duangsues.is_a? SaltedFish
def attach_function(name, func, args, returns = nil, options = nil) mname, a2, a3, a4, a5 = name, func, args, returns, options cname, arg_types, ret_type, opts = (a4 && (a2.is_a?(String) || a2.is_a?(Symbol))) ? [ a2, a3, a4, a5 ] : [ mname.to_s…
attach_function :getAS, 'Java_com_coolapk_market_util_AuthUtils_getAS', %i[string], :string
0x1cea: Java_com_coolapk_market_util_AuthUtils_getAS
0x1ca9: be
0x1bb0: me
0x1b84: bd
0x1b07: r
0x187e: MF
0x173a: MU
0x16fa: MI
0x8c4: BE
0x8a1: BEL
0x6c4: BD
0x664: BDL
0x1ca9: be
0x1bb0: me
0x1b84: bd
0x1b07: r
0x187e: MF
0x173a: MU
0x16fa: MI
0x8c4: BE
0x8a1: BEL
0x6c4: BD
0x664: BDL
dse@susepc:~$ r2 liba.so
[0x000005b0]> is
[Symbols]
004 0x00000664 0x00000664 GLOBAL FUNC 96 BDL
005 0x000006c4 0x000006c4 GLOBAL FUNC 477 BD
006 0x000008a1 0x000008a1 GLOBAL FUNC 35 BEL
007 0x000008c4 0x000008c4 GLOBAL FUNC 546 BE
008 0x000016fa 0x000016fa GLOBAL FUNC 64 MI
009 0x0000173a 0x0000173a GLOBAL FUNC 324 MU
011 0x0000187e 0x0000187e GLOBAL FUNC 649 MF
013 0x00001b07 0x00001b07 GLOBAL FUNC 125 r
015 0x00001b84 0x00001b84 GLOBAL FUNC 44 bd
016 0x00001bb0 0x00001bb0 GLOBAL FUNC 249 me
019 0x00001ca9 0x00001ca9 GLOBAL FUNC 65 be
020 0x00001cea 0x00001cea GLOBAL FUNC 1303 Java_com_coolapk_market_util_AuthUtils_getAS
023 0x00004004 0x00004004 GLOBAL NOTYPE 0 _edata
024 0x00004004 0x00004004 GLOBAL NOTYPE 0 __bss_start
025 0x00004004 0x00004004 GLOBAL NOTYPE 0 _end
001 0x00000540 0x00000540 GLOBAL FUNC 16 imp.__cxa_finalize
002 0x00000520 0x00000520 GLOBAL FUNC 16 imp.__cxa_atexit
003 0x00000530 0x00000530 GLOBAL FUNC 16 imp.__stack_chk_fail
010 0x00000550 0x00000550 GLOBAL FUNC 16 imp.memcpy
012 0x00000560 0x00000560 GLOBAL FUNC 16 imp.memset
014 0x00000570 0x00000570 GLOBAL FUNC 16 imp.strlen
017 0x00000000 0x00000000 GLOBAL OBJECT 16 imp.__stack_chk_guard
018 0x00000580 0x00000580 GLOBAL FUNC 16 imp.sprintf
021 0x00000590 0x00000590 GLOBAL FUNC 16 imp.time
022 0x000005a0 0x000005a0 GLOBAL FUNC 16 imp.strcat
[0x000005b0]> 0x00001cea
[0x00001cea]> aaaa
| lea eax, dword [local_d0h] |
| mov dword [esp], eax |
| call sym.r;[gb] |
| lea eax, dword [local_d0h] |
| mov dword [esp], eax |
| call sym.BDL;[gc] |
| mov dword [local_178h], eax
直播分析
| mov dword [esp], eax |
| call sym.r;[gb] |
| lea eax, dword [local_d0h] |
| mov dword [esp], eax |
| call sym.BDL;[gc] |
| mov dword [local_178h], eax
直播分析
- r 这个函数没有返回值，它负责对一个
- local_d0h 给 r 函数处理后又交给了 BDL 继续处理，结果放在了本地变量 local_178h 里
char * 进行处理- local_d0h 给 r 函数处理后又交给了 BDL 继续处理，结果放在了本地变量 local_178h 里
- bd 函数也没返回值，主逻辑里用 local_170h 给它处理了
- 后来以上 local 又给 r 处理了
- 后来它又被取长了
- 后来以上 local 又给 r 处理了
- 后来它又被取长了