android oat如何提取dex文件字节码,Android: 使用oatdump反编译oat文件
網上經常看到有通過apktool將apk中的dex反編譯成smali格式的文件，以便分析功能實現與破—解，確沒怎么看到oat文件反通過oatdump反編譯的，所以就寫了一篇這樣的文檔。聲明一下oat文件也是可以反編譯的。本來想著通過oatdump處理之后，既可以看到dex代碼又可以看到相應的匯編實現。反編譯之后發現其實不然，難道是因為系統是eng版本的原因，有機會再驗證看看。
先看一下這兩個代碼片段
1. JNI代碼: jni/com_android_hello_HelloActivity.cpp
#include
#include
extern "C" void Java_com_android_hello_HelloActivity_sayHello(JNIEnv *, jobject)
{
__builtin_trap();
}
使APP出現native crash
2. Java代碼: src/com/android/hello/HelloActivity.java
public class HelloActivity extends Activity {
@Override
public void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
sayHello();
}
static {
System.loadLibrary("hello-jni");
}
private static native void sayHello();
}
加載JNI庫libhello-jni.so, 并且在app launch時調用JNI方法sayHello()。
APK安裝時會執行dex2oat命令，生成oat文件:
03-11 23:06:38.748 11835 11902 D PackageManager: Renaming /data/app/vmdl111617587.tmp to /data/app/com.android.hello-1
03-11 23:06:38.774 11835 11902 I PackageManager: Running dexopt on: /data/app/com.android.hello-1/base.apk pkg=com.android.hello isa=arm vmSafeMode=false
03-11 23:06:38.800 18221 18221 I dex2oat : /system/bin/dex2oat --zip-fd=6 --zip-location=/data/app/com.android.hello-1/base.apk --oat-fd=7 --oat-location=/data/dalvik-cache/arm/data@app@com.android.hello-1@base.apk@classes.dex --instruction-set=arm --instruction-set-features=div --runtime-arg -Xms64m --runtime-arg -Xmx512m --compiler-filter=interpret-only --swap-fd=8
03-11 23:06:38.818 18221 18221 I dex2oat : Decided to run without swap.
03-11 23:06:38.838 18221 18221 I dex2oat : dex2oat took 38.211ms (threads: 4) arena alloc=0B java alloc=7KB native alloc=75KB free=32KB
oat文件是什么：
$ adb pull /data/dalvik-cache/arm/data@app@com.android.hello-1@base.apk@classes.dex
1236 KB/s (12720 bytes in 0.010s)
$ file data\@app\@com.android.hello-1\@base.apk\@classes.dex
data@app@com.android.hello-1@base.apk@classes.dex: ELF 32-bit LSB shared object, ARM, version 1 (GNU/Linux), dynamically linked, stripped
是一個ELF可執行文件。執行readelf/arm-linux-androideabi-readelf命令看看：
$ arm-linux-androideabi-readelf -a data\@app\@com.android.hello-1\@base.apk\@classes.dex
ELF Header:
Magic: 7f 45 4c 46 01 01 01 03 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - GNU
ABI Version: 0
Type: DYN (Shared object file)
Machine: ARM
Version: 0x1
Entry point address: 0x0
Start of program headers: 52 (bytes into file)
Start of section headers: 12400 (bytes into file)
Flags: 0x5000000, Version5 EABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 5
Size of section headers: 40 (bytes)
Number of section headers: 8
Section header string table index: 7
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .dynsym DYNSYM 000000d4 0000d4 000040 10 A 2 0 4
[ 2] .dynstr STRTAB 00000114 000114 00004f 01 A 0 0 1
[ 3] .hash HASH 00000164 000164 000020 04 A 1 0 4
[ 4] .rodata PROGBITS 00001000 001000 001000 00 A 0 0 4096
[ 5] .text PROGBITS 00002000 002000 000094 00 AX 0 0 4096
[ 6] .dynamic DYNAMIC 00003000 003000 000038 08 A 1 0 4096
[ 7] .shstrtab STRTAB 00000000 003038 000038 01 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings)
I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)
O (extra OS processing required) o (OS specific), p (processor specific)
There are no section groups in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x00000034 0x00000034 0x000a0 0x000a0 R 0x4
LOAD 0x000000 0x00000000 0x00000000 0x02000 0x02000 R 0x1000
LOAD 0x002000 0x00002000 0x00002000 0x00094 0x00094 R E 0x1000
LOAD 0x003000 0x00003000 0x00003000 0x00038 0x00038 RW 0x1000
DYNAMIC 0x003000 0x00003000 0x00003000 0x00038 0x00038 RW 0x1000
Section to Segment mapping:
Segment Sections...
00
01 .dynsym .dynstr .hash .rodata
02 .text
03 .dynamic
04 .dynamic
Dynamic section at offset 0x3000 contains 7 entries:
Tag Type Name/Value
0x00000004 (HASH) 0x164
0x00000005 (STRTAB) 0x114
0x00000006 (SYMTAB) 0xd4
0x0000000b (SYMENT) 16 (bytes)
0x0000000a (STRSZ) 79 (bytes)
0x0000000e (SONAME) Library soname: [data@app@com.android.hello-1@base.apk@classes.dex]
0x00000000 (NULL) 0x0
There are no relocations in this file.
There are no unwind sections in this file.
Symbol table '.dynsym' contains 4 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 00000000 0 NOTYPE LOCAL DEFAULT UND
1: 00001000 4096 OBJECT GLOBAL DEFAULT 4 oatdata
2: 00002000 148 OBJECT GLOBAL DEFAULT 5 oatexec
3: 00002090 4 OBJECT GLOBAL DEFAULT 5 oatlastword
Histogram for bucket list length (total of 2 buckets):
Length Number % of total Coverage
0 0 ( 0.0%)
1 1 ( 50.0%) 33.3%
2 1 ( 50.0%) 100.0%
No version information found in this file.
能使用objdump/arm-linux-androideabi-objdum反編譯嗎：
$ arm-linux-androideabi-objdump -d data\@app\@com.android.hello-1\@base.apk\@classes.dex
data@app@com.android.hello-1@base.apk@classes.dex: file format elf32-littlearm
Disassembly of section .text:
00002000 :
...
200c:30 00 00 00 e0 4d 00 00 00 00 00 00 78 00 00 00 0....M......x...
201c:2d e9 e0 4d ad f2 14 0d 00 90 4f f0 01 0c cd f8 -..M......O.....
202c:08 c0 d9 f8 c8 c0 cd f8 04 c0 0d f2 04 0c c9 f8 ................
203c:c8 c0 d0 f8 08 c0 cd f8 0c c0 c9 f8 8c d0 4f f0 ..............O.
204c:00 0c c9 f8 90 c0 48 46 d0 f8 94 c1 e0 47 04 90 ......HF.....G..
205c:0d f2 0c 01 d9 f8 98 00 dd f8 00 c0 dc f8 28 c0 ..............(.
206c:e0 47 04 98 49 46 d1 f8 9c c1 e0 47 d9 f8 7c c0 .G..IF.....G..|.
207c:bc f1 00 0f 03 d1 0d f2 14 0d bd e8 e0 8d 60 46 ..............`F
208c:d9 f8 34 c2 ..4.
00002090 :
2090:e0 47 00 be .G..
沒什么內容。
最后，我們用oatdump命令查看一下：
$ oatdump --oat-file=data\@app\@com.android.hello-1\@base.apk\@classes.dex
MAGIC:
oat
045
CHECKSUM:
0x864eeade
INSTRUCTION SET:
Thumb2
INSTRUCTION SET FEATURES:
div
DEX FILE COUNT:
1
EXECUTABLE OFFSET:
0x00001000
INTERPRETER TO INTERPRETER BRIDGE OFFSET:
0x00000000
INTERPRETER TO COMPILED CODE BRIDGE OFFSET:
0x00000000
JNI DLSYM LOOKUP OFFSET:
0x00000000
PORTABLE IMT CONFLICT TRAMPOLINE OFFSET:
0x00000000
PORTABLE RESOLUTION TRAMPOLINE OFFSET:
0x00000000
PORTABLE TO INTERPRETER BRIDGE OFFSET:
0x00000000
QUICK GENERIC JNI TRAMPOLINE OFFSET:
0x00000000
QUICK IMT CONFLICT TRAMPOLINE OFFSET:
0x00000000
QUICK RESOLUTION TRAMPOLINE OFFSET:
0x00000000
QUICK TO INTERPRETER BRIDGE OFFSET:
0x00000000
IMAGE PATCH DELTA:
0 (0x00000000)
IMAGE FILE LOCATION OAT CHECKSUM:
0x8223fe58
IMAGE FILE LOCATION OAT BEGIN:
0x70dd0000
KEY VALUE STORE:
dex2oat-cmdline = --zip-fd=6 --zip-location=/data/app/com.android.hello-1/base.apk --oat-fd=7 --oat-location=/data/dalvik-cache/arm/data@app@com.android.hello-1@base.apk@classes.dex --instruction-set=arm --instruction-set-features=div --runtime-arg -Xms64m --runtime-arg -Xmx512m --compiler-filter=interpret-only --swap-fd=8
dex2oat-host = Arm
image-location = /data/dalvik-cache/arm/system@framework@boot.art
pic = false
SIZE:
4244
OatDexFile:
location: /data/app/com.android.hello-1/base.apk
checksum: 0x2e3d006c
0: Lcom/android/hello/HelloActivity; (offset=0x00000578) (type_idx=2) (StatusVerified) (OatClassSomeCompiled)
0: void com.android.hello.HelloActivity.() (dex_method_idx=2)
DEX CODE:
0x0000: const-string v0, "hello-jni" // string@10
0x0002: invoke-static {v0}, void java.lang.System.loadLibrary(java.lang.String) // method@6
0x0005: return-void
OatMethodOffsets (offset=0x00000000)
code_offset: 0x00000000
gc_map: (offset=0x00000000)
OatQuickMethodHeader (offset=0x00000000)
mapping_table: (offset=0x00000000)
vmap_table: (offset=0x00000000)
QuickMethodFrameInfo
frame_size_in_bytes: 0
core_spill_mask: 0x00000000
fp_spill_mask: 0x00000000
CODE: (code_offset=0x00000000 size_offset=0x00000000 size=0)
NO CODE!
1: void com.android.hello.HelloActivity.() (dex_method_idx=3)
DEX CODE:
0x0000: invoke-direct {v0}, void android.app.Activity.() // method@0
0x0003: return-void
OatMethodOffsets (offset=0x00000000)
code_offset: 0x00000000
gc_map: (offset=0x00000000)
OatQuickMethodHeader (offset=0x00000000)
mapping_table: (offset=0x00000000)
vmap_table: (offset=0x00000000)
QuickMethodFrameInfo
frame_size_in_bytes: 0
core_spill_mask: 0x00000000
fp_spill_mask: 0x00000000
CODE: (code_offset=0x00000000 size_offset=0x00000000 size=0)
NO CODE!
2: void com.android.hello.HelloActivity.sayHello() (dex_method_idx=5)
DEX CODE:
OatMethodOffsets (offset=0x00000584)
code_offset: 0x0000101d
gc_map: (offset=0x00000000)
OatQuickMethodHeader (offset=0x00001000)
mapping_table: (offset=0x00000000)
vmap_table: (offset=0x00000000)
QuickMethodFrameInfo
frame_size_in_bytes: 48
core_spill_mask: 0x00004de0 (r5, r6, r7, r8, r10, r11, r14)
fp_spill_mask: 0x00000000
CODE: (code_offset=0x0000101d size_offset=0x00001018 size=120)...
0x0000101c: e92d4de0push {r5, r6, r7, r8, r10, r11, lr}
0x00001020: f2ad0d14subw sp, sp, #20
0x00001024: 9000 str r0, [sp, #0]
0x00001026: f04f0c01mov.w r12, #1
0x0000102a: f8cdc008str.w r12, [sp, #8]
0x0000102e: f8d9c0c8ldr.w r12, [r9, #200] ; top_handle_scope
0x00001032: f8cdc004str.w r12, [sp, #4]
0x00001036: f20d0c04addw r12, sp, #4
0x0000103a: f8c9c0c8str.w r12, [r9, #200]
0x0000103e: f8d0c008ldr.w r12, [r0, #8]
0x00001042: f8cdc00cstr.w r12, [sp, #12]
0x00001046: f8c9d08cstr.w sp, [r9, #140]
0x0000104a: f04f0c00mov.w r12, #0
0x0000104e: f8c9c090str.w r12, [r9, #144]
0x00001052: 4648 mov r0, r9
0x00001054: f8d0c194ldr.w r12, [r0, #404]
0x00001058: 47e0 blx r12
0x0000105a: 9004 str r0, [sp, #16]
0x0000105c: f20d010caddw r1, sp, #12
0x00001060: f8d90098ldr.w r0, [r9, #152] ; jni_env
0x00001064: f8ddc000ldr.w r12, [sp, #0]
0x00001068: f8dcc028ldr.w r12, [r12, #40]
0x0000106c: 47e0 blx r12
0x0000106e: 9804 ldr r0, [sp, #16]
0x00001070: 4649 mov r1, r9
0x00001072: f8d1c19cldr.w r12, [r1, #412]
0x00001076: 47e0 blx r12
0x00001078: f8d9c07cldr.w r12, [r9, #124] ; exception
0x0000107c: f1bc0f00cmp.w r12, #0
0x00001080: d103 bne +6 (0x0000108a)
0x00001082: f20d0d14addw sp, sp, #20
0x00001086: e8bd8de0pop {r5, r6, r7, r8, r10, r11, pc}
0x0000108a: 4660 mov r0, r12
0x0000108c: f8d9c234ldr.w r12, [r9, #564] ; pDeliverException
0x00001090: 47e0 blx r12
0x00001092: be00
3: void com.android.hello.HelloActivity.onCreate(android.os.Bundle) (dex_method_idx=4)
DEX CODE:
0x0000: invoke-super {v0, v1}, void android.app.Activity.onCreate(android.os.Bundle) // method@1
0x0003: invoke-static {}, void com.android.hello.HelloActivity.sayHello() // method@5
0x0006: return-void
OatMethodOffsets (offset=0x00000000)
code_offset: 0x00000000
gc_map: (offset=0x00000000)
OatQuickMethodHeader (offset=0x00000000)
mapping_table: (offset=0x00000000)
vmap_table: (offset=0x00000000)
QuickMethodFrameInfo
frame_size_in_bytes: 0
core_spill_mask: 0x00000000
fp_spill_mask: 0x00000000
CODE: (code_offset=0x00000000 size_offset=0x00000000 size=0)
NO CODE!
看來oat文件中既包含dex代碼，又包啟匯編代碼，不知道是不是因為我手機是eng版本的。相關系統屬性如下(Nexus4 android-5.1.1_r17(lmy48t)：
[dalvik.vm.dex2oat-Xms]: [64m]
[dalvik.vm.dex2oat-Xmx]: [512m]
[dalvik.vm.dex2oat-filter]: [interpret-only]
[dalvik.vm.dexopt-flags]: [m=y]
[dalvik.vm.image-dex2oat-Xms]: [64m]
[dalvik.vm.image-dex2oat-Xmx]: [64m]
[dalvik.vm.image-dex2oat-filter]: [verify-none]
相關的參考文檔，ART and Dalvik:?https://source.android.com/devices/tech/dalvik/index.html
1. Bytecode Format:?https://source.android.com/devices/tech/dalvik/dalvik-bytecode.html
2. .Dex Format:?https://source.android.com/devices/tech/dalvik/dex-format.html
3. Instruction Formats:?https://source.android.com/devices/tech/dalvik/instruction-formats.html
總結
以上是生活随笔為你收集整理的android oat如何提取dex文件字节码,Android: 使用oatdump反编译oat文件的全部內容，希望文章能夠幫你解決所遇到的問題。
- 上一篇： java+boolean+属性,java
- 下一篇： android 遍历sdcard,And