文章目錄

• 前言
• 一、dalvik_system_DexFile.cc#DexFile_openDexFileNative 函數(shù)分析
• 二、oat_file_manager.cc#OpenDexFilesFromOat 函數(shù)分析
• 三、oat_file_assistant.cc#MakeUpToDate 函數(shù)分析
• 四、oat_file_assistant.cc#GenerateOatFileNoChecks 函數(shù)分析
• 五、oat_file_assistant.cc#Dex2Oat 函數(shù)分析

前言

---

在上一篇博客 【Android 逆向】ART 脫殼 ( DexClassLoader 脫殼 | DexClassLoader 構(gòu)造函數(shù) | 參考 Dalvik 的 DexClassLoader 類加載流程 ) 中 , 分析了 ART 虛擬機下 DexClassLoader 類加載器加載 dex 文件的 Java 層流程 , 與 Dalvik 虛擬機下基本一致 , 從 native 層開始不一致 , 本篇博客開始分析 native 層的類加載流程 ;

一、dalvik_system_DexFile.cc#DexFile_openDexFileNative 函數(shù)分析

---

在下面的 DexFile_openDexFileNative 方法中 ,

jstring javaSourceName 參數(shù)是要加載的 dex 文件路徑 ,

下面調(diào)用的 OpenDexFilesFromOat 函數(shù) , 是生成 oat 文件的關(guān)鍵流程入口 ;

dex_files = runtime->GetOatFileManager().OpenDexFilesFromOat(sourceName.c_str(),class_loader,dex_elements,/*out*/ &oat_file,/*out*/ &error_msgs);

dalvik_system_DexFile.cc#DexFile_openDexFileNative 源碼 :

// TODO(calin): clean up the unused parameters (here and in libcore). static jobject DexFile_openDexFileNative(JNIEnv* env,jclass,jstring javaSourceName,jstring javaOutputName ATTRIBUTE_UNUSED,jint flags ATTRIBUTE_UNUSED,jobject class_loader,jobjectArray dex_elements) {ScopedUtfChars sourceName(env, javaSourceName);if (sourceName.c_str() == nullptr) {return 0;}Runtime* const runtime = Runtime::Current();ClassLinker* linker = runtime->GetClassLinker();std::vector<std::unique_ptr<const DexFile>> dex_files;std::vector<std::string> error_msgs;// OAT 文件const OatFile* oat_file = nullptr;// ★ 核心跳轉(zhuǎn) dex_files = runtime->GetOatFileManager().OpenDexFilesFromOat(sourceName.c_str(),class_loader,dex_elements,/*out*/ &oat_file,/*out*/ &error_msgs);if (!dex_files.empty()) {jlongArray array = ConvertDexFilesToJavaArray(env, oat_file, dex_files);if (array == nullptr) {ScopedObjectAccess soa(env);for (auto& dex_file : dex_files) {if (linker->IsDexFileRegistered(soa.Self(), *dex_file)) {dex_file.release();}}}return array;} else {ScopedObjectAccess soa(env);CHECK(!error_msgs.empty());// The most important message is at the end. So set up nesting by going forward, which will// wrap the existing exception as a cause for the following one.auto it = error_msgs.begin();auto itEnd = error_msgs.end();for ( ; it != itEnd; ++it) {ThrowWrappedIOException("%s", it->c_str());}return nullptr;} }

源碼路徑 : /art/runtime/native/dalvik_system_DexFile.cc#DexFile_openDexFileNative

二、oat_file_manager.cc#OpenDexFilesFromOat 函數(shù)分析

---

先聲明 oat 文件對象 ,

// 聲明 OatFile 對象const OatFile* source_oat_file = nullptr;

然后判斷是否有生成 oat 文件 , 如果是第一次調(diào)用 , 肯定沒有生成 oat 文件 ,

!oat_file_assistant.IsUpToDate()

如果沒有生成 oat 文件 , 則執(zhí)行

oat_file_assistant.MakeUpToDate(/*profile_changed*/false, /*out*/ &error_msg)

方法 , 開始生成 oat 文件 ;

oat_file_manager.cc#OpenDexFilesFromOat 函數(shù)源碼 :

std::vector<std::unique_ptr<const DexFile>> OatFileManager::OpenDexFilesFromOat(const char* dex_location,jobject class_loader,jobjectArray dex_elements,const OatFile** out_oat_file,std::vector<std::string>* error_msgs) {ScopedTrace trace(__FUNCTION__);CHECK(dex_location != nullptr);CHECK(error_msgs != nullptr);// 驗證我們沒有持有mutator鎖，如果我們必須生成或重新定位oat文件，這可能會導(dǎo)致GC饑餓。Thread* const self = Thread::Current();Locks::mutator_lock_->AssertNotHeld(self);Runtime* const runtime = Runtime::Current();OatFileAssistant oat_file_assistant(dex_location,kRuntimeISA,!runtime->IsAotCompiler());// 鎖定目標oat位置以避免生成和加載oat文件。std::string error_msg;if (!oat_file_assistant.Lock(/*out*/&error_msg)) {// Don't worry too much if this fails. If it does fail, it's unlikely we// can generate an oat file anyway.VLOG(class_linker) << "OatFileAssistant::Lock: " << error_msg;}// 聲明 OatFile 對象const OatFile* source_oat_file = nullptr;// 判斷是否有生成 oat 文件 , 如果是第一次調(diào)用 , 肯定沒有生成 oat 文件if (!oat_file_assistant.IsUpToDate()) {// 如果可以，根據(jù)從當(dāng)前運行時選項派生的--compiler-filter選項更新磁盤上的oat文件// 這可能會失敗，但沒關(guān)系。這里最重要的是盡最大努力。// ★ 核心跳轉(zhuǎn) switch (oat_file_assistant.MakeUpToDate(/*profile_changed*/false, /*out*/ &error_msg)) {case OatFileAssistant::kUpdateFailed:LOG(WARNING) << error_msg;break;case OatFileAssistant::kUpdateNotAttempted:// 如果我們決定不嘗試更新oat文件，請避免濫發(fā)日志。VLOG(oat) << error_msg;break;case OatFileAssistant::kUpdateSucceeded:// Nothing to do.break;}}// Get the oat file on disk.std::unique_ptr<const OatFile> oat_file(oat_file_assistant.GetBestOatFile().release());if (oat_file != nullptr) {// 僅當(dāng)文件沒有沖突時才獲取該文件，否則我們必須獲取該文件，因為存在預(yù)選項。bool accept_oat_file =!HasCollisions(oat_file.get(), class_loader, dex_elements, /*out*/ &error_msg);if (!accept_oat_file) {// 沖突檢查失敗。打印警告。if (Runtime::Current()->IsDexFileFallbackEnabled()) {if (!oat_file_assistant.HasOriginalDexFiles()) {// 我們需要回退，但沒有原始的dex文件。// 我們必須回退到打開現(xiàn)有的oat文件。// 這可能不安全，因此我們對此發(fā)出警告。accept_oat_file = true;LOG(WARNING) << "Dex location " << dex_location << " does not seem to include dex file. "<< "Allow oat file use. This is potentially dangerous.";} else {// 我們必須回退并找到原始的dex文件-從APK中提取它們。// 同時警告此操作，因為它可能會造成浪費。LOG(WARNING) << "Found duplicate classes, falling back to extracting from APK : "<< dex_location;LOG(WARNING) << "NOTE: This wastes RAM and hurts startup performance.";}} else {// TODO: 我們應(yīng)該刪除這個。我們在這里的事實意味著沒有設(shè)置-Xno dex文件回退，// 這意味著我們永遠不應(yīng)該回退。// 如果我們沒有原始的dex文件，我們應(yīng)該按照標志的意圖失敗解析。if (!oat_file_assistant.HasOriginalDexFiles()) {accept_oat_file = true;}LOG(WARNING) << "Found duplicate classes, dex-file-fallback disabled, will be failing to "" load classes for " << dex_location;}LOG(WARNING) << error_msg;}if (accept_oat_file) {VLOG(class_linker) << "Registering " << oat_file->GetLocation();source_oat_file = RegisterOatFile(std::move(oat_file));*out_oat_file = source_oat_file;}}std::vector<std::unique_ptr<const DexFile>> dex_files;// Load the dex files from the oat file.if (source_oat_file != nullptr) {bool added_image_space = false;if (source_oat_file->IsExecutable()) {std::unique_ptr<gc::space::ImageSpace> image_space =kEnableAppImage ? oat_file_assistant.OpenImageSpace(source_oat_file) : nullptr;if (image_space != nullptr) {ScopedObjectAccess soa(self);StackHandleScope<1> hs(self);Handle<mirror::ClassLoader> h_loader(hs.NewHandle(soa.Decode<mirror::ClassLoader>(class_loader)));// Can not load app image without class loader.if (h_loader != nullptr) {std::string temp_error_msg;// Add image space has a race condition since other threads could be reading from the// spaces array.{ScopedThreadSuspension sts(self, kSuspended);gc::ScopedGCCriticalSection gcs(self,gc::kGcCauseAddRemoveAppImageSpace,gc::kCollectorTypeAddRemoveAppImageSpace);ScopedSuspendAll ssa("Add image space");runtime->GetHeap()->AddSpace(image_space.get());}{ScopedTrace trace2(StringPrintf("Adding image space for location %s", dex_location));added_image_space = runtime->GetClassLinker()->AddImageSpace(image_space.get(),h_loader,dex_elements,dex_location,/*out*/&dex_files,/*out*/&temp_error_msg);}if (added_image_space) {// Successfully added image space to heap, release the map so that it does not get// freed.image_space.release();} else {LOG(INFO) << "Failed to add image file " << temp_error_msg;dex_files.clear();{ScopedThreadSuspension sts(self, kSuspended);gc::ScopedGCCriticalSection gcs(self,gc::kGcCauseAddRemoveAppImageSpace,gc::kCollectorTypeAddRemoveAppImageSpace);ScopedSuspendAll ssa("Remove image space");runtime->GetHeap()->RemoveSpace(image_space.get());}// Non-fatal, don't update error_msg.}}}}if (!added_image_space) {DCHECK(dex_files.empty());dex_files = oat_file_assistant.LoadDexFiles(*source_oat_file, dex_location);}if (dex_files.empty()) {error_msgs->push_back("Failed to open dex files from " + source_oat_file->GetLocation());}}// Fall back to running out of the original dex file if we couldn't load any// dex_files from the oat file.if (dex_files.empty()) {if (oat_file_assistant.HasOriginalDexFiles()) {if (Runtime::Current()->IsDexFileFallbackEnabled()) {static constexpr bool kVerifyChecksum = true;if (!DexFile::Open(dex_location, dex_location, kVerifyChecksum, /*out*/ &error_msg, &dex_files)) {LOG(WARNING) << error_msg;error_msgs->push_back("Failed to open dex files from " + std::string(dex_location)+ " because: " + error_msg);}} else {error_msgs->push_back("Fallback mode disabled, skipping dex files.");}} else {error_msgs->push_back("No original dex files found for dex location "+ std::string(dex_location));}}return dex_files; }

源碼路徑 : /art/runtime/oat_file_manager.cc#OpenDexFilesFromOat

三、oat_file_assistant.cc#MakeUpToDate 函數(shù)分析

---

在 oat_file_assistant.cc#MakeUpToDate 函數(shù)中 , 最終調(diào)用了 GenerateOatFileNoChecks 函數(shù) , 執(zhí)行下一步操作 ;

oat_file_assistant.cc#MakeUpToDate 函數(shù)源碼 :

OatFileAssistant::ResultOfAttemptToUpdate OatFileAssistant::MakeUpToDate(bool profile_changed, std::string* error_msg) {CompilerFilter::Filter target;if (!GetRuntimeCompilerFilterOption(&target, error_msg)) {return kUpdateNotAttempted;}OatFileInfo& info = GetBestInfo();switch (info.GetDexOptNeeded(target, profile_changed)) {case kNoDexOptNeeded:return kUpdateSucceeded;// TODO: 現(xiàn)在，不要為我們打電話的各種方式而煩惱// dex2oat生成oat文件。始終生成oat文件，就像它// KDEX2O是從頭開始的。case kDex2OatFromScratch:case kDex2OatForBootImage:case kDex2OatForRelocation:case kDex2OatForFilter:// ★ 核心跳轉(zhuǎn) return GenerateOatFileNoChecks(info, target, error_msg);}UNREACHABLE(); }

源碼路徑 : /art/runtime/oat_file_assistant.cc#MakeUpToDate

四、oat_file_assistant.cc#GenerateOatFileNoChecks 函數(shù)分析

---

先判斷 Dex2Oat 當(dāng)前是否可用 , 如果不可用 , 直接返回 ;

!runtime->IsDex2OatEnabled()

oat_file_assistant.cc#GenerateOatFileNoChecks 函數(shù)源碼 :

OatFileAssistant::ResultOfAttemptToUpdate OatFileAssistant::GenerateOatFileNoChecks(OatFileAssistant::OatFileInfo& info, CompilerFilter::Filter filter, std::string* error_msg) {CHECK(error_msg != nullptr);Runtime* runtime = Runtime::Current();// 判斷 Dex2Oat 當(dāng)前是否可用 , 如果不可用 , 直接返回 if (!runtime->IsDex2OatEnabled()) {*error_msg = "Generation of oat file for dex location " + dex_location_+ " not attempted because dex2oat is disabled.";return kUpdateNotAttempted;}if (info.Filename() == nullptr) {*error_msg = "Generation of oat file for dex location " + dex_location_+ " not attempted because the oat file name could not be determined.";return kUpdateNotAttempted;}const std::string& oat_file_name = *info.Filename();const std::string& vdex_file_name = GetVdexFilename(oat_file_name);// dex2oat ignores missing dex files and doesn't report an error.// Check explicitly here so we can detect the error properly.// TODO: Why does dex2oat behave that way?struct stat dex_path_stat;if (TEMP_FAILURE_RETRY(stat(dex_location_.c_str(), &dex_path_stat)) != 0) {*error_msg = "Could not access dex location " + dex_location_ + ":" + strerror(errno);return kUpdateNotAttempted;}// If this is the odex location, we need to create the odex file layout (../oat/isa/..)if (!info.IsOatLocation()) {if (!PrepareOdexDirectories(dex_location_, oat_file_name, isa_, error_msg)) {return kUpdateNotAttempted;}}// Set the permissions for the oat and the vdex files.// The user always gets read and write while the group and others propagate// the reading access of the original dex file.mode_t file_mode = S_IRUSR | S_IWUSR |(dex_path_stat.st_mode & S_IRGRP) |(dex_path_stat.st_mode & S_IROTH);std::unique_ptr<File> vdex_file(OS::CreateEmptyFile(vdex_file_name.c_str()));if (vdex_file.get() == nullptr) {*error_msg = "Generation of oat file " + oat_file_name+ " not attempted because the vdex file " + vdex_file_name+ " could not be opened.";return kUpdateNotAttempted;}if (fchmod(vdex_file->Fd(), file_mode) != 0) {*error_msg = "Generation of oat file " + oat_file_name+ " not attempted because the vdex file " + vdex_file_name+ " could not be made world readable.";return kUpdateNotAttempted;}std::unique_ptr<File> oat_file(OS::CreateEmptyFile(oat_file_name.c_str()));if (oat_file.get() == nullptr) {*error_msg = "Generation of oat file " + oat_file_name+ " not attempted because the oat file could not be created.";return kUpdateNotAttempted;}if (fchmod(oat_file->Fd(), file_mode) != 0) {*error_msg = "Generation of oat file " + oat_file_name+ " not attempted because the oat file could not be made world readable.";oat_file->Erase();return kUpdateNotAttempted;}std::vector<std::string> args;args.push_back("--dex-file=" + dex_location_);args.push_back("--output-vdex-fd=" + std::to_string(vdex_file->Fd()));args.push_back("--oat-fd=" + std::to_string(oat_file->Fd()));args.push_back("--oat-location=" + oat_file_name);args.push_back("--compiler-filter=" + CompilerFilter::NameOfFilter(filter));// ★ 核心跳轉(zhuǎn) if (!Dex2Oat(args, error_msg)) {// Manually delete the oat and vdex files. This ensures there is no garbage// left over if the process unexpectedly died.vdex_file->Erase();unlink(vdex_file_name.c_str());oat_file->Erase();unlink(oat_file_name.c_str());return kUpdateFailed;}if (vdex_file->FlushCloseOrErase() != 0) {*error_msg = "Unable to close vdex file " + vdex_file_name;unlink(vdex_file_name.c_str());return kUpdateFailed;}if (oat_file->FlushCloseOrErase() != 0) {*error_msg = "Unable to close oat file " + oat_file_name;unlink(oat_file_name.c_str());return kUpdateFailed;}// Mark that the odex file has changed and we should try to reload.info.Reset();return kUpdateSucceeded; }

源碼路徑 : /art/runtime/oat_file_assistant.cc#GenerateOatFileNoChecks

五、oat_file_assistant.cc#Dex2Oat 函數(shù)分析

---

在 oat_file_assistant.cc#Dex2Oat 函數(shù)中 , 主要是準備 Dex2Oat 可執(zhí)行二進制程序的相關(guān)參數(shù) ,

最終調(diào)用了

Exec(argv, error_msg)

函數(shù) , 完成 Dex2Oat 執(zhí)行的過程 ;

oat_file_assistant.cc#Dex2Oat 函數(shù)源碼 :

bool OatFileAssistant::Dex2Oat(const std::vector<std::string>& args,std::string* error_msg) {Runtime* runtime = Runtime::Current();std::string image_location = ImageLocation();if (image_location.empty()) {*error_msg = "No image location found for Dex2Oat.";return false;}std::vector<std::string> argv;argv.push_back(runtime->GetCompilerExecutable());argv.push_back("--runtime-arg");argv.push_back("-classpath");argv.push_back("--runtime-arg");std::string class_path = runtime->GetClassPathString();if (class_path == "") {class_path = OatFile::kSpecialSharedLibrary;}argv.push_back(class_path);if (runtime->IsJavaDebuggable()) {argv.push_back("--debuggable");}runtime->AddCurrentRuntimeFeaturesAsDex2OatArguments(&argv);if (!runtime->IsVerificationEnabled()) {argv.push_back("--compiler-filter=verify-none");}if (runtime->MustRelocateIfPossible()) {argv.push_back("--runtime-arg");argv.push_back("-Xrelocate");} else {argv.push_back("--runtime-arg");argv.push_back("-Xnorelocate");}if (!kIsTargetBuild) {argv.push_back("--host");}argv.push_back("--boot-image=" + image_location);std::vector<std::string> compiler_options = runtime->GetCompilerOptions();argv.insert(argv.end(), compiler_options.begin(), compiler_options.end());argv.insert(argv.end(), args.begin(), args.end());std::string command_line(android::base::Join(argv, ' '));// ★ 核心跳轉(zhuǎn)return Exec(argv, error_msg); }

源碼路徑 : /art/runtime/oat_file_assistant.cc#Dex2Oat

總結(jié)

以上是生活随笔為你收集整理的【Android 逆向】ART 脱壳 ( DexClassLoader 脱壳 | oat_file_assistant.cc 中涉及的 oat 文件生成流程 )的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。