文章目錄

• 一、ART 虛擬機下 DexClassLoader 類加載器脫殼點總結
• • 1、file_magic.cc#OpenAndReadMagic 函數(shù)
  • 2、dex_file.cc#DexFile::OpenCommon
  • 3、dex_file.cc#DexFile::DexFile
• 總結 ( 兼容 InMemoryDexClassLoader 和 DexClassLoader 兩種類加載器的 脫殼點 )

一、ART 虛擬機下 DexClassLoader 類加載器脫殼點總結

---

從 /art/runtime/dex_file.cc#DexFile::Open 函數(shù)開始分析脫殼點位置 ;

其中調用的 /art/runtime/base/file_magic.cc#OpenAndReadMagic 函數(shù) , 可以作為脫殼點 ;

在 /art/runtime/dex_file.cc#OpenFile 函數(shù)中 , 調用了 /art/runtime/dex_file.cc#OpenCommon 函數(shù) , 是脫殼點 ;

bool DexFile::Open(const char* filename,const std::string& location,bool verify_checksum,std::string* error_msg,std::vector<std::unique_ptr<const DexFile>>* dex_files) {ScopedTrace trace(std::string("Open dex file ") + std::string(location));DCHECK(dex_files != nullptr) << "DexFile::Open: out-param is nullptr";uint32_t magic;// ★ 脫殼點后漢書 File fd = OpenAndReadMagic(filename, &magic, error_msg);if (fd.Fd() == -1) {DCHECK(!error_msg->empty());return false;}if (IsZipMagic(magic)) {return DexFile::OpenZip(fd.Release(), location, verify_checksum, error_msg, dex_files);}if (IsDexMagic(magic)) {// ★ 脫殼點函數(shù)std::unique_ptr<const DexFile> dex_file(DexFile::OpenFile(fd.Release(),location,/* verify */ true,verify_checksum,error_msg));if (dex_file.get() != nullptr) {dex_files->push_back(std::move(dex_file));return true;} else {return false;}}*error_msg = StringPrintf("Expected valid zip or dex file: '%s'", filename);return false; }

1、file_magic.cc#OpenAndReadMagic 函數(shù)

file_magic.cc#OpenAndReadMagic 函數(shù)是 脫殼點 , 第一個參數(shù) const char* filename 是 Dex 文件的路徑 ;

調用該函數(shù)的上一個調用位置是 /art/runtime/dex_file.cc#DexFile::Open 函數(shù) ;

file_magic.cc 源碼 :

#include "file_magic.h"#include <fcntl.h> #include <sys/stat.h> #include <sys/types.h>#include "android-base/stringprintf.h"#include "base/logging.h" #include "base/unix_file/fd_file.h" #include "dex_file.h"namespace art {using android::base::StringPrintf;File OpenAndReadMagic(const char* filename, uint32_t* magic, std::string* error_msg) {CHECK(magic != nullptr);File fd(filename, O_RDONLY, /* check_usage */ false);if (fd.Fd() == -1) {*error_msg = StringPrintf("Unable to open '%s' : %s", filename, strerror(errno));return File();}int n = TEMP_FAILURE_RETRY(read(fd.Fd(), magic, sizeof(*magic)));if (n != sizeof(*magic)) {*error_msg = StringPrintf("Failed to find magic in '%s'", filename);return File();}if (lseek(fd.Fd(), 0, SEEK_SET) != 0) {*error_msg = StringPrintf("Failed to seek to beginning of file '%s' : %s", filename,strerror(errno));return File();}return fd; }bool IsZipMagic(uint32_t magic) {return (('P' == ((magic >> 0) & 0xff)) &&('K' == ((magic >> 8) & 0xff))); }bool IsDexMagic(uint32_t magic) {return DexFile::IsMagicValid(reinterpret_cast<const uint8_t*>(&magic)); }} // namespace art

源碼路徑 : /art/runtime/base/file_magic.cc#OpenAndReadMagic

2、dex_file.cc#DexFile::OpenCommon

dex_file.cc#DexFile::OpenCommon 函數(shù)中 , 可以獲取 Dex 文件在內存中的起始地址 ;

注意 : 該脫殼點 與 InMemoryDexClassLoader 類加載器的脫殼點重合 ;

std::unique_ptr<DexFile> DexFile::OpenCommon(const uint8_t* base,size_t size,const std::string& location,uint32_t location_checksum,const OatDexFile* oat_dex_file,bool verify,bool verify_checksum,std::string* error_msg,VerifyResult* verify_result) {if (verify_result != nullptr) {*verify_result = VerifyResult::kVerifyNotAttempted;}std::unique_ptr<DexFile> dex_file(new DexFile(base,size,location,location_checksum,oat_dex_file));if (dex_file == nullptr) {*error_msg = StringPrintf("Failed to open dex file '%s' from memory: %s", location.c_str(),error_msg->c_str());return nullptr;}if (!dex_file->Init(error_msg)) {dex_file.reset();return nullptr;}if (verify && !DexFileVerifier::Verify(dex_file.get(),dex_file->Begin(),dex_file->Size(),location.c_str(),verify_checksum,error_msg)) {if (verify_result != nullptr) {*verify_result = VerifyResult::kVerifyFailed;}return nullptr;}if (verify_result != nullptr) {*verify_result = VerifyResult::kVerifySucceeded;}return dex_file; }

源碼地址 : /art/runtime/dex_file.cc#OpenCommon

3、dex_file.cc#DexFile::DexFile

在 dex_file.cc#DexFile::DexFile 構造函數(shù)中 , 可以獲取到 Dex 文件地址 ;

注意 : 該脫殼點 與 InMemoryDexClassLoader 類加載器的脫殼點重合 ;

DexFile::DexFile(const uint8_t* base,size_t size,const std::string& location,uint32_t location_checksum,const OatDexFile* oat_dex_file): begin_(base),size_(size),location_(location),location_checksum_(location_checksum),header_(reinterpret_cast<const Header*>(base)),string_ids_(reinterpret_cast<const StringId*>(base + header_->string_ids_off_)),type_ids_(reinterpret_cast<const TypeId*>(base + header_->type_ids_off_)),field_ids_(reinterpret_cast<const FieldId*>(base + header_->field_ids_off_)),method_ids_(reinterpret_cast<const MethodId*>(base + header_->method_ids_off_)),proto_ids_(reinterpret_cast<const ProtoId*>(base + header_->proto_ids_off_)),class_defs_(reinterpret_cast<const ClassDef*>(base + header_->class_defs_off_)),method_handles_(nullptr),num_method_handles_(0),call_site_ids_(nullptr),num_call_site_ids_(0),oat_dex_file_(oat_dex_file) {CHECK(begin_ != nullptr) << GetLocation();CHECK_GT(size_, 0U) << GetLocation();// Check base (=header) alignment.// Must be 4-byte aligned to avoid undefined behavior when accessing// any of the sections via a pointer.CHECK_ALIGNED(begin_, alignof(Header));InitializeSectionsFromMapList(); }

源碼地址 : /art/runtime/dex_file.cc#DexFile

---

總結 ( 兼容 InMemoryDexClassLoader 和 DexClassLoader 兩種類加載器的 脫殼點 )

加固廠商可能使用 InMemoryDexClassLoader 類加載器 , 也可能使用 DexClassLoader 類加載器 , 這里為了保證不管使用什么類加載器 , 都可以進行脫殼 , 選擇 $2$ 個類加載器都有的脫殼點 , 可以兼容兩種類加載器 ;

總結

以上是生活随笔為你收集整理的【Android 逆向】ART 脱壳 ( DexClassLoader 脱壳 | ART 虚拟机下 DexClassLoader 类加载器脱壳点总结 )的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內容還不錯，歡迎將生活随笔推薦給好友。