The method of encryption and parsing of java unidbg Ollvm string

Today, the editor will share with you the relevant knowledge points about the method of java unidbg Ollvm string encryption and parsing. The content is detailed and the logic is clear. I believe most people still know too much about this, so share this article for your reference. I hope you can get something after reading this article. Let's take a look.

Unidbg Ollvm string encryption parsing

Principle: after loading so in memory using mem hook of unicorn, dump produces pure data. There are two ways:

Core method

Method 1: use getBackend () to replicate the memory hook method of Unicorn.

Method 2: use traceCode () to trace the specified memory segment and hook memory data.

Note that getBackend is driven by Unicorn, so it can only be used on dbg's unicorn engine

Take getBackend as an example

Emulator.getBackend () .hook_add_new (new WriteHook () {@ Override public void hook (Backend backend, long address, int size, long value, Object user) {System.out.println (Long.toHexString (address) + "- -" + size + "- -" + value); byte [] bytes = long2Bytes (value, size); modifyMap.put (address, bytes);}, 0, Long.MAX_VALUE, null)

Java

_ copy _

This allows hook to hook in-memory data at a specified time.

Derivation

Of course, you can encapsulate a GUI so that the work can be done with a click of the mouse.

These are all the contents of this article entitled "the method of java unidbg Ollvm string encryption and parsing". Thank you for reading! I believe you will gain a lot after reading this article. The editor will update different knowledge for you every day. If you want to learn more knowledge, please pay attention to the industry information channel.