Shulou(Shulou.com)05/31 Report--

This article introduces the relevant knowledge of "what is the method of dynamically exporting dex files in Android". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

1. Start ida port snooping 1.1 start Android_server service

1.2 Port Forwardin

1.3 Software enters debug mode

2.ida downtime 2.1attach additional process

2.2 break three items

2.3 Select process

2.4 Open Modules

Search art

PS: a little knowledge

Before Android version 4.4, the system functions are in libdvm.so.

After Android 5.0, the system function is in libart.so

2.5 Open the Openmemory () function

Search for the Openmemory function in libart.so and follow it.

PS: a little knowledge

Generally speaking, the system dex will be loaded in this function, but there will be a problem, as described later.

2.6 Lower breakpoint

3. Run the program to the next break 3.1 jdb forward the running program

3.2View IDA running

Successfully cut off, and run to where we cut off.

3.3View the location of dex

Open the register window and you can see that R1 is our dex

Then open R1 in the Hex window.

You can clearly see the binary structure of the dex file. If you don't understand, you can take a look at the previous dex file analysis.

3.4 extracting key information

The first key message: address offset: 0xF35CA328

The second key message: file offset: 70 35 01 00, which is converted to 0x00013570.

Add using a hexadecimal adder, F35DD898

4. Dump4.1 uses scripts for dump

Static main (void) {auto fp, begin, end, dexbyte; / / Open or create a file fp = fopen ("d:\\ dump.dex", "wb"); / / dex base address begin = 0xF34C6320; / / dex base address + dex file size end = begin + 0x00013570; for (dexbyte = begin; dexbyte < end; dexbyte +) {/ / dump it to the local file by byte fputc (Byte (dexbyte), fp);}}

4.2 script dump run

Once the script is completed, click run.

4.3 successful dump

This is the end of the content of "what is the method of dynamically exporting dex files in Android". Thank you for your reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.