本文为看雪论坛精华文章
看雪论坛作者ID：Bet4
现有的Android so库调试方法
使用Qiling仿真框架运行Android Runtime
typedef int(*JNI_CreateJavaVM_t)(void *, void *, void *);JNIEXPORT void InitializeSignalChain () {}JNIEXPORT void ClaimSignalChain() {}int init_jvm(JavaVM **m_jvm, JNIEnv **m_env){JavaVMOption opt[1];opt[0].optionString = "-Xnorelocate";JavaVMInitArgs args;args.version = JNI_VERSION_1_6;args.options = opt;args.nOptions = 1;void *libart_dso = dlopen("libart.so", RTLD_NOW);if (!libart_dso )return -1;JNI_CreateJavaVM_t JNI_CreateJavaVM;JNI_CreateJavaVM = (JNI_CreateJavaVM_t)dlsym(libart_dso, "JNI_CreateJavaVM");if (!JNI_CreateJavaVM)return -1;signed int result = JNI_CreateJavaVM(&(*m_jvm), &(*m_env), &args);if ( result != 0)return -1;return 0;}int main(){JavaVM * vm = NULL;JNIEnv * env = NULL;int status = init_jvm(&vm, &env);if (status == 0) {printf("Initialization success (vm=%p, env=%p)n", vm, env);} else {printf("Initialization failure (%i)n", status);return -1;}jstring testy = (*env)->NewStringUTF(env, "Hello world!");const char *str = (*env)->GetStringUTFChars(env, testy, NULL);printf("JNI: %sn", str);return 0;}
/opt/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/bin/armv7a-linux-androideabi23-clang -Wl,--export-dynamic jniart.c -o arm_android_jniart/opt/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android23-clang -Wl,--export-dynamic jniart.c -o arm64_android_jniart
from qiling import *ql = Qiling(["android6.0/bin/arm64_android_jniart"], "android6.0")ql.run()
make framework linker linker_32 libart libart_32 libstdc++ libstdc++_32├── bin│ ├── linker│ └── linker64├── framework│ ├── arm│ │ ├── boot.art│ │ └── boot.oat│ ├── arm64│ │ ├── boot.art│ │ └── boot.oat│ ├── framework.jar│ └── framework-res.apk├── lib│ ├── libart.so│ ├── libaudioutils.so│ ├── libbacktrace.so│ ├── libbase.so│ ├── libbinder.so│ ├── libcamera_client.so│ ├── libcamera_metadata.so│ ├── libcommon_time_client.so│ ├── libcrypto.so│ ├── libc++.so│ ├── libc.so│ ├── libcutils.so│ ├── libdl.so│ ├── libEGL.so│ ├── libexpat.so│ ├── libGLES_trace.so│ ├── libGLESv2.so│ ├── libGLESv3.so -> libGLESv2.so│ ├── libgui.so│ ├── libhardware.so│ ├── libicui18n.so│ ├── libicuuc.so│ ├── libjavacore.so│ ├── libjavacrypto.so│ ├── libkeymaster1.so│ ├── libkeymaster_messages.so│ ├── libkeystore_binder.so│ ├── libkeystore-engine.so│ ├── liblog.so│ ├── libmedia.so│ ├── libm.so│ ├── libnativebridge.so│ ├── libnativehelper.so│ ├── libnbaio.so│ ├── libpowermanager.so│ ├── libprotobuf-cpp-lite.so│ ├── librtp_jni.so│ ├── libsigchain.so│ ├── libsoftkeymasterdevice.so│ ├── libsonivox.so│ ├── libspeexresampler.so│ ├── libssl.so│ ├── libstagefright_amrnb_common.so│ ├── libstagefright_foundation.so│ ├── libstdc++.so│ ├── libsync.so│ ├── libui.so│ ├── libunwind.so│ ├── libutils.so│ └── libz.so├── lib64│ ├── libart.so│ ├── libaudioutils.so│ ├── libbacktrace.so│ ├── libbase.so│ ├── libbinder.so│ ├── libcamera_client.so│ ├── libcamera_metadata.so│ ├── libcommon_time_client.so│ ├── libcrypto.so│ ├── libc++.so│ ├── libc.so│ ├── libcutils.so│ ├── libdl.so│ ├── libEGL.so│ ├── libexpat.so│ ├── libGLES_trace.so│ ├── libGLESv2.so│ ├── libGLESv3.so -> libGLESv2.so│ ├── libgui.so│ ├── libhardware.so│ ├── libicui18n.so│ ├── libicuuc.so│ ├── libjavacore.so│ ├── libjavacrypto.so│ ├── libkeymaster1.so│ ├── libkeymaster_messages.so│ ├── libkeystore_binder.so│ ├── libkeystore-engine.so│ ├── liblog.so│ ├── libmedia.so│ ├── libm.so│ ├── libnativebridge.so│ ├── libnativehelper.so│ ├── libnbaio.so│ ├── libpowermanager.so│ ├── libprotobuf-cpp-lite.so│ ├── librtp_jni.so│ ├── libsigchain.so│ ├── libsoftkeymasterdevice.so│ ├── libsonivox.so│ ├── libspeexresampler.so│ ├── libssl.so│ ├── libstagefright_amrnb_common.so│ ├── libstagefright_foundation.so│ ├── libstdc++.so│ ├── libsync.so│ ├── libui.so│ ├── libunwind.so│ ├── libutils.so│ └── libz.so└── usr├── icu│ └── icudt55l.dat└── share└── zoneinfo└── tzdata
#!/usr/bin/env python3from qiling import *from qiling.os.mapper import QlFsMappedObjectfrom collections import defaultdictclass Fake_maps(QlFsMappedObject):def __init__(self, ql):self.ql = qldef read(self, size):stack = next(filter(lambda x : x[3]=='[stack]', self.ql.mem.map_info))return ('%x-%x %sn' % (stack[0], stack[1], stack[3])).encode()def fstat(self):return defaultdict(int)def close(self):return 0if __name__ == "__main__":rootfs = "android6.0"test_binary = "android6.0/bin/arm64_android_jniart"env = {"ANDROID_DATA":"/data", "ANDROID_ROOT":"/system"}ql = Qiling([test_binary], rootfs, env, multithread = True)ql.add_fs_mapper("/proc/self/task/2000/maps", Fake_maps(ql))ql.run()
Start End Perm Label00000012c00000 - 00000012c01000 rw- [syscall_mmap]00000012c01000 - 00000012e01000 rw- [syscall_mmap]00000012e01000 - 00000022c00000 --- [syscall_mmap]00000022c00000 - 00000022c01000 rw- [syscall_mmap]00000022c01000 - 00000032c00000 --- [syscall_mmap]00000032c00000 - 00000042c00000 rw- [syscall_mmap]00000070000000 - 00000070cf2000 rw- [mmap] boot.art00000070cf2000 - 00000072bcb000 r-- [mmap] boot.oat00000072bcb000 - 00000074b95000 r-x [mmap] boot.oat00000074b95000 - 00000074b96000 rw- [mmap] boot.oat00000074b96000 - 00000074b97000 rw- [syscall_mmap]00000074b97000 - 00000078b96000 --- [syscall_mmap]00555555554000 - 00555555555000 r-- arm64_android_jniart00555555555000 - 00555555556000 r-x arm64_android_jniart00555555556000 - 00555555557000 r-- arm64_android_jniart00555555557000 - 00555555558000 rw- arm64_android_jniart00555555558000 - 0055555555a000 rwx [hook_mem]007fffb7dd6000 - 007fffb7dd7000 --- [syscall_mmap]007fffb7dd7000 - 007fffb7ddb000 rw- [syscall_mmap]007fffb7ddb000 - 007fffb7ddc000 r-- [syscall_mmap]007fffb7ddc000 - 007fffb7ddd000 r-- [syscall_mmap]007fffb7ddd000 - 007fffb7dde000 rw- [syscall_mmap]007fffb7dde000 - 007fffb7ddf000 rw- [syscall_mmap]007fffb7ddf000 - 007fffb7de0000 rw- [syscall_mmap]007fffb7de0000 - 007fffb7de1000 r-- [syscall_mmap]007fffb7de6000 - 007fffb7ea9000 r-x [mmap] libc.so007fffb7ea9000 - 007fffb7eb8000 --- [syscall_mmap]007fffb7eb8000 - 007fffb7ebe000 r-- [mmap] libc.so007fffb7ebe000 - 007fffb7ec1000 rw- [mmap] libc.so007fffb7ec1000 - 007fffb7ecf000 rw- [syscall_mmap]007fffb7ed0000 - 007fffb7ed1000 rw- [syscall_mmap]007fffb7f40000 - 007fffb7f80000 rw- [syscall_mmap]007fffb7f91000 - 007fffb7f92000 r-- [syscall_mmap]007fffb8000000 - 007fffb8040000 rw- [syscall_mmap]007fffb8140000 - 007fffb8200000 rw- [syscall_mmap]007fffb8300000 - 007fffb83c0000 rw- [syscall_mmap]007fffb83d4000 - 007fffb89b5000 r-x [mmap] libart.so007fffb89b5000 - 007fffb89c5000 --- [syscall_mmap]007fffb89c5000 - 007fffb89d8000 r-- [mmap] libart.so007fffb89d8000 - 007fffb89da000 rw- [mmap] libart.so007fffb89da000 - 007fffb89dd000 rw- [syscall_mmap]007fffb89e2000 - 007fffb89ea000 r-x [mmap] libnativehelper.so007fffb89ea000 - 007fffb89f9000 --- [syscall_mmap]007fffb89f9000 - 007fffb89fa000 r-- [mmap] libnativehelper.so007fffb89fa000 - 007fffb89fb000 rw- [mmap] libnativehelper.so007fffb8a00000 - 007fffb8a03000 r-x [mmap] libnativebridge.so007fffb8a03000 - 007fffb8a12000 --- [syscall_mmap]007fffb8a12000 - 007fffb8a13000 r-- [mmap] libnativebridge.so007fffb8a13000 - 007fffb8a14000 rw- [mmap] libnativebridge.so007fffb8a19000 - 007fffb8a1a000 r-x [mmap] libsigchain.so007fffb8a1a000 - 007fffb8a29000 --- [syscall_mmap]007fffb8a29000 - 007fffb8a2a000 r-- [mmap] libsigchain.so007fffb8a2a000 - 007fffb8a2b000 rw- [mmap] libsigchain.so007fffb8a30000 - 007fffb8a3b000 r-x [mmap] libbacktrace.so007fffb8a3b000 - 007fffb8a4a000 --- [syscall_mmap]007fffb8a4a000 - 007fffb8a4c000 r-- [mmap] libbacktrace.so007fffb8a4c000 - 007fffb8a4d000 rw- [mmap] libbacktrace.so007fffb8a52000 - 007fffb8a75000 r-x [mmap] libutils.so007fffb8a75000 - 007fffb8a84000 --- [syscall_mmap]007fffb8a84000 - 007fffb8a86000 r-- [mmap] libutils.so007fffb8a86000 - 007fffb8a87000 rw- [mmap] libutils.so007fffb8a8c000 - 007fffb8a9d000 r-x [mmap] libcutils.so007fffb8a9d000 - 007fffb8aad000 --- [syscall_mmap]007fffb8aad000 - 007fffb8aae000 r-- [mmap] libcutils.so007fffb8aae000 - 007fffb8aaf000 rw- [mmap] libcutils.so007fffb8aaf000 - 007fffb8ab0000 r-- [syscall_mmap]007fffb8ab5000 - 007fffb8b8c000 r-x [mmap] libc++.so007fffb8b8c000 - 007fffb8b9b000 --- [syscall_mmap]007fffb8b9b000 - 007fffb8ba2000 r-- [mmap] libc++.so007fffb8ba2000 - 007fffb8ba3000 rw- [mmap] libc++.so007fffb8ba3000 - 007fffb8ba6000 rw- [syscall_mmap]007fffb8bab000 - 007fffb8be3000 r-x [mmap] libm.so007fffb8be3000 - 007fffb8bf3000 --- [syscall_mmap]007fffb8bf3000 - 007fffb8bf4000 r-- [mmap] libm.so007fffb8bf4000 - 007fffb8bf5000 rw- [mmap] libm.so007fffb8bfa000 - 007fffb8bff000 r-x [mmap] liblog.so007fffb8bff000 - 007fffb8c0e000 --- [syscall_mmap]007fffb8c0e000 - 007fffb8c0f000 r-- [mmap] liblog.so007fffb8c0f000 - 007fffb8c10000 rw- [mmap] liblog.so007fffb8c15000 - 007fffb8c1e000 r-x [mmap] libbase.so007fffb8c1e000 - 007fffb8c2d000 --- [syscall_mmap]007fffb8c2d000 - 007fffb8c2e000 r-- [mmap] libbase.so007fffb8c2e000 - 007fffb8c2f000 rw- [mmap] libbase.so007fffb8c34000 - 007fffb8c4f000 r-x [mmap] libunwind.so007fffb8c4f000 - 007fffb8c5e000 --- [syscall_mmap]007fffb8c5e000 - 007fffb8c5f000 r-- [mmap] libunwind.so007fffb8c5f000 - 007fffb8c60000 rw- [mmap] libunwind.so007fffb8c60000 - 007fffb8cc9000 rw- [syscall_mmap]007fffb8cca000 - 007fffb8ccb000 rw- [syscall_mmap]007fffb8d40000 - 007fffb8d80000 rw- [syscall_mmap]007fffb8e00000 - 007fffb8e40000 rw- [syscall_mmap]007fffb8e54000 - 007fffb8e7a000 r-- [mmap] boot.art007fffb8e7f000 - 007fffb8f7f000 rw- [syscall_mmap]007fffb8f7f000 - 007fffb907f000 rw- [syscall_mmap]007fffb907f000 - 007fffb908f000 rw- [syscall_mmap]007fffb908f000 - 007fffb948f000 rw- [syscall_mmap]007fffb948f000 - 007fffb988f000 rw- [syscall_mmap]007fffb988f000 - 007fffb989f000 rw- [syscall_mmap]007fffb989f000 - 007fffb9c9f000 rw- [syscall_mmap]007fffb9c9f000 - 007fffba09f000 rw- [syscall_mmap]007fffba09f000 - 007fffba0bf000 rw- [syscall_mmap]007fffba0bf000 - 007fffba0df000 rw- [syscall_mmap]007fffba0df000 - 007fffba15f000 rw- [syscall_mmap]007fffba15f000 - 007fffbae1f000 rw- [syscall_mmap]007fffbae1f000 - 007fffbae5f000 rw- [syscall_mmap]007fffbae5f000 - 007fffbb660000 rw- [syscall_mmap]007fffbb660000 - 007fffbbe61000 rw- [syscall_mmap]007fffbbe61000 - 007fffbbe63000 rw- [syscall_mmap]007fffbbe63000 - 007fffbbe65000 rw- [syscall_mmap]007fffbbe65000 - 007fffbbe67000 rw- [syscall_mmap]007fffbbe67000 - 007fffbbf2f000 rw- [syscall_mmap]007fffbbf2f000 - 007fffbbff7000 rw- [syscall_mmap]007fffbbff7000 - 007fffbbff9000 rw- [syscall_mmap]007fffbc040000 - 007fffbc080000 rw- [syscall_mmap]007fffbc0bd000 - 007fffbc10e000 r-x [mmap] libjavacore.so007fffbc10e000 - 007fffbc11e000 --- [syscall_mmap]007fffbc11e000 - 007fffbc120000 r-- [mmap] libjavacore.so007fffbc120000 - 007fffbc123000 rw- [mmap] libjavacore.so007fffbc123000 - 007fffbc124000 rw- [syscall_mmap]007fffbc129000 - 007fffbc22b000 r-x [mmap] libcrypto.so007fffbc22b000 - 007fffbc23a000 --- [syscall_mmap]007fffbc23a000 - 007fffbc24e000 r-- [mmap] libcrypto.so007fffbc24e000 - 007fffbc24f000 rw- [mmap] libcrypto.so007fffbc24f000 - 007fffbc250000 r-- [syscall_mmap]007fffbc255000 - 007fffbc276000 r-x [mmap] libexpat.so007fffbc276000 - 007fffbc286000 --- [syscall_mmap]007fffbc286000 - 007fffbc288000 r-- [mmap] libexpat.so007fffbc288000 - 007fffbc289000 rw- [mmap] libexpat.so007fffbc28e000 - 007fffbc411000 r-x [mmap] libicuuc.so007fffbc411000 - 007fffbc421000 --- [syscall_mmap]007fffbc421000 - 007fffbc433000 r-- [mmap] libicuuc.so007fffbc433000 - 007fffbc434000 rw- [mmap] libicuuc.so007fffbc434000 - 007fffbc438000 rw- [syscall_mmap]007fffbc43d000 - 007fffbc659000 r-x [mmap] libicui18n.so007fffbc659000 - 007fffbc669000 --- [syscall_mmap]007fffbc669000 - 007fffbc67d000 r-- [mmap] libicui18n.so007fffbc67d000 - 007fffbc67e000 rw- [mmap] libicui18n.so007fffbc683000 - 007fffbc69f000 r-x [mmap] libz.so007fffbc69f000 - 007fffbc6ae000 --- [syscall_mmap]007fffbc6ae000 - 007fffbc6af000 r-- [mmap] libz.so007fffbc6af000 - 007fffbc6b0000 rw- [mmap] libz.so007fffbc6b5000 - 007fffbc6b8000 r-x [mmap] libstdc++.so007fffbc6b8000 - 007fffbc6c7000 --- [syscall_mmap]007fffbc6c7000 - 007fffbc6c8000 r-- [mmap] libstdc++.so007fffbc6c8000 - 007fffbc6c9000 rw- [mmap] libstdc++.so007fffbc6ce000 - 007fffbc6ee000 rw- [syscall_mmap]007fffbc6ee000 - 007fffbdcee000 r-- [mmap] icudt55l.dat007fffbdcee000 - 007fffbdcef000 --- [syscall_mmap]007fffbdcef000 - 007fffbdcf0000 --- [syscall_mmap]007fffbdcf0000 - 007fffbdded000 rw- [syscall_mmap]007fffbdded000 - 007fffbddee000 --- [syscall_mmap]007fffbddee000 - 007fffbddf2000 rw- [syscall_mmap]007fffbde40000 - 007fffbde80000 rw- [syscall_mmap]007fffbdeb1000 - 007fffbdeb3000 rw- [syscall_mmap]007fffbdeb3000 - 007fffbdeb5000 rw- [syscall_mmap]007fffbdeb5000 - 007fffbdeb6000 --- [syscall_mmap]007fffbdeb6000 - 007fffbdeb7000 --- [syscall_mmap]007fffbdeb7000 - 007fffbdfba000 rw- [syscall_mmap]007fffbdfba000 - 007fffbdfbc000 rw- [syscall_mmap]007fffbdfbc000 - 007fffbdfbd000 --- [syscall_mmap]007fffbdfbd000 - 007fffbdfbe000 --- [syscall_mmap]007fffbdfbe000 - 007fffbe0c1000 rw- [syscall_mmap]007fffbe0c1000 - 007fffbe0c3000 rw- [syscall_mmap]007fffbe0c3000 - 007fffbe0c4000 --- [syscall_mmap]007fffbe0c4000 - 007fffbe0c5000 --- [syscall_mmap]007fffbe0c5000 - 007fffbe1c8000 rw- [syscall_mmap]007fffbe1c8000 - 007fffbe1ca000 rw- [syscall_mmap]007fffbe1ca000 - 007fffbe1cb000 --- [syscall_mmap]007fffbe1cb000 - 007fffbe1cc000 --- [syscall_mmap]007fffbe1cc000 - 007fffbe2cf000 rw- [syscall_mmap]007fffbe2cf000 - 007fffbe2d0000 --- [syscall_mmap]007fffbe2d0000 - 007fffbe2d4000 rw- [syscall_mmap]007fffbe2d4000 - 007fffbe2d5000 --- [syscall_mmap]007fffbe2d5000 - 007fffbe2d9000 rw- [syscall_mmap]007fffbe2d9000 - 007fffbe2da000 --- [syscall_mmap]007fffbe2da000 - 007fffbe2de000 rw- [syscall_mmap]007fffbe2de000 - 007fffbe2df000 --- [syscall_mmap]007fffbe2df000 - 007fffbe2e3000 rw- [syscall_mmap]007ffff7dd5000 - 007ffff7e0d000 r-x linker64007ffff7e1d000 - 007ffff7e1e000 r-- linker64007ffff7e1e000 - 007ffff7e24000 rw- linker64007ffffffde000 - 007ffffffdf000 --- [stack]007ffffffdf000 - 0080000000e000 rwx [stack]
对基于Unicorn的Qiling的新的调试方法
from udbserver import udbserverudbserver(ql.uc, 1234, 0x5555555558D4)
from udbserver import udbserverudbserver(emulator.mu, 1234, 0xcbbd2dec)
看雪ID：Bet4
https://bbs.pediy.com/user-home-952662.htm
# 往期推荐
球分享
球点赞
球在看
点击“阅读原文”，了解更多！
原文始发于微信公众号（看雪学苑）：一种新的Android Runtime环境仿真及调试方法
