Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

callStaticJniMethodObject方法返回null #707

Open
2382323268 opened this issue Dec 30, 2024 · 0 comments
Open

callStaticJniMethodObject方法返回null #707

2382323268 opened this issue Dec 30, 2024 · 0 comments

Comments

@2382323268
Copy link

2382323268 commented Dec 30, 2024

 // 1.创建设备(32位或64位模拟器), 具体看so文件在哪个目录。 在armeabi-v7a就选择32位
        emulator = AndroidEmulatorBuilder
                .for64Bit()
                .addBackendFactory(new Unicorn2Factory(true))
                .setProcessName(unidbgSoEnum.getPackageName()).build();

        // 2.获取内存对象(可以操作内存)
        memory = emulator.getMemory();

        // 3.设置安卓sdk版本(只支持19、23)
        memory.setLibraryResolver(new AndroidResolver(23));

        // 4.创建虚拟机(运行安卓代码需要虚拟机,就想运行py代码需要python解释器一样)
        vm = emulator.createDalvikVM(new File(path + unidbgSoEnum.getApk()));
        function.apply(emulator, vm, memory);

        vm.setJni(this);
        //是否展示调用过程的细节
        vm.setVerbose(true);
        emulator.getSyscallHandler().addIOResolver(this);


        // 5.加载so文件
        DalvikModule dm = }vm.loadLibrary(unidbgSoEnum.getSo(), true);

        // traceCode()可以查看so文件中的调用过程
        // emulator.traceCode();

        // 6.dm代表so文件,dm.getModule()得到module对象,基于module对象可以访问so中的成员。
        module = dm.getModule();
        dm.callJNI_OnLoad(emulator);



    public Object a() {
        DvmClass cls = vm.resolveClass("com/xxx/tiny/internal/t");
        String method = "a(I[Ljava/lang/Object;)Ljava/lang/Object;";
        ArrayObject arrayObject = new ArrayObject(new StringObject(vm, "POST"), new StringObject(vm, "https://xxx.xxx.com/test"), new ByteArray(vm, "test".getBytes(StandardCharsets.UTF_8)));
        DvmObject<?> dvmObject = cls.callStaticJniMethodObject(emulator, method, 0, arrayObject);
        System.out.println("dvmObject = " + dvmObject);
        return null;
    }

下面是控制台输出

024-12-30 14:20:20.964 CST INFO  [main] com.xy.imitator.so.env.CoreEnv[c.x.i.s.e.CoreEnv:95] - 系统文件 fileName = /dev/__properties__
File opened '/dev/__properties__' with oflags=0x88000 from RX@0x405d2854[libc.so]0x22854
File closed '/dev/__properties__' from RX@0x405cece4[libc.so]0x1ece4
2024-12-30 14:20:20.970 CST INFO  [main] com.xy.imitator.so.env.CoreEnv[c.x.i.s.e.CoreEnv:127] - 系统属性 key = ro.kernel.qemu
2024-12-30 14:20:20.973 CST INFO  [main] com.xy.imitator.so.env.CoreEnv[c.x.i.s.e.CoreEnv:127] - 系统属性 key = libc.debug.malloc
2024-12-30 14:20:20.996 CST INFO  [main] com.xy.imitator.so.env.CoreEnv[c.x.i.s.e.CoreEnv:95] - 系统文件 fileName = /proc/stat
File opened '/proc/stat' with oflags=0x80000 from RX@0x405d2854[libc.so]0x22854
Read 1871 bytes from '/proc/stat'
Read 0 bytes from '/proc/stat'
File closed '/proc/stat' from RX@0x405cece4[libc.so]0x1ece4
JNIEnv->FindClass(com/xingin/tiny/internal/t) was called from RX@0x401c6e70[libtiny.so]0x1c6e70
JNIEnv->RegisterNatives(com/xingin/tiny/internal/t, unidbg@0xbffff6b0, 1) was called from RX@0x401c6ebc[libtiny.so]0x1c6ebc
RegisterNative(com/xingin/tiny/internal/t, a(I[Ljava/lang/Object;)Ljava/lang/Object;, RX@0x401ab2d0[libtiny.so]0x1ab2d0)
Find native function Java_com_xingin_tiny_internal_t_a => RX@0x401ab2d0[libtiny.so]0x1ab2d0
JNIEnv->GetObjectArrayElement(["POST", "https://xxx.xxx/test", [B@74844216], 0) => "POST" was called from RX@0x401c25c0[libtiny.so]0x1c25c0
JNIEnv->GetObjectArrayElement(["POST", "https://xxx.xxx/test", [B@74844216], 1) => "https://xxx.xxx/test" was called from RX@0x401c25c0[libtiny.so]0x1c25c0
JNIEnv->GetObjectArrayElement(["POST", "https://xxx.xxx/test", [B@74844216], 2) => [B@74844216 was called from RX@0x401c25c0[libtiny.so]0x1c25c0
JNIEnv->GetStringUtfChars("POST") was called from RX@0x4038282c[libtiny.so]0x38282c
JNIEnv->ReleaseStringUTFChars("POST") was called from RX@0x403828b8[libtiny.so]0x3828b8
JNIEnv->GetStringUtfChars("https://xxx.xxx/test") was called from RX@0x4038282c[libtiny.so]0x38282c
JNIEnv->ReleaseStringUTFChars("https://xxx.xxx/test") was called from RX@0x403828b8[libtiny.so]0x3828b8
JNIEnv->GetArrayLength([B@74844216 => 250) was called from RX@0x401c47a0[libtiny.so]0x1c47a0
JNIEnv->GetByteArrayRegion([B@74844216, 0, 250, RW@0x4077b000) was called from RX@0x401c63f8[libtiny.so]0x1c63f8
dvmObject = null

是有什么环境检测没过吗,还是什么别的,因为没报错,不知道从哪里开始补环境

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant