-
-
[原创]活捉一只弱鸡vmp(libvdog.so)
-
发表于: 2017-8-2 19:23
-
简介
因为工作关系接触到一个需要分析的apk文件，经过分析发现其加固方式使用的常见的vmp方式，但由于比较简单易懂，
所以很适合用来做教学使用。
分析过程概述
静态分析：
通过查看壳dex文件，发现壳代码主要在libvdog.so中实现，示例如下：
提前剧透以下，虚拟机执行的入口就是VLibrary中的v1函数，后边会有示例
动态分析：
跟踪调试发现这个加固并没有反调试和混淆，对dex的加密也比较简单（加固产品厂商对自己的产品很放心呀）
在加载dex函数处下断点可以dump出解密后的dex文件，共有两个，见附件（tax1.dex，tax2.dex）。
查看dump出的dex文件，可以发现在其中一些函数进行了vmp的隐藏，如下示例：
其中的onCreate函数就是使用vmp方式加固了，入口就是前面的v1函数（外观形似梆梆的vmp入口）
vmp实现分析：
v1函数如下所示：
虚拟机引擎入口如下所示：
指令执行引擎（部分）如下所示：
.text:00018AAC ; ---------------------------------------------------------------------------
.text:00018AAC
.text:00018AAC loc_18AAC ; CODE XREF: .text:00018A1Cj
.text:00018AAC LDR R3, =(aObject - 0x18AB2)
.text:00018AAE ADD R3, PC ; "-object"
.text:00018AB0
.text:00018AB0 loc_18AB0 ; CODE XREF: .text:00018A22j
.text:00018AB0 MOVS R1, #0xE4
.text:00018AB2 LDR R1, [R1,R7]
.text:00018AB4 LSLS R4, R2, #2
.text:00018AB6 STR R2, [SP,#4]
.text:00018AB8 LDR R2, =(asc_3DA5C - 0x18AC2)
.text:00018ABA ADDS R4, R1, R4
.text:00018ABC STR R5, [SP]
.text:00018ABE ADD R2, PC ; " "
.text:00018AC0 STR R5, [SP,#0xC]
.text:00018AC2 STR R2, [SP,#8]
.text:00018AC4 LDR R2, [R4]
.text:00018AC6 LDR R1, =(aVdog - 0x18AD2)
.text:00018AC8 MOVS R0, #2
.text:00018ACA STR R2, [SP,#0x10]
.text:00018ACC LDR R2, =(aMove_object_16 - 0x18AD4)
.text:00018ACE ADD R1, PC ; "VDOG"
.text:00018AD0 ADD R2, PC ; "|move_object_16%s/16 v%d,v%d %s(v%d=0x%"...
.text:00018AD2 BL j_j___android_log_print
.text:00018AD6 LDR R3, [R4]
.text:00018AD8 MOVS R1, #0x12C
.text:00018ADC STR R3, [SP]
.text:00018ADE ADDS R6, R7, R1
.text:00018AE0 MOVS R3, #0xE4
.text:00018AE2 LDR R2, [R3,R7]
.text:00018AE4 LDR R0, [R7,#0x28]
.text:00018AE6 MOVS R3, R5
.text:00018AE8 MOVS R1, R6
.text:00018AEA BL _Z17SET_REGISTER_FUNCP7_JNIEnvP14ReferenceTablePjij ; SET_REGISTER_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,uint)
.text:00018AEE LDR R1, [R4]
.text:00018AF0 MOVS R4, #0x11C
.text:00018AF4 MOVS R0, R6
.text:00018AF6 BL _Z22dvmAddToReferenceTableP14ReferenceTablePv ; dvmAddToReferenceTable(ReferenceTable *,void *)
.text:00018AFA LDR R3, [R4,R7]
.text:00018AFC ADDS R5, R4, R7
.text:00018AFE ADDS R3, #6
.text:00018B00 STR R3, [R5]
.text:00018B02
.text:00018B02 loc_18B02 ; CODE XREF: .text:loc_182CEj
.text:00018B02 ; DATA XREF: .text:000182FCo
.text:00018B02 BL def_182CE ; jumptable 000182CE default case
.text:00018B06 ; ---------------------------------------------------------------------------
.text:00018B06 MOVS R6, #0xE8
.text:00018B08 LDR R6, [R6,R7]
.text:00018B0A ASRS R4, R4, #8
.text:00018B0C CMP R6, #0xA
.text:00018B0E BNE loc_18B16
.text:00018B10 LDR R3, =(unk_39722 - 0x18B16)
.text:00018B12 ADD R3, PC ; unk_39722
.text:00018B14 B loc_18B1A
.text:00018B16 ; ---------------------------------------------------------------------------
.text:00018B16
.text:00018B16 loc_18B16 ; CODE XREF: .text:00018B0Ej
.text:00018B16 LDR R3, =(aObject - 0x18B1C)
.text:00018B18 ADD R3, PC ; "-object"
.text:00018B1A
.text:00018B1A loc_18B1A ; CODE XREF: .text:00018B14j
.text:00018B1A LDR R2, =(asc_3DA5C - 0x18B24)
.text:00018B1C STR R4, [SP]
.text:00018B1E STR R4, [SP,#8]
.text:00018B20 ADD R2, PC ; " "
.text:00018B22 ADDS R2, #4
.text:00018B24 STR R2, [SP,#4]
.text:00018B26 MOVS R0, #0xB8
.text:00018B28 LDR R1, [R0,R7]
.text:00018B2A LDR R2, =(aMoveResultSVDS - 0x18B34)
.text:00018B2C LDR R0, [R1]
.text:00018B2E MOVS R1, #0xA4
.text:00018B30 ADD R2, PC ; "|move-result%s v%d %s(v%d=0x%08x)"
.text:00018B32 STR R0, [R1,R7]
.text:00018B34 LDR R1, =(aVdog - 0x18B3E)
.text:00018B36 STR R0, [SP,#0xC]
.text:00018B38 MOVS R0, #2
.text:00018B3A ADD R1, PC ; "VDOG"
.text:00018B3C BL j_j___android_log_print
.text:00018B40 MOVS R3, #0xB8
.text:00018B42 LDR R5, [R3,R7]
.text:00018B44 MOVS R2, #0x12C
.text:00018B48 LDR R3, [R5]
.text:00018B4A MOVS R5, #0xA0
.text:00018B4C ADDS R1, R7, R2
.text:00018B4E STR R3, [R5,R7]
.text:00018B50 STR R3, [SP]
.text:00018B52 MOVS R3, #0xE4
.text:00018B54 LDR R2, [R3,R7]
.text:00018B56 MOVS R3, R4
.text:00018B58 MOVS R4, #0x11C
.text:00018B5C LDR R0, [R7,#0x28]
.text:00018B5E BL _Z17SET_REGISTER_FUNCP7_JNIEnvP14ReferenceTablePjij ; SET_REGISTER_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,uint)
.text:00018B62 LDR R3, [R4,R7]
.text:00018B64 ADDS R5, R4, R7
.text:00018B66 ADDS R3, #2
.text:00018B68 STR R3, [R5]
.text:00018B6A
.text:00018B6A loc_18B6A ; CODE XREF: .text:loc_182CEj
.text:00018B6A ; DATA XREF: .text:00018300o
.text:00018B6A BL def_182CE ; jumptable 000182CE default case
.text:00018B6E ; ---------------------------------------------------------------------------
.text:00018B6E LDR R3, =(asc_3DA5C - 0x18B78)
.text:00018B70 MOVS R1, #0xB8
.text:00018B72 MOVS R2, #0x98
.text:00018B74 ADD R3, PC ; " "
.text:00018B76 STR R3, [SP]
.text:00018B78 LDR R0, [R1,R7]
.text:00018B7A ADDS R2, R2, R7
.text:00018B7C ASRS R4, R4, #8
.text:00018B7E LDR R1, [R0,#4]
.text:00018B80 LDR R0, [R0]
.text:00018B82 STR R0, [R2]
.text:00018B84 STR R1, [R2,#4]
.text:00018B86 STR R0, [SP,#8]
.text:00018B88 STR R1, [SP,#0xC]
.text:00018B8A LDR R2, =(aMoveResultWide - 0x18B94)
.text:00018B8C LDR R1, =(aVdog - 0x18B96)
.text:00018B8E MOVS R3, R4
.text:00018B90 ADD R2, PC ; "|move-result-wide v%d %s(0x%08llx)"
.text:00018B92 ADD R1, PC ; "VDOG"
.text:00018B94 MOVS R6, #0xB8
.text:00018B96 MOVS R0, #2
.text:00018B98 BL j_j___android_log_print
.text:00018B9C LDR R5, [R6,R7]
.text:00018B9E MOVS R0, #0x90
.text:00018BA0 ADDS R0, R0, R7
.text:00018BA2 MOVS R2, #0x96
.text:00018BA4 LDR R6, [R5,#4]
.text:00018BA6 LDR R5, [R5]
.text:00018BA8 LSLS R2, R2, #1
.text:00018BAA STR R5, [R0]
.text:00018BAC STR R6, [R0,#4]
.text:00018BAE MOVS R3, #0xE4
.text:00018BB0 STR R5, [SP]
.text:00018BB2 STR R6, [SP,#4]
.text:00018BB4 ADDS R1, R7, R2
.text:00018BB6 LDR R2, [R3,R7]
.text:00018BB8 MOVS R3, R4
.text:00018BBA MOVS R4, #0x11C
.text:00018BBE LDR R0, [R7,#0x28]
.text:00018BC0 BL _Z22SET_REGISTER_WIDE_FUNCP7_JNIEnvP14ReferenceTablePjiy ; SET_REGISTER_WIDE_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,ulong long)
.text:00018BC4 LDR R3, [R4,R7]
.text:00018BC6 ADDS R5, R4, R7
.text:00018BC8 ADDS R3, #2
.text:00018BCA STR R3, [R5]
.text:00018BCC
.text:00018BCC loc_18BCC ; CODE XREF: .text:loc_182CEj
.text:00018BCC ; DATA XREF: .text:00018304o
.text:00018BCC BL def_182CE ; jumptable 000182CE default case
.text:00018BD0 ; ---------------------------------------------------------------------------
.text:00018BD0 MOVS R6, #0xE8
.text:00018BD2 LDR R6, [R6,R7]
.text:00018BD4 ASRS R4, R4, #8
.text:00018BD6 CMP R6, #0xA
.text:00018BD8 BNE loc_18BE0
.text:00018BDA LDR R3, =(unk_39722 - 0x18BE0)
.text:00018BDC ADD R3, PC ; unk_39722
.text:00018BDE B loc_18BE4
.text:00018BE0 ; ---------------------------------------------------------------------------
.text:00018BE0
.text:00018BE0 loc_18BE0 ; CODE XREF: .text:00018BD8j
.text:00018BE0 LDR R3, =(aObject - 0x18BE6)
.text:00018BE2 ADD R3, PC ; "-object"
.text:00018BE4
.text:00018BE4 loc_18BE4 ; CODE XREF: .text:00018BDEj
.text:00018BE4 LDR R2, =(asc_3DA5C - 0x18BEE)
.text:00018BE6 STR R4, [SP]
.text:00018BE8 STR R4, [SP,#8]
.text:00018BEA ADD R2, PC ; " "
.text:00018BEC ADDS R2, #4
.text:00018BEE STR R2, [SP,#4]
.text:00018BF0 MOVS R0, #0xB8
.text:00018BF2 LDR R1, [R0,R7]
.text:00018BF4 LDR R2, =(aMoveResultSVDS - 0x18BFE)
.text:00018BF6 LDR R0, [R1]
.text:00018BF8 MOVS R1, #0x8C
.text:00018BFA ADD R2, PC ; "|move-result%s v%d %s(v%d=0x%08x)"
.text:00018BFC STR R0, [R1,R7]
.text:00018BFE LDR R1, =(aVdog - 0x18C08)
.text:00018C00 STR R0, [SP,#0xC]
.text:00018C02 MOVS R0, #2
.text:00018C04 ADD R1, PC ; "VDOG"
.text:00018C06 BL j_j___android_log_print
.text:00018C0A MOVS R3, #0xB8
.text:00018C0C LDR R5, [R3,R7]
.text:00018C0E MOVS R1, #0x12C
.text:00018C12 LDR R3, [R5]
.text:00018C14 MOVS R5, #0x88
.text:00018C16 STR R3, [R5,R7]
.text:00018C18 STR R3, [SP]
.text:00018C1A ADDS R5, R7, R1
.text:00018C1C MOVS R3, #0xE4
.text:00018C1E MOVS R1, R5
.text:00018C20 LDR R2, [R3,R7]
.text:00018C22 LDR R0, [R7,#0x28]
.text:00018C24 MOVS R3, R4
.text:00018C26 MOVS R4, #0xB8
.text:00018C28 BL _Z17SET_REGISTER_FUNCP7_JNIEnvP14ReferenceTablePjij ; SET_REGISTER_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,uint)
.text:00018C2C LDR R6, [R4,R7]
.text:00018C2E MOVS R0, R5
.text:00018C30 LDR R4, [R6]
.text:00018C32 MOVS R6, #0x84
.text:00018C34 STR R4, [R6,R7]
.text:00018C36 MOVS R1, R4
.text:00018C38 MOVS R4, #0x11C
.text:00018C3C BL _Z22dvmAddToReferenceTableP14ReferenceTablePv ; dvmAddToReferenceTable(ReferenceTable *,void *)
.text:00018C40 LDR R3, [R4,R7]
.text:00018C42 ADDS R5, R4, R7
.text:00018C44 ADDS R3, #2
.text:00018C46 STR R3, [R5]
.text:00018C48
.text:00018C48 loc_18C48 ; CODE XREF: .text:loc_182CEj
.text:00018C48 ; DATA XREF: .text:00018308o
.text:00018C48 BL def_182CE ; jumptable 000182CE default case
.text:00018C4C ; ---------------------------------------------------------------------------
.text:00018C4C LDR R1, =(aVdog - 0x18C56)
.text:00018C4E LDR R2, =(aMoveExceptionV - 0x18C58)
.text:00018C50 ASRS R4, R4, #8
.text:00018C52 ADD R1, PC ; "VDOG"
.text:00018C54 ADD R2, PC ; "|move-exception v%d"
.text:00018C56 MOVS R3, R4
.text:00018C58 MOVS R0, #2
.text:00018C5A BL j_j___android_log_print
.text:00018C5E LDR R6, [R7,#0x28]
.text:00018C60 LSLS R4, R4, #2
.text:00018C62 LDR R3, [R6]
.text:00018C64 MOVS R0, R6
.text:00018C66 LDR R3, [R3,#0x3C]
.text:00018C68 BLX R3
.text:00018C6A MOVS R1, #0xE4
.text:00018C6C LDR R1, [R1,R7]
.text:00018C6E STR R0, [R4,R1]
.text:00018C70 LDR R3, [R6]
.text:00018C72 LDR R0, [R7,#0x28]
.text:00018C74 LDR R3, [R3,#0x44]
.text:00018C76 BLX R3
.text:00018C78 MOVS R2, #0x11C
.text:00018C7C LDR R3, [R2,R7]
.text:00018C7E ADDS R4, R2, R7
.text:00018C80 ADDS R3, #2
.text:00018C82 STR R3, [R4]
.text:00018C84
.text:00018C84 loc_18C84 ; CODE XREF: .text:loc_182CEj
.text:00018C84 ; DATA XREF: .text:0001830Co
.text:00018C84 BL def_182CE ; jumptable 000182CE default case
.text:00018C88 ; ---------------------------------------------------------------------------
.text:00018C88 LDR R4, =(aVdog - 0x18C92)
.text:00018C8A LDR R2, =(aReturnVoid - 0x18C96)
.text:00018C8C MOVS R0, #2
.text:00018C8E ADD R4, PC ; "VDOG"
.text:00018C90 MOVS R1, R4
.text:00018C92 ADD R2, PC ; "|return-void"
.text:00018C94 BL j_j___android_log_print
.text:00018C98 LDR R2, =(aLeaveInterpret - 0x18CA2)
.text:00018C9A MOVS R0, #3
.text:00018C9C MOVS R1, R4
.text:00018C9E ADD R2, PC ; "Leave interpret...................."
.text:00018CA0
.text:00018CA0 loc_18CA0 ; CODE XREF: .text:loc_182CEj
.text:00018CA0 ; DATA XREF: .text:00018310o
.text:00018CA0 BL loc_22716
.text:00018CA4 ; ---------------------------------------------------------------------------
.text:00018CA4 MOVS R6, #0xE8
.text:00018CA6 LDR R6, [R6,R7]
.text:00018CA8 ASRS R4, R4, #8
.text:00018CAA CMP R6, #0xF
.text:00018CAC BNE loc_18CB4
.text:00018CAE LDR R3, =(unk_39722 - 0x18CB4)
.text:00018CB0 ADD R3, PC ; unk_39722
.text:00018CB2 B loc_18CB8
.text:00018CB4 ; ---------------------------------------------------------------------------
.text:00018CB4
.text:00018CB4 loc_18CB4 ; CODE XREF: .text:00018CACj
.text:00018CB4 LDR R3, =(aObject - 0x18CBA)
.text:00018CB6 ADD R3, PC ; "-object"
.text:00018CB8
.text:00018CB8 loc_18CB8 ; CODE XREF: .text:00018CB2j
.text:00018CB8 LDR R1, =(aVdog - 0x18CC2)
.text:00018CBA LDR R2, =(aReturnSVD - 0x18CC6)
.text:00018CBC STR R4, [SP]
.text:00018CBE ADD R1, PC ; "VDOG"
.text:00018CC0 MOVS R0, #2
.text:00018CC2 ADD R2, PC ; "|return%s v%d"
.text:00018CC4 BL j_j___android_log_print
.text:00018CC8 MOVS R0, #0xE4
.text:00018CCA LDR R0, [R0,R7]
.text:00018CCC LSLS R4, R4, #2
.text:00018CCE MOVS R1, #0xB8
.text:00018CD0 LDR R4, [R4,R0]
.text:00018CD2 LDR R1, [R1,R7]
.text:00018CD4 STR R4, [R1]
.text:00018CD6
.text:00018CD6 loc_18CD6 ; CODE XREF: .text:loc_182CEj
.text:00018CD6 ; DATA XREF: .text:00018318o
.text:00018CD6 BL loc_22A94
.text:00018CDA ; ---------------------------------------------------------------------------
.text:00018CDA MOVS R2, #0xE8
.text:00018CDC LDR R2, [R2,R7]
.text:00018CDE ASRS R4, R4, #8
.text:00018CE0 CMP R2, #0xF
.text:00018CE2 BNE loc_18CEA
.text:00018CE4 LDR R3, =(unk_39722 - 0x18CEA)
.text:00018CE6 ADD R3, PC ; unk_39722
.text:00018CE8 B loc_18CEE
.text:00018CEA ; ---------------------------------------------------------------------------
.text:00018CEA
.text:00018CEA loc_18CEA ; CODE XREF: .text:00018CE2j
.text:00018CEA LDR R3, =(aObject - 0x18CF0)
.text:00018CEC ADD R3, PC ; "-object"
.text:00018CEE
.text:00018CEE loc_18CEE ; CODE XREF: .text:00018CE8j
.text:00018CEE LDR R1, =(aVdog - 0x18CFA)
.text:00018CF0 LDR R2, =(aReturnSVD - 0x18CFC)
.text:00018CF2 STR R4, [SP]
.text:00018CF4 MOVS R0, #2
.text:00018CF6 ADD R1, PC ; "VDOG"
.text:00018CF8 ADD R2, PC ; "|return%s v%d"
.text:00018CFA BL j_j___android_log_print
.text:00018CFE MOVS R3, #0xE4
.text:00018D00 LDR R3, [R3,R7]
.text:00018D02 LSLS R4, R4, #2
.text:00018D04 MOVS R5, #0xB8
.text:00018D06 LDR R4, [R4,R3]
.text:00018D08 LDR R5, [R5,R7]
.text:00018D0A STR R4, [R5]
.text:00018D0C
.text:00018D0C loc_18D0C ; CODE XREF: .text:loc_182CEj
.text:00018D0C ; DATA XREF: .text:00018314o
.text:00018D0C BL loc_22A94
.text:00018D10 ; ---------------------------------------------------------------------------
.text:00018D10 LDR R1, =(aVdog - 0x18D1A)
.text:00018D12 LDR R2, =(aReturnWideVD - 0x18D1C)
.text:00018D14 ASRS R4, R4, #8
.text:00018D16 ADD R1, PC ; "VDOG"
.text:00018D18 ADD R2, PC ; "|return-wide v%d"
.text:00018D1A MOVS R3, R4
.text:00018D1C MOVS R0, #2
.text:00018D1E MOVS R6, #0xE4
.text:00018D20 BL j_j___android_log_print
.text:00018D24 LDR R0, [R6,R7]
.text:00018D26 MOVS R1, R4
.text:00018D28 BL sub_17C56
.text:00018D2C MOVS R2, #0xB8
.text:00018D2E LDR R2, [R2,R7]
.text:00018D30 STR R0, [R2]
.text:00018D32 STR R1, [R2,#4]
.text:00018D34
.text:00018D34 loc_18D34 ; CODE XREF: .text:loc_182CEj
.text:00018D34 ; DATA XREF: .text:0001831Co
.text:00018D34 BL loc_22A94
.text:00018D38 ; ---------------------------------------------------------------------------
.text:00018D38 LDR R1, =(aVdog - 0x18D4A)
.text:00018D3A LDR R2, =(aConst4VD0x02x - 0x18D4C)
.text:00018D3C LSLS R5, R4, #0x10
.text:00018D3E LSLS R4, R4, #0x14
.text:00018D40 ASRS R5, R5, #0x1C
.text:00018D42 LSRS R4, R4, #0x1C
.text:00018D44 STR R5, [SP]
.text:00018D46 ADD R1, PC ; "VDOG"
.text:00018D48 ADD R2, PC ; "|const/4 v%d,#0x%02x"
.text:00018D4A MOVS R3, R4
.text:00018D4C MOVS R0, #2
.text:00018D4E BL j_j___android_log_print
.text:00018D52 MOVS R3, #0x96
.text:00018D54 STR R5, [SP]
.text:00018D56 LSLS R3, R3, #1
.text:00018D58 MOVS R5, #0xE4
.text:00018D5A MOVS R6, #0x8E
.text:00018D5C LDR R0, [R7,#0x28]
.text:00018D5E ADDS R1, R7, R3
.text:00018D60 LSLS R6, R6, #1
.text:00018D62 MOVS R3, R4
.text:00018D64 LDR R2, [R5,R7]
.text:00018D66 BL _Z17SET_REGISTER_FUNCP7_JNIEnvP14ReferenceTablePjij ; SET_REGISTER_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,uint)
.text:00018D6A LDR R3, [R6,R7]
.text:00018D6C ADDS R0, R6, R7
.text:00018D6E ADDS R3, #2
.text:00018D70 STR R3, [R0]
.text:00018D72
.text:00018D72 loc_18D72 ; CODE XREF: .text:loc_182CEj
.text:00018D72 ; DATA XREF: .text:00018320o
.text:00018D72 BL def_182CE ; jumptable 000182CE default case
.text:00018D76 ; ---------------------------------------------------------------------------
.text:00018D76 MOVS R1, #0x11C
.text:00018D7A LDR R1, [R1,R7]
.text:00018D7C LDR R2, =(aConst16VD0x04x - 0x18D90)
.text:00018D7E ASRS R4, R4, #8
.text:00018D80 MOVS R5, #2
.text:00018D82 LDRSH R5, [R1,R5]
.text:00018D84 LDR R1, =(aVdog - 0x18D8E)
.text:00018D86 MOVS R3, R4
.text:00018D88 STR R5, [SP]
.text:00018D8A ADD R1, PC ; "VDOG"
.text:00018D8C ADD R2, PC ; "|const/16 v%d,#0x%04x"
.text:00018D8E MOVS R0, #2
.text:00018D90 BL j_j___android_log_print
.text:00018D94 MOVS R2, #0x96
.text:00018D96 STR R5, [SP]
.text:00018D98 LSLS R2, R2, #1
.text:00018D9A MOVS R3, #0xE4
.text:00018D9C ADDS R1, R7, R2
.text:00018D9E LDR R2, [R3,R7]
.text:00018DA0 MOVS R3, R4
.text:00018DA2 MOVS R4, #0x11C
.text:00018DA6 LDR R0, [R7,#0x28]
.text:00018DA8 BL _Z17SET_REGISTER_FUNCP7_JNIEnvP14ReferenceTablePjij ; SET_REGISTER_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,uint)
.text:00018DAC LDR R3, [R4,R7]
.text:00018DAE ADDS R5, R4, R7
.text:00018DB0 ADDS R3, #4
.text:00018DB2 STR R3, [R5]
.text:00018DB4
.text:00018DB4 loc_18DB4 ; CODE XREF: .text:loc_182CEj
.text:00018DB4 ; DATA XREF: .text:00018324o
.text:00018DB4 BL def_182CE ; jumptable 000182CE default case
.text:00018DB8 ; ---------------------------------------------------------------------------
.text:00018DB8 MOVS R6, #0x11C
.text:00018DBC LDR R3, [R6,R7]
.text:00018DBE LDR R1, =(aVdog - 0x18DCA)
.text:00018DC0 ASRS R4, R4, #8
.text:00018DC2 LDRH R5, [R3,#4]
.text:00018DC4 LDRH R2, [R3,#2]
.text:00018DC6 ADD R1, PC ; "VDOG"
.text:00018DC8 LSLS R5, R5, #0x10
.text:00018DCA ORRS R5, R2
.text:00018DCC LDR R2, byte_18E90
.text:00018DCE MOVS R3, R4
.text:00018DD0 STR R5, [SP]
.text:00018DD2 ADD R2, PC ; "|const v%d,#0x%08x"
.text:00018DD4 MOVS R0, #2
.text:00018DD6 BL j_j___android_log_print
.text:00018DDA MOVS R2, #0x96
.text:00018DDC STR R5, [SP]
.text:00018DDE LSLS R2, R2, #1
.text:00018DE0 MOVS R3, #0xE4
.text:00018DE2 ADDS R1, R7, R2
.text:00018DE4 LDR R0, [R7,#0x28]
.text:00018DE6 LDR R2, [R3,R7]
.text:00018DE8 MOVS R3, R4
.text:00018DEA ADDS R4, R6, R7
.text:00018DEC BL _Z17SET_REGISTER_FUNCP7_JNIEnvP14ReferenceTablePjij ; SET_REGISTER_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,uint)
.text:00018DF0 LDR R3, [R4]
.text:00018DF2 ADDS R3, #6
.text:00018DF4 STR R3, [R4]
.text:00018DF6 BL def_182CE ; jumptable 000182CE default case
.text:00018DF6 ; ---------------------------------------------------------------------------
.text:00018DFA ALIGN 4
.text:00018DFC off_18DFC DCD aObject - 0x18AB2 ; DATA XREF: .text:loc_18AACr
.text:00018DFC ; "-object"
.text:00018E00 off_18E00 DCD asc_3DA5C - 0x18AC2 ; DATA XREF: .text:00018AB8r
.text:00018E00 ; " "
.text:00018E04 off_18E04 DCD aVdog - 0x18AD2 ; DATA XREF: .text:00018AC6r
.text:00018E04 ; "VDOG"
.text:00018E08 off_18E08 DCD aMove_object_16 - 0x18AD4 ; DATA XREF: .text:00018ACCr
.text:00018E08 ; "|move_object_16%s/16 v%d,v%d %s(v%d=0x%"...
.text:00018E0C off_18E0C DCD unk_39722 - 0x18B16 ; DATA XREF: .text:00018B10r
.text:00018E10 off_18E10 DCD aObject - 0x18B1C ; DATA XREF: .text:loc_18B16r
.text:00018E10 ; "-object"
.text:00018E14 off_18E14 DCD asc_3DA5C - 0x18B24 ; DATA XREF: .text:loc_18B1Ar
.text:00018E14 ; " "
.text:00018E18 off_18E18 DCD aMoveResultSVDS - 0x18B34 ; DATA XREF: .text:00018B2Ar
.text:00018E18 ; "|move-result%s v%d %s(v%d=0x%08x)"
.text:00018E1C off_18E1C DCD aVdog - 0x18B3E ; DATA XREF: .text:00018B34r
.text:00018E1C ; "VDOG"
.text:00018E20 off_18E20 DCD asc_3DA5C - 0x18B78 ; DATA XREF: .text:00018B6Er
.text:00018E20 ; " "
.text:00018E24 off_18E24 DCD aMoveResultWide - 0x18B94 ; DATA XREF: .text:00018B8Ar
.text:00018E24 ; "|move-result-wide v%d %s(0x%08llx)"
.text:00018E28 off_18E28 DCD aVdog - 0x18B96 ; DATA XREF: .text:00018B8Cr
.text:00018E28 ; "VDOG"
.text:00018E2C off_18E2C DCD unk_39722 - 0x18BE0 ; DATA XREF: .text:00018BDAr
.text:00018E30 off_18E30 DCD aObject - 0x18BE6 ; DATA XREF: .text:loc_18BE0r
.text:00018E30 ; "-object"
.text:00018E34 off_18E34 DCD asc_3DA5C - 0x18BEE ; DATA XREF: .text:loc_18BE4r
.text:00018E34 ; " "
.text:00018E38 off_18E38 DCD aMoveResultSVDS - 0x18BFE ; DATA XREF: .text:00018BF4r
.text:00018E38 ; "|move-result%s v%d %s(v%d=0x%08x)"
.text:00018E3C off_18E3C DCD aVdog - 0x18C08 ; DATA XREF: .text:00018BFEr
.text:00018E3C ; "VDOG"
.text:00018E40 off_18E40 DCD aVdog - 0x18C56 ; DATA XREF: .text:00018C4Cr
.text:00018E40 ; "VDOG"
.text:00018E44 off_18E44 DCD aMoveExceptionV - 0x18C58 ; DATA XREF: .text:00018C4Er
.text:00018E44 ; "|move-exception v%d"
.text:00018E48 off_18E48 DCD aVdog - 0x18C92 ; DATA XREF: .text:00018C88r
.text:00018E48 ; "VDOG"
.text:00018E4C off_18E4C DCD aReturnVoid - 0x18C96 ; DATA XREF: .text:00018C8Ar
.text:00018E4C ; "|return-void"
.text:00018E50 off_18E50 DCD aLeaveInterpret - 0x18CA2 ; DATA XREF: .text:00018C98r
.text:00018E50 ; "Leave interpret...................."
.text:00018E54 off_18E54 DCD unk_39722 - 0x18CB4 ; DATA XREF: .text:00018CAEr
.text:00018E58 off_18E58 DCD aObject - 0x18CBA ; DATA XREF: .text:loc_18CB4r
.text:00018E58 ; "-object"
.text:00018E5C off_18E5C DCD aVdog - 0x18CC2 ; DATA XREF: .text:loc_18CB8r
.text:00018E5C ; "VDOG"
.text:00018E60 off_18E60 DCD aReturnSVD - 0x18CC6 ; DATA XREF: .text:00018CBAr
.text:00018E60 ; "|return%s v%d"
.text:00018E64 off_18E64 DCD unk_39722 - 0x18CEA ; DATA XREF: .text:00018CE4r
.text:00018E68 off_18E68 DCD aObject - 0x18CF0 ; DATA XREF: .text:loc_18CEAr
.text:00018E68 ; "-object"
.text:00018E6C off_18E6C DCD aVdog - 0x18CFA ; DATA XREF: .text:loc_18CEEr
.text:00018E6C ; "VDOG"
.text:00018E70 off_18E70 DCD aReturnSVD - 0x18CFC ; DATA XREF: .text:00018CF0r
.text:00018E70 ; "|return%s v%d"
.text:00018E74 off_18E74 DCD aVdog - 0x18D1A ; DATA XREF: .text:00018D10r
.text:00018E74 ; "VDOG"
.text:00018E78 off_18E78 DCD aReturnWideVD - 0x18D1C ; DATA XREF: .text:00018D12r
.text:00018E78 ; "|return-wide v%d"
.text:00018E7C off_18E7C DCD aVdog - 0x18D4A ; DATA XREF: .text:00018D38r
.text:00018E7C ; "VDOG"
.text:00018E80 off_18E80 DCD aConst4VD0x02x - 0x18D4C ; DATA XREF: .text:00018D3Ar
.text:00018E80 ; "|const/4 v%d,#0x%02x"
.text:00018E84 off_18E84 DCD aConst16VD0x04x - 0x18D90 ; DATA XREF: .text:00018D7Cr
.text:00018E84 ; "|const/16 v%d,#0x%04x"
.text:00018E88 off_18E88 DCD aVdog - 0x18D8E ; DATA XREF: .text:00018D84r
.text:00018E88 ; "VDOG"
.text:00018E8C off_18E8C DCD aVdog - 0x18DCA ; DATA XREF: .text:00018DBEr
.text:00018E8C ; "VDOG"
.text:00018E90 byte_18E90 DCB 0xDA, 0x29 ; DATA XREF: .text:00018DCCr
.text:00018E92 ; ---------------------------------------------------------------------------
.text:00018E92
.text:00018E92 loc_18E92 ; CODE XREF: .text:loc_182CEj
.text:00018E92 ; DATA XREF: .text:00018328o
.text:00018E92 MOVS R2, R0 ; jumptable 000182CE case 42
.text:00018E94 MOVS R6, #0x11C
.text:00018E98 LDR R6, [R6,R7]
.text:00018E9A LDR R1, =(aVdog - 0x18EAA)
.text:00018E9C LDR R2, =(aConstHigh16VD0 - 0x18EAC)
.text:00018E9E LDRH R5, [R6,#2]
.text:00018EA0 ASRS R4, R4, #8
.text:00018EA2 MOVS R3, R4
.text:00018EA4 STR R5, [SP]
.text:00018EA6 ADD R1, PC ; "VDOG"
.text:00018EA8 ADD R2, PC ; "|const/high16 v%d,#0x%04x0000"
.text:00018EAA MOVS R0, #2
.text:00018EAC BL j_j___android_log_print
.text:00018EB0 LSLS R5, R5, #0x10
.text:00018EB2 MOVS R2, #0x96
.text:00018EB4 STR R5, [SP]
.text:00018EB6 LSLS R2, R2, #1
.text:00018EB8 MOVS R3, #0xE4
.text:00018EBA ADDS R1, R7, R2
.text:00018EBC LDR R2, [R3,R7]
.text:00018EBE MOVS R3, R4
.text:00018EC0 MOVS R4, #0x11C
.text:00018EC4 LDR R0, [R7,#0x28]
.text:00018EC6 BL _Z17SET_REGISTER_FUNCP7_JNIEnvP14ReferenceTablePjij ; SET_REGISTER_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,uint)
.text:00018ECA LDR R3, [R4,R7]
.text:00018ECC ADDS R5, R4, R7
.text:00018ECE ADDS R3, #4
.text:00018ED0 STR R3, [R5]
.text:00018ED2
.text:00018ED2 loc_18ED2 ; CODE XREF: .text:loc_182CEj
.text:00018ED2 ; DATA XREF: .text:0001832Co
.text:00018ED2 BL def_182CE ; jumptable 000182CE default case
.text:00018ED6 ; ---------------------------------------------------------------------------
.text:00018ED6 MOVS R6, #0x11C
.text:00018EDA LDR R6, [R6,R7]
.text:00018EDC LDR R1, =(aVdog - 0x18EEE)
.text:00018EDE LDR R2, =(aConstWide16VD0 - 0x18EF0)
.text:00018EE0 MOVS R5, #2
.text:00018EE2 LDRSH R5, [R6,R5]
.text:00018EE4 ASRS R4, R4, #8
.text:00018EE6 MOVS R3, R4
.text:00018EE8 STR R5, [SP]
.text:00018EEA ADD R1, PC ; "VDOG"
.text:00018EEC ADD R2, PC ; "|const-wide/16 v%d,#0x%04x"
.text:00018EEE MOVS R0, #2
.text:00018EF0 BL j_j___android_log_print
.text:00018EF4 STR R5, [SP]
.text:00018EF6 MOVS R2, #0x96
.text:00018EF8 ASRS R5, R5, #0x1F
.text:00018EFA STR R5, [SP,#4]
.text:00018EFC LSLS R2, R2, #1
.text:00018EFE MOVS R3, #0xE4
.text:00018F00 ADDS R1, R7, R2
.text:00018F02 LDR R2, [R3,R7]
.text:00018F04 MOVS R3, R4
.text:00018F06 MOVS R4, #0x11C
.text:00018F0A LDR R0, [R7,#0x28]
.text:00018F0C BL _Z22SET_REGISTER_WIDE_FUNCP7_JNIEnvP14ReferenceTablePjiy ; SET_REGISTER_WIDE_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,ulong long)
.text:00018F10 LDR R3, [R4,R7]
.text:00018F12 ADDS R5, R4, R7
.text:00018F14 ADDS R3, #4
.text:00018F16 STR R3, [R5]
.text:00018F18
.text:00018F18 loc_18F18 ; CODE XREF: .text:loc_182CEj
.text:00018F18 ; DATA XREF: .text:00018330o
.text:00018F18 BL def_182CE ; jumptable 000182CE default case
.text:00018F1C ; ---------------------------------------------------------------------------
.text:00018F1C MOVS R6, #0x11C
.text:00018F20 LDR R3, [R6,R7]
.text:00018F22 LDR R1, =(aVdog - 0x18F2E)
.text:00018F24 ASRS R4, R4, #8
.text:00018F26 LDRH R5, [R3,#4]
.text:00018F28 LDRH R2, [R3,#2]
.text:00018F2A ADD R1, PC ; "VDOG"
.text:00018F2C LSLS R5, R5, #0x10
.text:00018F2E ORRS R5, R2
.text:00018F30 LDR R2, =(aConstWide32VD0 - 0x18F3A)
.text:00018F32 MOVS R3, R4
.text:00018F34 STR R5, [SP]
.text:00018F36 ADD R2, PC ; "|const-wide/32 v%d,#0x%08x"
.text:00018F38 MOVS R0, #2
.text:00018F3A BL j_j___android_log_print
.text:00018F3E STR R5, [SP]
.text:00018F40 MOVS R2, #0x96
.text:00018F42 ASRS R5, R5, #0x1F
.text:00018F44 STR R5, [SP,#4]
.text:00018F46 LSLS R2, R2, #1
.text:00018F48 MOVS R3, #0xE4
.text:00018F4A ADDS R1, R7, R2
.text:00018F4C LDR R0, [R7,#0x28]
.text:00018F4E LDR R2, [R3,R7]
.text:00018F50 MOVS R3, R4
.text:00018F52 ADDS R4, R6, R7
.text:00018F54 BL _Z22SET_REGISTER_WIDE_FUNCP7_JNIEnvP14ReferenceTablePjiy ; SET_REGISTER_WIDE_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,ulong long)
.text:00018F58 LDR R3, [R4]
.text:00018F5A ADDS R3, #6
.text:00018F5C STR R3, [R4]
.text:00018F5E
.text:00018F5E loc_18F5E ; CODE XREF: .text:loc_182CEj
.text:00018F5E ; DATA XREF: .text:00018334o
.text:00018F5E BL def_182CE ; jumptable 000182CE default case
.text:00018F62 ; ---------------------------------------------------------------------------
.text:00018F62 MOVS R6, #0x11C
.text:00018F66 LDR R3, [R6,R7]
.text:00018F68 ASRS R4, R4, #8
.text:00018F6A LDRH R2, [R3,#4]
.text:00018F6C LDRH R5, [R3,#8]
.text:00018F6E LDRH R1, [R3,#2]
.text:00018F70 LSLS R0, R2, #0x10
.text:00018F72 LDRH R2, [R3,#6]
.text:00018F74 MOVS R6, R0
.text:00018F76 LSLS R5, R5, #0x10
.text:00018F78 ORRS R5, R2
.text:00018F7A ORRS R6, R1
.text:00018F7C LDR R2, =(aConstWideVD0x0 - 0x18F8A)
.text:00018F7E LDR R1, =(aVdog - 0x18F88)
.text:00018F80 MOVS R3, R4
.text:00018F82 STR R5, [SP,#4]
.text:00018F84 ADD R1, PC ; "VDOG"
.text:00018F86 ADD R2, PC ; "|const-wide v%d,#0x%08llx"
.text:00018F88 STR R6, [SP]
.text:00018F8A MOVS R0, #2
.text:00018F8C BL j_j___android_log_print
.text:00018F90 MOVS R2, #0x96
.text:00018F92 STR R5, [SP,#4]
.text:00018F94 STR R6, [SP]
.text:00018F96 LSLS R2, R2, #1
.text:00018F98 MOVS R3, #0xE4
.text:00018F9A ADDS R1, R7, R2
.text:00018F9C LDR R2, [R3,R7]
.text:00018F9E MOVS R3, R4
.text:00018FA0 MOVS R4, #0x11C
.text:00018FA4 LDR R0, [R7,#0x28]
.text:00018FA6 BL _Z22SET_REGISTER_WIDE_FUNCP7_JNIEnvP14ReferenceTablePjiy ; SET_REGISTER_WIDE_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,ulong long)
.text:00018FAA LDR R3, [R4,R7]
.text:00018FAC ADDS R5, R4, R7
.text:00018FAE ADDS R3, #0xA
.text:00018FB0 STR R3, [R5]
.text:00018FB2
.text:00018FB2 loc_18FB2 ; CODE XREF: .text:loc_182CEj
.text:00018FB2 ; DATA XREF: .text:00018338o
.text:00018FB2 BL def_182CE ; jumptable 000182CE default case
.text:00018FB6 ; ---------------------------------------------------------------------------
.text:00018FB6 MOVS R6, #0x11C
.text:00018FBA LDR R6, [R6,R7]
.text:00018FBC LDR R1, =(aVdog - 0x18FCC)
.text:00018FBE LDR R2, =(aConstWideHigh1 - 0x18FCE)
.text:00018FC0 LDRH R5, [R6,#2]
.text:00018FC2 ASRS R4, R4, #8
.text:00018FC4 MOVS R3, R4
.text:00018FC6 STR R5, [SP]
.text:00018FC8 ADD R1, PC ; "VDOG"
.text:00018FCA ADD R2, PC ; "|const-wide/high16 v%d,#0x%04x000000000"...
.text:00018FCC MOVS R0, #2
.text:00018FCE BL j_j___android_log_print
.text:00018FD2 LSLS R5, R5, #0x10
.text:00018FD4 MOVS R3, #0
.text:00018FD6 MOVS R2, #0x96
.text:00018FD8 STR R3, [SP]
.text:00018FDA STR R5, [SP,#4]
.text:00018FDC LSLS R2, R2, #1
.text:00018FDE MOVS R3, #0xE4
.text:00018FE0 ADDS R1, R7, R2
.text:00018FE2 LDR R2, [R3,R7]
.text:00018FE4 MOVS R3, R4
.text:00018FE6 MOVS R4, #0x11C
.text:00018FEA LDR R0, [R7,#0x28]
.text:00018FEC BL _Z22SET_REGISTER_WIDE_FUNCP7_JNIEnvP14ReferenceTablePjiy ; SET_REGISTER_WIDE_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,ulong long)
.text:00018FF0 LDR R3, [R4,R7]
.text:00018FF2 ADDS R5, R4, R7
.text:00018FF4 ADDS R3, #4
.text:00018FF6 STR R3, [R5]
.text:00018FF8
.text:00018FF8 loc_18FF8 ; CODE XREF: .text:loc_182CEj
.text:00018FF8 ; DATA XREF: .text:0001833Co
.text:00018FF8 BL def_182CE ; jumptable 000182CE default case
.text:00018FFC ; ---------------------------------------------------------------------------
.text:00018FFC MOVS R0, #0x11C
.text:00019000 LDR R0, [R0,R7]
.text:00019002 LDR R1, =(aVdog - 0x1900C)
.text:00019004 MOVS R2, #0xC0
.text:00019006 LDRH R5, [R0,#2]
.text:00019008 ADD R1, PC ; "VDOG"
.text:0001900A STR R1, [R2,R7]
.text:0001900C ADDS R3, R2, R7
.text:0001900E LDR R2, =(aConstStringVDS - 0x1901A)
.text:00019010 ASRS R6, R4, #8
.text:00019012 STR R5, [SP]
.text:00019014 LDR R1, [R3]
.text:00019016 ADD R2, PC ; "|const-string v%d string@0x%04x"
.text:00019018 MOVS R3, R6
.text:0001901A MOVS R0, #2
.text:0001901C BL j_j___android_log_print
.text:00019020 MOVS R1, #0xBC
.text:00019022 LDR R1, [R1,R7]
.text:00019024 LDR R3, =0xFFFFFE94
.text:00019026 LSLS R4, R5, #2
.text:00019028 MOVS R0, #0xC4
.text:0001902A STR R4, [R0,R7]
.text:0001902C LDR R3, [R1,R3]
.text:0001902E MOVS R2, #0xCC
.text:00019030 MOVS R1, #0xB4
.text:00019032 STR R3, [R1,R7]
.text:00019034 ADDS R0, R1, R7
.text:00019036 LDR R2, [R2,R7]
.text:00019038 LDR R4, [R0]
.text:0001903A MOVS R3, #0xB0
.text:0001903C LSLS R2, R2, #2
.text:0001903E STR R2, [R3,R7]
.text:00019040 LDR R3, [R2,R4]
.text:00019042 MOVS R1, #0xC4
.text:00019044 LDR R1, [R1,R7]
.text:00019046 LDR R3, [R3,#8]
.text:00019048 LDR R4, [R3,R1]
.text:0001904A CMP R4, #0
.text:0001904C BNE loc_190EE
.text:0001904E MOVS R2, #0xCC
.text:00019050 LDR R2, [R2,R7]
.text:00019052 MOVS R3, #0x34
.text:00019054 MOVS R4, #0xBC
.text:00019056 MULS R3, R2
.text:00019058 LDR R4, [R4,R7]
.text:0001905A LDR R2, =0xFFFFFE90
.text:0001905C MOVS R1, #0xD0
.text:0001905E LDR R2, [R4,R2]
.text:00019060 MOVS R4, #0xE8
.text:00019062 ADDS R0, R3, R2
.text:00019064 STR R0, [R1,R7]
.text:00019066 MOVS R1, R5
.text:00019068 STR R2, [R4,R7]
.text:0001906A BL _Z13dexStringByIdPK7DexFilej ; dexStringById(DexFile const*,uint)
.text:0001906E LDR R2, [R7,#0x28]
.text:00019070 MOVS R3, #0x29C
.text:00019074 LDR R2, [R2]
.text:00019076 MOVS R1, R0
.text:00019078 LDR R0, [R7,#0x28]
.text:0001907A LDR R3, [R2,R3]
.text:0001907C BLX R3
.text:0001907E ADDS R3, R4, R7
.text:00019080 STR R0, [R3]
.text:00019082 CMP R0, #0
.text:00019084 BNE loc_190A6
.text:00019086 MOVS R6, #0x8E
.text:00019088 MOVS R5, #0xC8
.text:0001908A LSLS R6, R6, #1
.text:0001908C MOVS R4, #0xCC
.text:0001908E LDR R0, [R7,#0x28]
.text:00019090 LDR R1, [R5,R7]
.text:00019092 ADDS R2, R7, R6
.text:00019094 LDR R3, [R4,R7]
.text:00019096 BL _Z24dvmMterp_exceptionThrownP7_JNIEnvPK7DexCodePPKti ; dvmMterp_exceptionThrown(_JNIEnv *,DexCode const*,ushort const**,int)
.text:0001909A CMP R0, #0
.text:0001909C BEQ loc_190A2
.text:0001909E BL def_182CE ; jumptable 000182CE default case
.text:000190A2 ; ---------------------------------------------------------------------------
.text:000190A2
.text:000190A2 loc_190A2 ; CODE XREF: .text:0001909Cj
.text:000190A2 BL loc_226FE
.text:000190A6 ; ---------------------------------------------------------------------------
.text:000190A6
.text:000190A6 loc_190A6 ; CODE XREF: .text:00019084j
.text:000190A6 MOVS R2, #0xE8
.text:000190A8 LDR R0, [R7,#0x28]
.text:000190AA LDR R1, [R2,R7]
.text:000190AC BL _ZN7_JNIEnv12NewGlobalRefEP8_jobject ; _JNIEnv::NewGlobalRef(_jobject *)
.text:000190B0 SUBS R4, R0, #0
.text:000190B2 BEQ loc_190D2
.text:000190B4 MOVS R1, #0xB4
.text:000190B6 MOVS R5, #0xB0
.text:000190B8 LDR R0, [R1,R7]
.text:000190BA LDR R5, [R5,R7]
.text:000190BC MOVS R2, #0xC4
.text:000190BE LDR R2, [R2,R7]
.text:000190C0 LDR R3, [R5,R0]
.text:000190C2 LDR R0, [R7,#0x28]
.text:000190C4 LDR R3, [R3,#8]
.text:000190C6 STR R4, [R3,R2]
.text:000190C8 MOVS R3, #0xE8
.text:000190CA LDR R1, [R3,R7]
.text:000190CC BL _ZN7_JNIEnv14DeleteLocalRefEP8_jobject ; _JNIEnv::DeleteLocalRef(_jobject *)
.text:000190D0 B loc_190EE
.text:000190D2 ; ---------------------------------------------------------------------------
.text:000190D2
.text:000190D2 loc_190D2 ; CODE XREF: .text:000190B2j
.text:000190D2 MOVS R4, #0xD0
.text:000190D4 ADDS R4, R4, R7
.text:000190D6 MOVS R1, R5
.text:000190D8 LDR R0, [R4]
.text:000190DA BL _Z13dexStringByIdPK7DexFilej ; dexStringById(DexFile const*,uint)
.text:000190DE LDR R2, =(aOp_const_strin - 0x190EE)
.text:000190E0 MOVS R5, #0xC0
.text:000190E2 ADDS R5, R5, R7
.text:000190E4 MOVS R3, R0
.text:000190E6 LDR R1, [R5]
.text:000190E8 MOVS R0, #6
.text:000190EA ADD R2, PC ; "OP_CONST_STRING(%s) : env->NewGlobalRef"...
.text:000190EC B loc_19214
.text:000190EE ; ---------------------------------------------------------------------------
.text:000190EE
.text:000190EE loc_190EE ; CODE XREF: .text:0001904Cj
.text:000190EE ; .text:000190D0j
.text:000190EE MOVS R1, #0x12C
.text:000190F2 STR R4, [SP]
.text:000190F4 ADDS R1, R7, R1
.text:000190F6 MOVS R2, #0xE8
.text:000190F8 MOVS R5, #0xE4
.text:000190FA MOVS R3, R6
.text:000190FC STR R1, [R2,R7]
.text:000190FE LDR R0, [R7,#0x28]
.text:00019100 LDR R2, [R5,R7]
.text:00019102 MOVS R6, #0xE8
.text:00019104 BL _Z17SET_REGISTER_FUNCP7_JNIEnvP14ReferenceTablePjij ; SET_REGISTER_FUNC(_JNIEnv *,ReferenceTable *,uint *,int,uint)
.text:00019108 MOVS R1, R4
.text:0001910A LDR R0, [R6,R7]
.text:0001910C BL _Z22dvmAddToReferenceTableP14ReferenceTablePv ; dvmAddToReferenceTable(ReferenceTable *,void *)
.text:00019110 MOVS R0, #0x11C
.text:00019114 LDR R3, [R0,R7]
.text:00019116 ADDS R1, R0, R7
.text:00019118 ADDS R3, #4
.text:0001911A STR R3, [R1]
.text:0001911C
.text:0001911C loc_1911C ; CODE XREF: .text:loc_182CEj
.text:0001911C ; DATA XREF: .text:00018340o
.text:0001911C BL def_182CE ; jumptable 000182CE default case
.text:00019120 ; ---------------------------------------------------------------------------
.text:00019120 MOVS R2, #0x11C
.text:00019124 LDR R3, [R2,R7]
.text:00019126 ASRS R6, R4, #8
.text:00019128 MOVS R4, #0xC0
.text:0001912A LDRH R2, [R3,#2]
.text:0001912C LDRH R3, [R3,#4]
.text:0001912E MOVS R0, #2
.text:00019130 LSLS R3, R3, #0x10
.text:00019132 MOVS R5, R3
.text:00019134 LDR R3, =(aVdog - 0x1913E)
.text:00019136 ORRS R5, R2
.text:00019138 ADDS R2, R4, R7
.text:0001913A ADD R3, PC ; "VDOG"
.text:0001913C STR R3, [R4,R7]
.text:0001913E STR R5, [SP]
.text:00019140 LDR R1, [R2]
.text:00019142 LDR R2, =(aConstStringJum - 0x1914C)
.text:00019144 MOVS R3, R6
.text:00019146 MOVS R4, #0xC4
.text:00019148 ADD R2, PC ; "|const-string/jumbo v%d string@0x%08x"
.text:0001914A BL j_j___android_log_print
.text:0001914E LSLS R3, R5, #2
.text:00019150 MOVS R0, #0xBC
.text:00019152 STR R3, [R4,R7]
.text:00019154 LDR R0, [R0,R7]
.text:00019156 LDR R3, =0xFFFFFE94
.text:00019158 MOVS R1, #0xCC
.text:0001915A LDR R1, [R1,R7]
.text:0001915C LDR R3, [R0,R3]
.text:0001915E MOVS R0, #0xB4
.text:00019160 LSLS R1, R1, #2
.text:00019162 STR R3, [R0,R7]
.text:00019164 LDR R3, [R1,R3]
.text:00019166 MOVS R0, #0xC4
.text:00019168 LDR R0, [R0,R7]
.text:0001916A LDR R3, [R3,#8]
.text:0001916C MOVS R2, #0xB0
.text:0001916E STR R1, [R2,R7]
.text:00019170 LDR R4, [R3,R0]
.text:00019172 CMP R4, #0
.text:00019174 BNE loc_19268
.text:00019176 MOVS R1, #0xCC
.text:00019178 LDR R1, [R1,R7]
.text:0001917A MOVS R4, #0xBC
.text:0001917C LDR R4, [R4,R7]
.text:0001917E LDR R2, =0xFFFFFE90
.text:00019180 MOVS R3, #0x34
.text:00019182 MULS R3, R1
.text:00019184 LDR R2, [R4,R2]
.text:00019186 MOVS R1, #0xD0
.text:00019188 MOVS R4, #0xE8
.text:0001918A ADDS R0, R3, R2
.text:0001918C STR R0, [R1,R7]
.text:0001918E MOVS R1, R5
.text:00019190 STR R2, [R4,R7]
.text:00019192 BL _Z13dexStringByIdPK7DexFilej ; dexStringById(DexFile const*,uint)
.text:00019196 LDR R2, [R7,#0x28]
.text:00019198 MOVS R3, #0x29C
.text:0001919C LDR R2, [R2]
.text:0001919E MOVS R1, R0
.text:000191A0 LDR R0, [R7,#0x28]
.text:000191A2 LDR R3, [R2,R3]
.text:000191A4 BLX R3
.text:000191A6 ADDS R3, R4, R7
.text:000191A8 STR R0, [R3]
.text:000191AA CMP R0, #0
.text:000191AC BNE loc_191CE
.text:000191AE MOVS R6, #0x8E
.text:000191B0 MOVS R5, #0xC8
.text:000191B2 LSLS R6, R6, #1
.text:000191B4 MOVS R4, #0xCC
.text:000191B6 LDR R0, [R7,#0x28]
.text:000191B8 LDR R1, [R5,R7]
.text:000191BA ADDS R2, R7, R6
.text:000191BC LDR R3, [R4,R7]
.text:000191BE BL _Z24dvmMterp_exceptionThrownP7_JNIEnvPK7DexCodePPKti ; dvmMterp_exceptionThrown(_JNIEnv *,DexCode const*,ushort const**,int)
.text:000191C2 CMP R0, #0
.text:000191C4 BEQ loc_191CA
.text:000191C6 BL def_182CE ; jumptable 000182CE default case
.text:000191CA ; -------------------------------------------------------------------------
经过分析发现，该vmp执行引擎中的指令没有混淆（与原始dalvik指令码完全对应），为还原dex中的函数提供了良好基础。
获取函数真实指令：
vmp执行引擎通过函数参数中的int型数值对函数信息和原始指令数据进行索引，其实就是datarc文件在内存中的解密数据，
解密后数据见附件（datarc.bin）。
隐藏函数还原
隐藏函数的恢复：
综合分析的结果可以发现，由于指令码没有混淆，所以得到的指令数据就是原始dex中的指令，只要修正原始dex中相应函数的code_off值
就可实现函数恢复。但由于索引信息中只有函数的类名、函数名和签名等信息，所以需要自己根据信息索引，实现code_off位置的查找和修改。
本人根据分析结果，实现的一个简单的恢复方法（美中不足的是原始dex中有207个函数被隐藏，最后有两个函数没有成功恢复）
主函数如下：
private void fixDexFile(String inPath, String outPath, String dataPath) throws IOException {
byte[] oriDex;
try {
File f = new File(inPath);
fileSize = f.length();
FileInputStream in1 = new FileInputStream(f);
DataInputStream data_in = new DataInputStream(in1);
oriDex = new byte[(int) fileSize];
data_in.read(oriDex, 0, (int) fileSize);
DexFileReader dexFileReader = new DexFileReader(f);
dexFileReader.accept(w); //锟斤拷DEX锟斤拷锟捷讹拷取锟斤拷cp锟斤拷锟斤拷锟斤拷锟斤拷锟�
} catch(NoSuchFileException e) {
//e.printStackTrace();
System.out.println(e.getFile() + "锟斤拷锟斤拷锟侥硷拷锟斤拷锟斤拷锟斤拷");
return;
}
System.out.println(fileSize);
startPos = getNearBigNum(fileSize);
System.out.println(startPos);
File data = new File(dataPath);
int dataSize = (int)(data.length());
FileInputStream in1 = new FileInputStream(data);
DataInputStream data_in = new DataInputStream(in1);
byte[] dataBuf = new byte[dataSize];
data_in.read(dataBuf, 0, dataSize);
int indexOff = bytesToInt(getData(dataBuf, 0x18, 0x4));
//System.out.println(indexOff);
for(int i = 0; i < 207; ++i) {
int nameOff = bytesToInt(getData(dataBuf, indexOff + i * 0xC, 0x4));
int shortyOff = bytesToInt(getData(dataBuf, indexOff + 4 + i * 0xC, 0x4));
int codeOff = bytesToInt(getData(dataBuf, indexOff + 8 + i * 0xC, 0x4));
String funcInfo = getStr(dataBuf, nameOff);
funcInfo = funcInfo.substring(0, funcInfo.indexOf('('));
/*System.out.println(funcInfo);
System.out.println(getStr(dataBuf, shortyOff));
System.out.println(codeOff);
System.out.println("===========");*/
func2code.put(funcInfo, codeOff);
}
//code相关的
List<ClassDataItem> classDataList = Arrays.asList(w.cp.classDataItems.toArray(new ClassDataItem[] {}));
int size = classDataList.size();
for(int i = 0; i < size; ++i)
{
handleClassDataItem(classDataList.get(i), oriDex);
}
int s = (int) (dataSize + this.startPos);
byte[] finalFile = new byte[s];
for(int i = 0; i < fileSize; ++i) {
finalFile[i] = oriDex[i];
}
for(int i = 0; i < dataSize; ++i) {
finalFile[(int) (i + this.startPos)] = dataBuf[i];
}
File file = new File (outPath);
FileOutputStream fs= new FileOutputStream(file);
fs.write(finalFile);
fs.flush();
fs.close();
System.out.println("OK");
}
恢复原理如下：
首先，读取原dex文件，获取其函数中的code_off位置信息并记录
然后，解析datarc文件，读取其中的函数信息和真实指令信息
最后，根据函数信息匹配到要还原的函数，修改其code_off数值到真实指令信息位置（真实指令数据被附加在原dex数据之后）
总结
由于code_off数值为uleb128格式，原始字节和新数据字节不匹配时没有办法存储，所以导致两个函数无法恢复（Lcom/andview/refreshview/recyclerview/BaseRecyclerAdapter;onCreateViewHolder和Lcom/j256/ormlite/android/apptools/OrmLiteSqliteOpenHelper;onCreate）
这也是由于该恢复方法的局限性造成的。（恢复后的dex见附件：tax1_.dex tax2_.dex）
欢迎各位同仁提出宝贵意见，共同提高技术水平。（由于其中一个dex文件较大，进行了压缩处理，请需要的小伙伴解压获取）
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
对头，不知道时哪家公司的，你遇到过没 |
|
|
有企业版的可以mi我一下，我想看看企业版的样子，感觉不像是娜迦的，难道娜迦新出了VMP正在测试么 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
对啊，给了一个学习VMP的好例子，等我的VMP实现了，就算是裸壳也不怕了，哈哈，保证还原不出原始DEX~~~ |
|
|
对了，你们有没有企业版加固的APK，我想看看企业版是什么样子，网上找不到呀 |
|
|
|
|
|
你的用户名是不是有问题，私信发不了啊 |
|
|
好啦，给你发了消息啦，期待娜迦的企业版APK~~ |
|
|
|
|
|
别人企业的apk，没有授权不好发呀。。。 |
|
|
能发一个so吗 |
|
|
你加我扣扣564551045 |
|
|
|
