https://github.com/smartdone/dexdump
这是xposed版本的
首先 入口指向如下
com.smartdone.dexdump.Main
根据源码可以看得到
public class Main implements IXposedHookLoadPackage {
private static final String TAG = "DEX_DUMP";
@Override
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
List hooklist = Config.getConfig();
if(!Config.contains(hooklist, loadPackageParam.packageName))
return;
XposedBridge.log("对" + loadPackageParam.packageName + "进行处理");
Log.e(TAG, "开始处理: " + loadPackageParam.packageName);
try{
System.load("/data/local/tmp/libhook.so");
}catch (Exception e) {
Log.e(TAG, "加载动态库失败：" + e.getMessage());
}
Log.e(TAG, "加载动态库成功");
XposedHelpers.findAndHookMethod("android.app.Application", loadPackageParam.classLoader, "attach", Context.class, new XC_MethodHook() {
private Context context;
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
Dumpper.dump();
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
}
});
}
}
代码都是通过Dumpper.dump()方法去实现的
而这个方法是native方法
而查看源码可以看到，其实是使用hook特定函数去脱壳
art::DexFile *new_openmemory(const byte *base, size_t size, const std::string &location,
uint32_t location_checksum, art::MemMap *mem_map,
const art::OatDexFile *oat_dex_file, std::string *error_msg) {
__android_log_print(ANDROID_LOG_ERROR, TAG, "art::DexFile::OpenMemory is called");
writeToFile(pname, (uint8_t *) base, size);
return (*old_openmemory)(base, size, location, location_checksum, mem_map, oat_dex_file,
error_msg);
}
art::DexFile *new_openmemory_23(void* DexFile_thiz,char* base,int size,void* location,
void* location_checksum,void* mem_map,void* oat_dex_file,void* error_meessage) {
writeToFile(pname, (u_int8_t *)base, size);
return (*old_openmemory_23)(DexFile_thiz, base, size, location, location_checksum, mem_map,
oat_dex_file, error_meessage);
}
通过判断不同的版本，去hook不同的函数，获得base以及size的长度，然后dump下来。
跟ida中dump的代码很像，或者说，思路都是大同小异的，通过获取dexFile的类，或者查找带有base size的函数去hook，然后dump 文件下来。
frida版本
image.png
首先hook dexFile的openMemory方法
image.png
这里不是很清楚为啥是用args1而不是args0
image.png
当然，网上有64的写法，直接取r0寄存器的值
if(Java.available) {
Java.perform(function(){
var dexBase64 = "ZGV4CjAzNQCjsh5+52qOBRMl1aMHk33QkLmfsSbOla5wDwAAcAAAAHhWNBIAAAAAAAAAAKAOAABpAAAAcAAAABwAAAAUAgAAGgAAAIQCAAABAAAAvAMAACUAAADEAwAAAQAAAOwEAABkCgAADAUAAAwFAAAPBQAAEgUAABcFAAAfBQAAIwUAADgFAABGBQAASQUAAE0FAABSBQAAVQUAAFkFAABeBQAAYwUAAHcFAACXBQAAtgUAAM8FAADiBQAA+AUAABEGAAAoBgAATAYAAG4GAACCBgAAlgYAALEGAADIBgAA4wYAAP4GAAAaBwAAMQcAAEgHAABzBwAAjAcAAKUHAADSBwAA6AcAAPoHAAD/BwAAAggAAAYIAAAKCAAADQgAABEIAAAlCAAAOggAAE8IAABsCAAAcQgAAHkIAACGCAAAlQgAAKAIAACnCAAAqggAALcIAADKCAAA0wgAANYIAADaCAAA4wgAAPEIAAD5CAAAAAkAAAsJAAAQCQAAGgkAACwJAABDCQAAVQkAAGkJAAB0CQAAfQkAAI0JAACgCQAArwkAAMAJAADJCQAAzAkAANQJAADeCQAA7AkAAPoJAAAFCgAADQoAABYKAAAcCgAAJgoAACwKAAA5CgAAQQoAAEcKAABQCgAAWgoAAGsKAABzCgAAggoAAIgKAACOCgAAlwoAAKAKAACqCgAAwAoAAAcAAAAOAAAADwAAABAAAAARAAAAEgAAABQAAAAVAAAAFgAAABcAAAAYAAAAGQAAABoAAAAbAAAAHAAAAB0AAAAeAAAAHwAAACIAAAAjAAAAJQAAACYAAAAoAAAAKwAAAC0AAAAuAAAALwAAADAAAAAHAAAAAAAAAAAAAAAIAAAAAAAAAMgKAAAJAAAAAAAAAAgLAAAKAAAABQAAAAAAAAALAAAABQAAAOgKAAAKAAAACgAAAAAAAAALAAAACgAAAMgKAAAMAAAACgAAANAKAAANAAAACgAAANgKAAANAAAACgAAAOAKAAAKAAAACwAAAAAAAAALAAAADAAAAOgKAAALAAAADwAAAOgKAAALAAAAEQAAAPAKAAAKAAAAEwAAAAAAAAAKAAAAFAAAAAAAAAAoAAAAFgAAAAAAAAApAAAAFgAAAPAKAAApAAAAFgAAAPgKAAAqAAAAFgAAAAALAAArAAAAFwAAAAAAAAAsAAAAFwAAAMgKAAAKAAAAGAAAAAAAAAALAAAAGQAAABALAAALAAAAGgAAAPAKAAAKAAAAGwAAAAAAAAACAAsAJwAAAAEAAgA3AAAAAgAQAAMAAAACAA0ARAAAAAIAGABFAAAAAgAIAEoAAAACABEAUwAAAAQADgA9AAAABQAMAEYAAAAFABkARwAAAAUACgBJAAAABQADAEwAAAAGAAQAVAAAAAgAEABfAAAACQAQAF8AAAAKABAAAwAAAAoAAwBDAAAACwAVAD8AAAAMABAAAwAAAAwACwAyAAAADAAKAGYAAAAOAAcAQgAAAA4AAQBIAAAADwAGAEIAAAAPABMAYQAAABAACgBJAAAAEAAWAEsAAAAQAAkAUAAAABEAEAADAAAAEQAVADEAAAARAA8AUQAAABEAAABiAAAAEQAXAGUAAAASABIAYwAAABMAFABNAAAAEwAFAFoAAAAUABQATgAAABQABQBZAAAAAgAAAAEAAAAKAAAAAAAAAAUAAAA8CwAAhA4AABYLAAABKAABKQADLS0+AAY8aW5pdD4AAj47ABNFbnVtZXJhdGVDbGFzcy5qYXZhAAxGUmlEQV9VTlBBQ0sAAUkAAklMAANJTEwAAUwAAkxMAANMTEkAA0xMTAASTGFuZHJvaWQvdXRpbC9Mb2c7AB5MY29tL3NtYXJ0ZG9uZS9FbnVtZXJhdGVDbGFzczsAHUxkYWx2aWsvYW5ub3RhdGlvbi9TaWduYXR1cmU7ABdMZGFsdmlrL3N5c3RlbS9EZXhGaWxlOwARTGphdmEvbGFuZy9DbGFzczsAFExqYXZhL2xhbmcvQ2xhc3M8Kj47ABdMamF2YS9sYW5nL0NsYXNzTG9hZGVyOwAVTGphdmEvbGFuZy9FeGNlcHRpb247ACJMamF2YS9sYW5nL0lsbGVnYWxBY2Nlc3NFeGNlcHRpb247ACBMamF2YS9sYW5nL05vU3VjaEZpZWxkRXhjZXB0aW9uOwASTGphdmEvbGFuZy9PYmplY3Q7ABJMamF2YS9sYW5nL1N0cmluZzsAGUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsAFUxqYXZhL2xhbmcvVGhyb3dhYmxlOwAZTGphdmEvbGFuZy9yZWZsZWN0L0FycmF5OwAZTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwAaTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsAFUxqYXZhL3V0aWwvQXJyYXlMaXN0OwAVTGphdmEvdXRpbC9BcnJheUxpc3Q8AClMamF2YS91dGlsL0FycmF5TGlzdDxMamF2YS9sYW5nL1N0cmluZzs+OwAXTGphdmEvdXRpbC9Db2xsZWN0aW9uczsAF0xqYXZhL3V0aWwvRW51bWVyYXRpb247ACtMamF2YS91dGlsL0VudW1lcmF0aW9uPExqYXZhL2xhbmcvU3RyaW5nOz47ABRMamF2YS91dGlsL0l0ZXJhdG9yOwAQTGphdmEvdXRpbC9MaXN0OwADVEFHAAFWAAJWTAACVloAAVoAAlpMABJbTGphdmEvbGFuZy9DbGFzczsAE1tMamF2YS9sYW5nL09iamVjdDsAE1tMamF2YS9sYW5nL1N0cmluZzsAG1tMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwADYWRkAAZhcHBlbmQAC2NsYXNzTG9hZGVyAA1jbGFzc05hbWVMaXN0AAljbGFzc2xpc3QABWNsYXp6AAFkAAtkZXhFbGVtZW50cwARZGV4RWxlbWVudHNMZW5ndGgAB2RleEZpbGUAAWUAAmUyAAdlbnRyaWVzAAxlbnVtZXJhdGlvbnMABmVxdWFscwAFZmllbGQACWZpZWxkTmFtZQADZ2V0AAhnZXRDbGFzcwAQZ2V0Q2xhc3NOYW1lTGlzdAAVZ2V0Q2xhc3NOYW1lTGlzdEFycmF5ABBnZXREZWNsYXJlZEZpZWxkABJnZXREZWNsYXJlZE1ldGhvZHMACWdldExlbmd0aAAHZ2V0TmFtZQAOZ2V0T2JqZWN0RmllbGQAEWdldFBhcmFtZXRlclR5cGVzAA1nZXRTdXBlcmNsYXNzAA9oYXNNb3JlRWxlbWVudHMAB2hhc05leHQAAWkABmludm9rZQAIaXRlcmF0b3IADGxvYWQgY2xhc3M6IAAMbG9hZEFsbENsYXNzAAlsb2FkQ2xhc3MABm1ldGhvZAAHbWV0aG9kcwAEbmFtZQAIbmFtZWxpc3QABG5leHQAC25leHRFbGVtZW50AAZvYmplY3QABG9ianMAB3Bhcm1sZW4ACHBhdGhMaXN0AA9wcmludFN0YWNrVHJhY2UABnJldHZhbAANc2V0QWNjZXNzaWJsZQAEc2l6ZQAEc29ydAAHc3VjY2VzcwAHdG9BcnJheQAIdG9TdHJpbmcAFHRyeSB0byBsb2FkIG1ldGhvZDogAAV2YWx1ZQAAAQAAAAoAAAACAAAACgAAAAIAAAAKAAsAAgAAAAoAGQABAAAACwAAAAEAAAAGAAAAAQAAABUAAAABAAAAFwAAAAIAAAALAAsAAQAAABkAARcGAgMBaBwGFwAXFBcBFyAXGRcEAAAAAAAAAAAAAQAAABkLAAAAAAAAAAAAAAEAAAAAAAAAAgAAADQLAAAOAA4AJAE0DlsEADUSIsMDATkLSwMCOgEdAwNQAS3/BAQ/FCVpoQUEQgUBBQIFAxwfPAA1ATQOSwQAWRIiaQMBYRs8ABMCXEIOSwMANwYBEBBLAwFBEEtdBQEeAwE9CTsFARkeAwE8CjxNBQEfAD0BNA5LBAA2EiL/AwJYDEsEAzcGFEsDBFccARoPaQMHVhFaAwheAS0DCV0aASYPSwJ7dwUHBQgFCUIFAgUDBQQgBQAbIAABAAEAAQAAAFQLAAAEAAAAcBAOAAAADgAHAAEAAgABAFgLAABBAAAAIgARAHAQGwAAABoBXgBxIAQAFgAMARoCOABxIAQAIQAMAXEQFQABAAoCEgM1IyUAcSAUADEADAQaBToAcSAEAFQADAQfBAQAbhAGAAQADARyECEABAAKBTgFDAByECIABAAMBR8FCwBuIBwAUAAo8dgDAwEo3CgCDQFxECAAAAARAAAABQAAADIAAQABAQc8AwABAAIAAACHCwAADgAAAHEQAgACAAwAbhAeAAAACgEjERoAbiAfABAAEQEFAAIAAgABAJgLAAAxAAAAbhAPAAMADABuEAkAAAAMARwCCgBuEAkAAgAMAm4gEAAhAAoBOQEdAG4gBwBAAAwBEhJuIBcAIQBuIBYAMQAMAhECDQFuEAwAAQAoCQ0BbhANAAEAbhAKAAAADAAo1hIBEQEAABQAAAAMAAEAAQIJJgghAAAOAAEAAwABAMILAAB7AAAAcRACAA0ADABuEB0AAAAMAXIQIwABAAoCOAJsAHIQJAABAAwCHwILAG4gCwAtAAwDbhAIAAMADAQaBQYAIgYMAHAQEQAGABoHUgBuIBIAdgBuEAkAAwAMB24gEgB2AG4QEwAGAAwGcSAAAGUAIUUSBjVWPwBGBwQGbhAZAAcADAghiCOJGQAaCgYAIgsMAHAQEQALABoMZwBuIBIAywBuEAkAAwAMDG4gEgDLABoMAgBuIBIAywBuEBgABwAMDG4gEgDLAG4QEwALAAwLcSAAALoAEgpuMBoApwkaCgYAGgtkAHEgAAC6ANgGBgEowiiRKAINAA4AAAAAAAAAdAABAAEBDXkBAAUAABoBgYAEiBgBCaAYAQnAGQEJ7BkBCfAaEQAAAAAAAAABAAAAAAAAAAEAAABpAAAAcAAAAAIAAAAcAAAAFAIAAAMAAAAaAAAAhAIAAAQAAAABAAAAvAMAAAUAAAAlAAAAxAMAAAYAAAABAAAA7AQAAAIgAABpAAAADAUAAAEQAAAKAAAAyAoAAAUgAAABAAAAFgsAAAQgAAABAAAAGQsAAAMQAAADAAAALAsAAAYgAAABAAAAPAsAAAMgAAAFAAAAVAsAAAEgAAAFAAAACAwAAAAgAAABAAAAhA4AAAAQAAABAAAAoA4AAA==";
var application = Java.use("android.app.Application");
var BaseDexClassLoader = Java.use("dalvik.system.BaseDexClassLoader");
var Base64 = Java.use("android.util.Base64");
var FileOutputStream = Java.use("java.io.FileOutputStream");
var DexClassLoader = Java.use("dalvik.system.DexClassLoader");
var reflectField = Java.use("java.lang.reflect.Field");
var reflectMethod = Java.use("java.lang.reflect.Method");
var reflectObject = Java.use("java.lang.Object");
var reflectClass = Java.use("java.lang.Class");
var reflectString = Java.use("java.lang.String");
var reflectClassloader = Java.use("java.lang.ClassLoader");
if(application != undefined) {
application.attach.overload('android.content.Context').implementation = function(context) {
var result = this.attach(context);
var classloader = context.getClassLoader();
var filesDir = context.getFilesDir();
var codeCacheDir = context.getCodeCacheDir();
console.log("files dir: " + filesDir);
console.log("code cache dir: " + codeCacheDir);
if(classloader != undefined) {
var casedloader = Java.cast(classloader, BaseDexClassLoader);
var dexbytes = Base64.decode(dexBase64, 0);
var dexpath = filesDir + "/emmm.dex";
var fout = FileOutputStream.$new(dexpath);
fout.write(dexbytes, 0, dexbytes.length);
fout.close();
console.log("write dex to " + dexpath);
var dexstr = dexpath.toString();
var cachestr = codeCacheDir.toString();
var dyndex = DexClassLoader.$new(dexstr, cachestr, cachestr, classloader);
console.log(dyndex.toString());
var EnumerateClass = dyndex.loadClass("com.smartdone.EnumerateClass");
var castedEnumerateClass = Java.cast(EnumerateClass, reflectClass);
var methods = castedEnumerateClass.getDeclaredMethods();
// loadAllClass
var loadAllClass = undefined;
for(var i in methods) {
console.log(methods[i].getName());
if(methods[i].getName() == "loadAllClass") {
console.log("find loadAllClass");
loadAllClass = methods[i];
}
}
if(loadAllClass != undefined) {
console.log("loadAllClass: " + loadAllClass.toString());
var args = Java.array('Ljava.lang.Object;',[classloader]);
var classlist = loadAllClass.invoke(null , args);
console.log("start dump dex ");
for(var i in dexrec) {
if(Memory.readU32(dexrec[i]) == DEX_MAGIC) {
var dex_len = Memory.readU32(dexrec[i].add(0x20));
var dumppath = filesDir.toString() + "/" + dex_len.toString(0x10) + ".dex";
console.log(dumppath);
var dumpdexfile = new File(dumppath, "wb");
dumpdexfile.write(Memory.readByteArray(dexrec[i], dex_len));
dumpdexfile.close();
console.log("write file to " + dumppath);
}
}
}
} else {
console.error("unable get classloader");
}
return result;
}
}
});
}
然后接着先取application 的context，然后将自己的dex代码写到文件夹中。接着使用dex中的方法枚举loadAllClass方法，然后接着遍历dex的基址，然后dumpdex出来。
为什么要loadAllClass呢，主要是为了遍历类，让一些函数抽取壳的数据回填。
base64的代码如下
package com.smartdone;
import android.util.Log;
import dalvik.system.DexFile;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Enumeration;
import java.util.Iterator;
public class EnumerateClass {
private static final String TAG = "FRiDA_UNPACK";
public static ArrayList getClassNameList(ClassLoader classLoader) {
int i;
ArrayList classNameList = new ArrayList();
try {
Object dexElements = EnumerateClass.getObjectField(EnumerateClass.getObjectField(classLoader, "pathList"), "dexElements");
int dexElementsLength = Array.getLength(dexElements);
i = 0;
while(true) {
label_8:
if(i >= dexElementsLength) {
goto label_24;
}
Enumeration enumerations = ((DexFile)EnumerateClass.getObjectField(Array.get(dexElements, i), "dexFile")).entries();
while(true) {
if(!enumerations.hasMoreElements()) {
++i;
break;
}
classNameList.add(((String)enumerations.nextElement()));
}
}
}
catch(Exception v1) {
goto label_24;
}
++i;
goto label_8;
label_24:
Collections.sort(classNameList);
return classNameList;
}
public static String[] getClassNameListArray(ClassLoader classLoader) {
ArrayList namelist = EnumerateClass.getClassNameList(classLoader);
String[] retval = new String[namelist.size()];
namelist.toArray(((Object[])retval));
return retval;
}
public static Object getObjectField(Object object, String fieldName) {
Class clazz = object.getClass();
while(!clazz.getName().equals(Object.class.getName())) {
try {
Field field = clazz.getDeclaredField(fieldName);
field.setAccessible(true);
return field.get(object);
}
catch(NoSuchFieldException e) {
e.printStackTrace();
clazz = clazz.getSuperclass();
}
catch(IllegalAccessException e2) {
e2.printStackTrace();
}
}
return null;
}
public static void loadAllClass(ClassLoader classLoader) {
int v6_1;
Method[] methods;
Class clazz;
try {
Iterator v1 = EnumerateClass.getClassNameList(classLoader).iterator();
while(true) {
if(!v1.hasNext()) {
return;
}
Object v2 = v1.next();
clazz = classLoader.loadClass(((String)v2));
methods = clazz.getDeclaredMethods();
Log.d("FRiDA_UNPACK", "load class: " + clazz.getName());
v6_1 = 0;
label_19:
while(v6_1 < methods.length) {
goto label_20;
}
}
label_20:
Method method = methods[v6_1];
Object[] objs = new Object[method.getParameterTypes().length];
Log.d("FRiDA_UNPACK", "try to load method: " + clazz.getName() + "-->" + method.getName());
method.invoke(null, objs);
Log.d("FRiDA_UNPACK", "success");
++v6_1;
goto label_19;
}
catch(Throwable v0) {
}
}
}