What is the method of dynamically exporting dex files in Android
This article introduces the relevant knowledge of "what is the method of dynamically exporting dex files in Android". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!
1. Start ida port snooping 1.1 start Android_server service
1.2 Port Forwardin
1.3 Software enters debug mode
2.ida downtime 2.1attach additional process
2.2 break three items
2.3 Select process
2.4 Open Modules
Search art
PS: a little knowledge
Before Android version 4.4, the system functions are in libdvm.so.
After Android 5.0, the system function is in libart.so
2.5 Open the Openmemory () function
Search for the Openmemory function in libart.so and follow it.
PS: a little knowledge
Generally speaking, the system dex will be loaded in this function, but there will be a problem, as described later.
2.6 Lower breakpoint
3. Run the program to the next break 3.1 jdb forward the running program
3.2View IDA running
Successfully cut off, and run to where we cut off.
3.3View the location of dex
Open the register window and you can see that R1 is our dex
Then open R1 in the Hex window.
You can clearly see the binary structure of the dex file. If you don't understand, you can take a look at the previous dex file analysis.
3.4 extracting key information
The first key message: address offset: 0xF35CA328
The second key message: file offset: 70 35 01 00, which is converted to 0x00013570.
Add using a hexadecimal adder, F35DD898
4. Dump4.1 uses scripts for dump
Static main (void) {auto fp, begin, end, dexbyte; / / Open or create a file fp = fopen ("d:\\ dump.dex", "wb"); / / dex base address begin = 0xF34C6320; / / dex base address + dex file size end = begin + 0x00013570; for (dexbyte = begin; dexbyte < end; dexbyte +) {/ / dump it to the local file by byte fputc (Byte (dexbyte), fp);}}
4.2 script dump run
Once the script is completed, click run.
4.3 successful dump
This is the end of the content of "what is the method of dynamically exporting dex files in Android". Thank you for your reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!
