dexdump源码分析

这是xposed版本的
首先入口指向如下
com.smartdone.dexdump.Main

根据源码可以看得到

public class Main implements IXposedHookLoadPackage {
    private static final String TAG = "DEX_DUMP";
    @Override
    public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {

        List<String> hooklist = Config.getConfig();

        if(!Config.contains(hooklist, loadPackageParam.packageName))
            return;

        XposedBridge.log("对" + loadPackageParam.packageName + "进行处理");
        Log.e(TAG, "开始处理: " + loadPackageParam.packageName);

        try{
            System.load("/data/local/tmp/libhook.so");
        }catch (Exception e) {
            Log.e(TAG, "加载动态库失败：" + e.getMessage());
        }
        Log.e(TAG, "加载动态库成功");
        XposedHelpers.findAndHookMethod("android.app.Application", loadPackageParam.classLoader, "attach", Context.class, new XC_MethodHook() {
            private Context context;
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
                Dumpper.dump();
            }

            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);
            }
        });
    }
}

代码都是通过Dumpper.dump()方法去实现的
而这个方法是native方法

而查看源码可以看到，其实是使用hook特定函数去脱壳

art::DexFile *new_openmemory(const byte *base, size_t size, const std::string &location,
                             uint32_t location_checksum, art::MemMap *mem_map,
                             const art::OatDexFile *oat_dex_file, std::string *error_msg) {
    __android_log_print(ANDROID_LOG_ERROR, TAG, "art::DexFile::OpenMemory is called");
    writeToFile(pname, (uint8_t *) base, size);
    return (*old_openmemory)(base, size, location, location_checksum, mem_map, oat_dex_file,
                             error_msg);
}


art::DexFile *new_openmemory_23(void* DexFile_thiz,char* base,int size,void* location,
                                void* location_checksum,void* mem_map,void* oat_dex_file,void* error_meessage) {
    writeToFile(pname, (u_int8_t *)base, size);
    return (*old_openmemory_23)(DexFile_thiz, base, size, location, location_checksum, mem_map,
                                oat_dex_file, error_meessage);
}

通过判断不同的版本，去hook不同的函数，获得base以及size的长度，然后dump下来。

跟ida中dump的代码很像，或者说，思路都是大同小异的，通过获取dexFile的类，或者查找带有base size的函数去hook，然后dump 文件下来。

frida版本

image.png

首先hook dexFile的openMemory方法

image.png

这里不是很清楚为啥是用args1而不是args0

image.png

当然，网上有64的写法，直接取r0寄存器的值

if(Java.available) {
    Java.perform(function(){

        var dexBase64 = "ZGV4CjAzNQCjsh5+52qOBRMl1aMHk33QkLmfsSbOla5wDwAAcAAAAHhWNBIAAAAAAAAAAKAOAABpAAAAcAAAABwAAAAUAgAAGgAAAIQCAAABAAAAvAMAACUAAADEAwAAAQAAAOwEAABkCgAADAUAAAwFAAAPBQAAEgUAABcFAAAfBQAAIwUAADgFAABGBQAASQUAAE0FAABSBQAAVQUAAFkFAABeBQAAYwUAAHcFAACXBQAAtgUAAM8FAADiBQAA+AUAABEGAAAoBgAATAYAAG4GAACCBgAAlgYAALEGAADIBgAA4wYAAP4GAAAaBwAAMQcAAEgHAABzBwAAjAcAAKUHAADSBwAA6AcAAPoHAAD/BwAAAggAAAYIAAAKCAAADQgAABEIAAAlCAAAOggAAE8IAABsCAAAcQgAAHkIAACGCAAAlQgAAKAIAACnCAAAqggAALcIAADKCAAA0wgAANYIAADaCAAA4wgAAPEIAAD5CAAAAAkAAAsJAAAQCQAAGgkAACwJAABDCQAAVQkAAGkJAAB0CQAAfQkAAI0JAACgCQAArwkAAMAJAADJCQAAzAkAANQJAADeCQAA7AkAAPoJAAAFCgAADQoAABYKAAAcCgAAJgoAACwKAAA5CgAAQQoAAEcKAABQCgAAWgoAAGsKAABzCgAAggoAAIgKAACOCgAAlwoAAKAKAACqCgAAwAoAAAcAAAAOAAAADwAAABAAAAARAAAAEgAAABQAAAAVAAAAFgAAABcAAAAYAAAAGQAAABoAAAAbAAAAHAAAAB0AAAAeAAAAHwAAACIAAAAjAAAAJQAAACYAAAAoAAAAKwAAAC0AAAAuAAAALwAAADAAAAAHAAAAAAAAAAAAAAAIAAAAAAAAAMgKAAAJAAAAAAAAAAgLAAAKAAAABQAAAAAAAAALAAAABQAAAOgKAAAKAAAACgAAAAAAAAALAAAACgAAAMgKAAAMAAAACgAAANAKAAANAAAACgAAANgKAAANAAAACgAAAOAKAAAKAAAACwAAAAAAAAALAAAADAAAAOgKAAALAAAADwAAAOgKAAALAAAAEQAAAPAKAAAKAAAAEwAAAAAAAAAKAAAAFAAAAAAAAAAoAAAAFgAAAAAAAAApAAAAFgAAAPAKAAApAAAAFgAAAPgKAAAqAAAAFgAAAAALAAArAAAAFwAAAAAAAAAsAAAAFwAAAMgKAAAKAAAAGAAAAAAAAAALAAAAGQAAABALAAALAAAAGgAAAPAKAAAKAAAAGwAAAAAAAAACAAsAJwAAAAEAAgA3AAAAAgAQAAMAAAACAA0ARAAAAAIAGABFAAAAAgAIAEoAAAACABEAUwAAAAQADgA9AAAABQAMAEYAAAAFABkARwAAAAUACgBJAAAABQADAEwAAAAGAAQAVAAAAAgAEABfAAAACQAQAF8AAAAKABAAAwAAAAoAAwBDAAAACwAVAD8AAAAMABAAAwAAAAwACwAyAAAADAAKAGYAAAAOAAcAQgAAAA4AAQBIAAAADwAGAEIAAAAPABMAYQAAABAACgBJAAAAEAAWAEsAAAAQAAkAUAAAABEAEAADAAAAEQAVADEAAAARAA8AUQAAABEAAABiAAAAEQAXAGUAAAASABIAYwAAABMAFABNAAAAEwAFAFoAAAAUABQATgAAABQABQBZAAAAAgAAAAEAAAAKAAAAAAAAAAUAAAA8CwAAhA4AABYLAAABKAABKQADLS0+AAY8aW5pdD4AAj47ABNFbnVtZXJhdGVDbGFzcy5qYXZhAAxGUmlEQV9VTlBBQ0sAAUkAAklMAANJTEwAAUwAAkxMAANMTEkAA0xMTAASTGFuZHJvaWQvdXRpbC9Mb2c7AB5MY29tL3NtYXJ0ZG9uZS9FbnVtZXJhdGVDbGFzczsAHUxkYWx2aWsvYW5ub3RhdGlvbi9TaWduYXR1cmU7ABdMZGFsdmlrL3N5c3RlbS9EZXhGaWxlOwARTGphdmEvbGFuZy9DbGFzczsAFExqYXZhL2xhbmcvQ2xhc3M8Kj47ABdMamF2YS9sYW5nL0NsYXNzTG9hZGVyOwAVTGphdmEvbGFuZy9FeGNlcHRpb247ACJMamF2YS9sYW5nL0lsbGVnYWxBY2Nlc3NFeGNlcHRpb247ACBMamF2YS9sYW5nL05vU3VjaEZpZWxkRXhjZXB0aW9uOwASTGphdmEvbGFuZy9PYmplY3Q7ABJMamF2YS9sYW5nL1N0cmluZzsAGUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsAFUxqYXZhL2xhbmcvVGhyb3dhYmxlOwAZTGphdmEvbGFuZy9yZWZsZWN0L0FycmF5OwAZTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwAaTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsAFUxqYXZhL3V0aWwvQXJyYXlMaXN0OwAVTGphdmEvdXRpbC9BcnJheUxpc3Q8AClMamF2YS91dGlsL0FycmF5TGlzdDxMamF2YS9sYW5nL1N0cmluZzs+OwAXTGphdmEvdXRpbC9Db2xsZWN0aW9uczsAF0xqYXZhL3V0aWwvRW51bWVyYXRpb247ACtMamF2YS91dGlsL0VudW1lcmF0aW9uPExqYXZhL2xhbmcvU3RyaW5nOz47ABRMamF2YS91dGlsL0l0ZXJhdG9yOwAQTGphdmEvdXRpbC9MaXN0OwADVEFHAAFWAAJWTAACVloAAVoAAlpMABJbTGphdmEvbGFuZy9DbGFzczsAE1tMamF2YS9sYW5nL09iamVjdDsAE1tMamF2YS9sYW5nL1N0cmluZzsAG1tMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwADYWRkAAZhcHBlbmQAC2NsYXNzTG9hZGVyAA1jbGFzc05hbWVMaXN0AAljbGFzc2xpc3QABWNsYXp6AAFkAAtkZXhFbGVtZW50cwARZGV4RWxlbWVudHNMZW5ndGgAB2RleEZpbGUAAWUAAmUyAAdlbnRyaWVzAAxlbnVtZXJhdGlvbnMABmVxdWFscwAFZmllbGQACWZpZWxkTmFtZQADZ2V0AAhnZXRDbGFzcwAQZ2V0Q2xhc3NOYW1lTGlzdAAVZ2V0Q2xhc3NOYW1lTGlzdEFycmF5ABBnZXREZWNsYXJlZEZpZWxkABJnZXREZWNsYXJlZE1ldGhvZHMACWdldExlbmd0aAAHZ2V0TmFtZQAOZ2V0T2JqZWN0RmllbGQAEWdldFBhcmFtZXRlclR5cGVzAA1nZXRTdXBlcmNsYXNzAA9oYXNNb3JlRWxlbWVudHMAB2hhc05leHQAAWkABmludm9rZQAIaXRlcmF0b3IADGxvYWQgY2xhc3M6IAAMbG9hZEFsbENsYXNzAAlsb2FkQ2xhc3MABm1ldGhvZAAHbWV0aG9kcwAEbmFtZQAIbmFtZWxpc3QABG5leHQAC25leHRFbGVtZW50AAZvYmplY3QABG9ianMAB3Bhcm1sZW4ACHBhdGhMaXN0AA9wcmludFN0YWNrVHJhY2UABnJldHZhbAANc2V0QWNjZXNzaWJsZQAEc2l6ZQAEc29ydAAHc3VjY2VzcwAHdG9BcnJheQAIdG9TdHJpbmcAFHRyeSB0byBsb2FkIG1ldGhvZDogAAV2YWx1ZQAAAQAAAAoAAAACAAAACgAAAAIAAAAKAAsAAgAAAAoAGQABAAAACwAAAAEAAAAGAAAAAQAAABUAAAABAAAAFwAAAAIAAAALAAsAAQAAABkAARcGAgMBaBwGFwAXFBcBFyAXGRcEAAAAAAAAAAAAAQAAABkLAAAAAAAAAAAAAAEAAAAAAAAAAgAAADQLAAAOAA4AJAE0DlsEADUSIsMDATkLSwMCOgEdAwNQAS3/BAQ/FCVpoQUEQgUBBQIFAxwfPAA1ATQOSwQAWRIiaQMBYRs8ABMCXEIOSwMANwYBEBBLAwFBEEtdBQEeAwE9CTsFARkeAwE8CjxNBQEfAD0BNA5LBAA2EiL/AwJYDEsEAzcGFEsDBFccARoPaQMHVhFaAwheAS0DCV0aASYPSwJ7dwUHBQgFCUIFAgUDBQQgBQAbIAABAAEAAQAAAFQLAAAEAAAAcBAOAAAADgAHAAEAAgABAFgLAABBAAAAIgARAHAQGwAAABoBXgBxIAQAFgAMARoCOABxIAQAIQAMAXEQFQABAAoCEgM1IyUAcSAUADEADAQaBToAcSAEAFQADAQfBAQAbhAGAAQADARyECEABAAKBTgFDAByECIABAAMBR8FCwBuIBwAUAAo8dgDAwEo3CgCDQFxECAAAAARAAAABQAAADIAAQABAQc8AwABAAIAAACHCwAADgAAAHEQAgACAAwAbhAeAAAACgEjERoAbiAfABAAEQEFAAIAAgABAJgLAAAxAAAAbhAPAAMADABuEAkAAAAMARwCCgBuEAkAAgAMAm4gEAAhAAoBOQEdAG4gBwBAAAwBEhJuIBcAIQBuIBYAMQAMAhECDQFuEAwAAQAoCQ0BbhANAAEAbhAKAAAADAAo1hIBEQEAABQAAAAMAAEAAQIJJgghAAAOAAEAAwABAMILAAB7AAAAcRACAA0ADABuEB0AAAAMAXIQIwABAAoCOAJsAHIQJAABAAwCHwILAG4gCwAtAAwDbhAIAAMADAQaBQYAIgYMAHAQEQAGABoHUgBuIBIAdgBuEAkAAwAMB24gEgB2AG4QEwAGAAwGcSAAAGUAIUUSBjVWPwBGBwQGbhAZAAcADAghiCOJGQAaCgYAIgsMAHAQEQALABoMZwBuIBIAywBuEAkAAwAMDG4gEgDLABoMAgBuIBIAywBuEBgABwAMDG4gEgDLAG4QEwALAAwLcSAAALoAEgpuMBoApwkaCgYAGgtkAHEgAAC6ANgGBgEowiiRKAINAA4AAAAAAAAAdAABAAEBDXkBAAUAABoBgYAEiBgBCaAYAQnAGQEJ7BkBCfAaEQAAAAAAAAABAAAAAAAAAAEAAABpAAAAcAAAAAIAAAAcAAAAFAIAAAMAAAAaAAAAhAIAAAQAAAABAAAAvAMAAAUAAAAlAAAAxAMAAAYAAAABAAAA7AQAAAIgAABpAAAADAUAAAEQAAAKAAAAyAoAAAUgAAABAAAAFgsAAAQgAAABAAAAGQsAAAMQAAADAAAALAsAAAYgAAABAAAAPAsAAAMgAAAFAAAAVAsAAAEgAAAFAAAACAwAAAAgAAABAAAAhA4AAAAQAAABAAAAoA4AAA==";
        var application = Java.use("android.app.Application");
        var BaseDexClassLoader = Java.use("dalvik.system.BaseDexClassLoader");
        var Base64 = Java.use("android.util.Base64");
        var FileOutputStream = Java.use("java.io.FileOutputStream");
        var DexClassLoader = Java.use("dalvik.system.DexClassLoader");

        var reflectField = Java.use("java.lang.reflect.Field");
        var reflectMethod = Java.use("java.lang.reflect.Method");
        var reflectObject = Java.use("java.lang.Object");
        var reflectClass = Java.use("java.lang.Class");
        var reflectString = Java.use("java.lang.String");
        var reflectClassloader = Java.use("java.lang.ClassLoader");


        if(application != undefined) {
            application.attach.overload('android.content.Context').implementation = function(context) {
                var result = this.attach(context);
                var classloader = context.getClassLoader();
                var filesDir = context.getFilesDir();
                var codeCacheDir = context.getCodeCacheDir();
                console.log("files dir: " + filesDir);
                console.log("code cache dir: " + codeCacheDir);
                if(classloader != undefined) {
                    var casedloader = Java.cast(classloader, BaseDexClassLoader);
                    var dexbytes = Base64.decode(dexBase64, 0);
                    var dexpath = filesDir + "/emmm.dex";
                    var fout = FileOutputStream.$new(dexpath);
                    fout.write(dexbytes, 0, dexbytes.length);
                    fout.close();
                    console.log("write dex to " + dexpath);

                    var dexstr = dexpath.toString();
                    var cachestr = codeCacheDir.toString();

                    var dyndex = DexClassLoader.$new(dexstr, cachestr, cachestr, classloader);
                    console.log(dyndex.toString());
                    var EnumerateClass = dyndex.loadClass("com.smartdone.EnumerateClass");
                    var castedEnumerateClass = Java.cast(EnumerateClass, reflectClass);
                    var methods = castedEnumerateClass.getDeclaredMethods();
                    // loadAllClass
                    var loadAllClass = undefined;
                    for(var i in methods) {
                        console.log(methods[i].getName());
                        if(methods[i].getName() == "loadAllClass") {
                            console.log("find loadAllClass");
                            loadAllClass = methods[i];
                        }
                    }
                    if(loadAllClass != undefined) {
                        console.log("loadAllClass: " + loadAllClass.toString());
                        var args = Java.array('Ljava.lang.Object;',[classloader]);
                        var classlist = loadAllClass.invoke(null , args);
                        console.log("start dump dex ");
                        for(var i in dexrec) {
                            if(Memory.readU32(dexrec[i]) == DEX_MAGIC) {
                                var dex_len = Memory.readU32(dexrec[i].add(0x20));
                                var dumppath = filesDir.toString() + "/" + dex_len.toString(0x10) + ".dex";
                                console.log(dumppath);
                                var dumpdexfile = new File(dumppath, "wb");
                                dumpdexfile.write(Memory.readByteArray(dexrec[i], dex_len));
                                dumpdexfile.close();
                                console.log("write file to " + dumppath);
                            }
                        }
                    }


                } else {
                    console.error("unable get classloader");
                }
                return result;
            }
        }
    });
}

然后接着先取application 的context，然后将自己的dex代码写到文件夹中。接着使用dex中的方法枚举loadAllClass方法，然后接着遍历dex的基址，然后dumpdex出来。

为什么要loadAllClass呢，主要是为了遍历类，让一些函数抽取壳的数据回填。

base64的代码如下

package com.smartdone;

import android.util.Log;
import dalvik.system.DexFile;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Enumeration;
import java.util.Iterator;

public class EnumerateClass {
    private static final String TAG = "FRiDA_UNPACK";

    public static ArrayList getClassNameList(ClassLoader classLoader) {
        int i;
        ArrayList classNameList = new ArrayList();
        try {
            Object dexElements = EnumerateClass.getObjectField(EnumerateClass.getObjectField(classLoader, "pathList"), "dexElements");
            int dexElementsLength = Array.getLength(dexElements);
            i = 0;
            while(true) {
            label_8:
                if(i >= dexElementsLength) {
                    goto label_24;
                }

                Enumeration enumerations = ((DexFile)EnumerateClass.getObjectField(Array.get(dexElements, i), "dexFile")).entries();
                while(true) {
                    if(!enumerations.hasMoreElements()) {
                        ++i;
                        break;
                    }

                    classNameList.add(((String)enumerations.nextElement()));
                }
            }
        }
        catch(Exception v1) {
            goto label_24;
        }

        ++i;
        goto label_8;
    label_24:
        Collections.sort(classNameList);
        return classNameList;
    }

    public static String[] getClassNameListArray(ClassLoader classLoader) {
        ArrayList namelist = EnumerateClass.getClassNameList(classLoader);
        String[] retval = new String[namelist.size()];
        namelist.toArray(((Object[])retval));
        return retval;
    }

    public static Object getObjectField(Object object, String fieldName) {
        Class clazz = object.getClass();
        while(!clazz.getName().equals(Object.class.getName())) {
            try {
                Field field = clazz.getDeclaredField(fieldName);
                field.setAccessible(true);
                return field.get(object);
            }
            catch(NoSuchFieldException e) {
                e.printStackTrace();
                clazz = clazz.getSuperclass();
            }
            catch(IllegalAccessException e2) {
                e2.printStackTrace();
            }
        }

        return null;
    }

    public static void loadAllClass(ClassLoader classLoader) {
        int v6_1;
        Method[] methods;
        Class clazz;
        try {
            Iterator v1 = EnumerateClass.getClassNameList(classLoader).iterator();
            while(true) {
                if(!v1.hasNext()) {
                    return;
                }

                Object v2 = v1.next();
                clazz = classLoader.loadClass(((String)v2));
                methods = clazz.getDeclaredMethods();
                Log.d("FRiDA_UNPACK", "load class: " + clazz.getName());
                v6_1 = 0;
            label_19:
                while(v6_1 < methods.length) {
                    goto label_20;
                }
            }

        label_20:
            Method method = methods[v6_1];
            Object[] objs = new Object[method.getParameterTypes().length];
            Log.d("FRiDA_UNPACK", "try to load method: " + clazz.getName() + "-->" + method.getName());
            method.invoke(null, objs);
            Log.d("FRiDA_UNPACK", "success");
            ++v6_1;
            goto label_19;
        }
        catch(Throwable v0) {
        }
    }
}