文章目录
- 一、InMemoryDexClassLoader 类加载器脱壳点总结
- 1、dalvik_system_DexFile.cc#CreateSingleDexFileCookie
- 2、dalvik_system_DexFile.cc#CreateDexFile
- 3、dex_file.cc#DexFile::Open
- 4、dex_file.cc#DexFile::OpenCommon
- 5、dex_file.cc#DexFile::DexFile
一、InMemoryDexClassLoader 类加载器脱壳点总结
InMemoryDexClassLoader 类加载器脱壳点总结 : 在下面列举出的函数中 , 都可以获取到内存中 DEX 文件的起始地址 , 可以将 DEX 文件从内存中 dump 下来 ;
1、dalvik_system_DexFile.cc#CreateSingleDexFileCookie
代码语言：javascript复制static jobject CreateSingleDexFileCookie(JNIEnv* env, std::unique_ptr<MemMap> data) {
std::unique_ptr<const DexFile> dex_file(CreateDexFile(env, std::move(data)));
if (dex_file.get() == nullptr) {
DCHECK(env->ExceptionCheck());
return nullptr;
}
std::vector<std::unique_ptr<const DexFile>> dex_files;
dex_files.push_back(std::move(dex_file));
return ConvertDexFilesToJavaArray(env, nullptr, dex_files);
}源码地址 : /art/runtime/native/dalvik_system_DexFile.cc#CreateSingleDexFileCookie
2、dalvik_system_DexFile.cc#CreateDexFile
代码语言：javascript复制static const DexFile* CreateDexFile(JNIEnv* env, std::unique_ptr<MemMap> dex_mem_map) {
std::string location = StringPrintf("Anonymous-DexFile@%p-%p",
dex_mem_map->Begin(),
dex_mem_map->End());
std::string error_message;
std::unique_ptr<const DexFile> dex_file(DexFile::Open(location,
0,
std::move(dex_mem_map),
/* verify */ true,
/* verify_location */ true,
&error_message));
if (dex_file == nullptr) {
ScopedObjectAccess soa(env);
ThrowWrappedIOException("%s", error_message.c_str());
return nullptr;
}
if (!dex_file->DisableWrite()) {
ScopedObjectAccess soa(env);
ThrowWrappedIOException("Failed to make dex file read-only");
return nullptr;
}
return dex_file.release();
}源码地址 : /art/runtime/native/dalvik_system_DexFile.cc#CreateDexFile
3、dex_file.cc#DexFile::Open
代码语言：javascript复制std::unique_ptr<const DexFile> DexFile::Open(const std::string& location,
uint32_t location_checksum,
std::unique_ptr<MemMap> map,
bool verify,
bool verify_checksum,
std::string* error_msg) {
ScopedTrace trace(std::string("Open dex file from mapped-memory ") location);
CHECK(map.get() != nullptr);
if (map->Size() < sizeof(DexFile::Header)) {
*error_msg = StringPrintf(
"DexFile: failed to open dex file '%s' that is too short to have a header",
location.c_str());
return nullptr;
}
std::unique_ptr<DexFile> dex_file = OpenCommon(map->Begin(),
map->Size(),
location,
location_checksum,
kNoOatDexFile,
verify,
verify_checksum,
error_msg);
if (dex_file != nullptr) {
dex_file->mem_map_.reset(map.release());
}
return dex_file;
}源码路径 : /art/runtime/dex_file.cc#182
4、dex_file.cc#DexFile::OpenCommon
代码语言：javascript复制std::unique_ptr<DexFile> DexFile::OpenCommon(const uint8_t* base,
size_t size,
const std::string& location,
uint32_t location_checksum,
const OatDexFile* oat_dex_file,
bool verify,
bool verify_checksum,
std::string* error_msg,
VerifyResult* verify_result) {
if (verify_result != nullptr) {
*verify_result = VerifyResult::kVerifyNotAttempted;
}
std::unique_ptr<DexFile> dex_file(new DexFile(base,
size,
location,
location_checksum,
oat_dex_file));
if (dex_file == nullptr) {
*error_msg = StringPrintf("Failed to open dex file '%s' from memory: %s", location.c_str(),
error_msg->c_str());
return nullptr;
}
if (!dex_file->Init(error_msg)) {
dex_file.reset();
return nullptr;
}
if (verify && !DexFileVerifier::Verify(dex_file.get(),
dex_file->Begin(),
dex_file->Size(),
location.c_str(),
verify_checksum,
error_msg)) {
if (verify_result != nullptr) {
*verify_result = VerifyResult::kVerifyFailed;
}
return nullptr;
}
if (verify_result != nullptr) {
*verify_result = VerifyResult::kVerifySucceeded;
}
return dex_file;
}源码地址 : /art/runtime/dex_file.cc#OpenCommon
5、dex_file.cc#DexFile::DexFile
代码语言：javascript复制DexFile::DexFile(const uint8_t* base,
size_t size,
const std::string& location,
uint32_t location_checksum,
const OatDexFile* oat_dex_file)
: begin_(base),
size_(size),
location_(location),
location_checksum_(location_checksum),
header_(reinterpret_cast<const Header*>(base)),
string_ids_(reinterpret_cast<const StringId*>(base header_->string_ids_off_)),
type_ids_(reinterpret_cast<const TypeId*>(base header_->type_ids_off_)),
field_ids_(reinterpret_cast<const FieldId*>(base header_->field_ids_off_)),
method_ids_(reinterpret_cast<const MethodId*>(base header_->method_ids_off_)),
proto_ids_(reinterpret_cast<const ProtoId*>(base header_->proto_ids_off_)),
class_defs_(reinterpret_cast<const ClassDef*>(base header_->class_defs_off_)),
method_handles_(nullptr),
num_method_handles_(0),
call_site_ids_(nullptr),
num_call_site_ids_(0),
oat_dex_file_(oat_dex_file) {
CHECK(begin_ != nullptr) << GetLocation();
CHECK_GT(size_, 0U) << GetLocation();
// Check base (=header) alignment.
// Must be 4-byte aligned to avoid undefined behavior when accessing
// any of the sections via a pointer.
CHECK_ALIGNED(begin_, alignof(Header));
InitializeSectionsFromMapList();
}源码地址 : /art/runtime/dex_file.cc#DexFile
