unidbg-fork及管道读写

红太狼 2023-09-26 16:44 4阅读 0赞

fork子进程直接执行子进程函数；  
管道读写采用了输入输出形式；  
实战(六)

package com.dta.lesson31;
    
    import com.github.unidbg.AndroidEmulator;
    import com.github.unidbg.Module;
    import com.github.unidbg.linux.AndroidElfLoader;
    import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
    import com.github.unidbg.linux.android.AndroidResolver;
    import com.github.unidbg.linux.android.dvm.*;
    import com.github.unidbg.memory.Memory;
    import com.github.unidbg.memory.MemoryBlock;
    import com.github.unidbg.pointer.UnidbgPointer;
    import org.apache.log4j.Level;
    import org.apache.log4j.Logger;
    
    import java.io.File;
    import java.nio.charset.StandardCharsets;
    import java.util.ArrayList;
    import java.util.List;
    
    
    public class MainActivity2 extends AbstractJni {
        
        private final AndroidEmulator emulator;
        private final VM vm;
        private final Memory memory;
        private final Module module;
    
        public MainActivity2(){
        
            emulator = AndroidEmulatorBuilder
                    .for32Bit()
                    //.setRootDir(new File("target/rootfs/default"))
                    //.addBackendFactory(new DynarmicFactory(true))
                    .build();
    
            memory = emulator.getMemory();
            memory.setLibraryResolver(new AndroidResolver(23));
    
            vm = emulator.createDalvikVM();
            vm.setVerbose(true);
            vm.setJni(this);
    
            DalvikModule dalvikModule = vm.loadLibrary(new File("unidbg-android/src/test/java/com/dta/lesson31/libcheck.so"), false);
            module = dalvikModule.getModule();
    
            vm.callJNI_OnLoad(emulator,module);
        }
    
        static {
        
            Logger.getLogger(AndroidElfLoader.class).setLevel(Level.INFO);
        }
    
    
        public static void main(String[] args) {
        
            long start = System.currentTimeMillis();
            MainActivity2 mainActivity = new MainActivity2();
            System.out.println("load the vm "+( System.currentTimeMillis() - start )+ "ms");
            mainActivity.sub_85E0();
        }
    
        private void sub_85E0() {
        
            //emulator.traceCode();
            List<Object> args = new ArrayList<>();
            UnidbgPointer ptr_arg0 = UnidbgPointer.pointer(emulator, module.base + 0xF1B0);
            args.add(ptr_arg0.toIntPeer());
            args.add(622);
    
            MemoryBlock malloc = memory.malloc(32, true);
            UnidbgPointer ptr_md5 = malloc.getPointer();
            String md5 = "f8c49056e4ccf9a11e090eaf471f418d";
            ptr_md5.write(md5.getBytes(StandardCharsets.UTF_8));
            args.add(ptr_md5.toIntPeer());
    
            Number[] numbers = module.callFunction(emulator, 0x85E1, args.toArray());
            System.out.println("result => " + numbers[0].longValue());
    
            sub_shellCode(numbers[0].longValue());
        }
    
        private void sub_shellCode(long addr) {
        
            List<Object> args = new ArrayList<>();
    
            String input = "qqqqqqq";
            MemoryBlock malloc = memory.malloc(input.length(), true);
            UnidbgPointer ptr_input = malloc.getPointer();
    
            UnidbgPointer ptr_v9 = memory.allocateStack(8);
            ptr_v9.setPointer(0,ptr_input);
    
    
            UnidbgPointer ptr_pipe = memory.allocateStack(8);
            ptr_pipe.setInt(0,0);
            ptr_pipe.setInt(4,1);
    
            ptr_v9.setPointer(4,ptr_pipe);
    
            args.add(ptr_v9.toIntPeer());
            Number[] numbers = module.callFunction(emulator, addr - module.base + 1, args.toArray());
            System.out.println("shellcode result => " + numbers[0].longValue());
        }
    
        @Override
        public DvmObject<?> callStaticObjectMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
        
            if(signature.equals("com/a/sample/loopcrypto/Decode->a([BI)Ljava/lang/String;")){
        
                byte[] bytes = (byte[]) varArg.getObjectArg(0).getValue();
                int i = varArg.getIntArg(1);
                String a = Encrypt.a(bytes, i);
                return new StringObject(vm, a);
            }
            return super.callStaticObjectMethod(vm, dvmClass, signature, varArg);
        }
    }