var prettyMethodPtr;var prettyMethod; function pretty_method(art_method) {    if (!prettyMethodPtr) {        prettyMethodPtr = Module.getExportByName("libart.so", "_ZN3art9ArtMethod12PrettyMethodEb");        prettyMethod = new NativeFunction(prettyMethodPtr, 'pointer', ['pointer', 'pointer', 'bool']);    }    var result = Memory.alloc(0x100);    prettyMethod(ptr(result), art_method, 1);    return result.add(0x8).readPointer().readCString();} var in_method = false;var target_method_name = "com.xgtl.aggregate.activities.MainActivity.a(android.view.View)"; function hookGetThisObject(base) {    var get_this_object_addr = Module.getExportByName("libart.so", "_ZNK3art11ShadowFrame13GetThisObjectEt");    Interceptor.attach(get_this_object_addr, {        onEnter: function (args) {            console.log("pid :" + Process.getCurrentThreadId() + ", lr:" + ptr(this.context.lr).sub(base).add(0xB000));            console.log(hexdump(ptr(this.context.r11), { length: 32 }));            console.log()         }, onLeave: function (retval) {         }    });} function hook() {    var libartmodule = Process.getModuleByName("libart.so");    var base = libartmodule.base;     libartmodule.enumerateSymbols().forEach(function (symbol) {        if (symbol.name.indexOf("ExecuteSwitchImpl") != -1 && symbol.name.indexOf("CodeItem") != -1) {            Interceptor.attach(symbol.address, {                onEnter: function (args) {                    var instance = ptr(0x43898C).add(base).sub(0xB000).add(0xca9f4).add(480);                    instance.writeU8(1);                    var shadow_frame = args[3];                    var art_method = ptr(shadow_frame).add(Process.pointerSize).readPointer();                    this.method_name = pretty_method(art_method);                    if (this.method_name.indexOf(target_method_name) != -1) {                        console.log("method start : >>>>>>>>>>>" + this.method_name);                        hookGetThisObject(base, this.method_name);                        in_method = true;                    }                    if (in_method) {                        console.log("method start : >>>>>>>>>>>" + this.method_name);                    }                }, onLeave: function (retval) {                    if (this.method_name.indexOf(target_method_name) != -1) {                        console.log("method end : >>>>>>>>>>>" + this.method_name);                        Interceptor.detachAll();                        in_method = false;                    }                }            });         }    });}function main() {    hook();}setImmediate(main);

[AOSP on msm8996::com.xgtl.assistant]-> method start : >>>>>>>>>>>void com.xgtl.aggregate.activities.MainActivity.a(android.view.View)method start : >>>>>>>>>>>void com.xgtl.aggregate.activities.MainActivity.a(android.view.View)pid :16444, lr:0x206a57           0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEFc4bce9f8  28 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00  (...............c4bcea08  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ pid :16444, lr:0x203a79           0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEFc4bcea2e  14 00 5f 18 00 00 71 10 4e df 00 00 28 e0 02 00  .._...q.N...(...c4bcea3e  02 00 02 00 00 00 00 00 00 00 09 00 00 00 12 01  ................ pid :16444, lr:0x203f87           0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEFc4bcea34  71 10 4e df 00 00 28 e0 02 00 02 00 02 00 00 00  q.N...(.........c4bcea44  00 00 00 00 09 00 00 00 12 01 70 20 87 ca 10 00  ..........p .... pid :16444, lr:0x206a57           0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEFc4bcea3a  28 e0 02 00 02 00 02 00 00 00 00 00 00 00 09 00  (...............c4bcea4a  00 00 12 01 70 20 87 ca 10 00 0c 01 71 20 50 ca  ....p ......q P.

method start : >>>>>>>>>>>void com.xgtl.aggregate.activities.MainActivity.a(android.view.View)lr:0x206a57 = goto 1blr:0x203a79 = const v0, 0x0000185flr:0x203f87 =  invoke-static {v0},[email protected]df4e = invoke-static {v0},Ls/h/e/l/l/H;->i(I)Vlr:0x206a57 = goto e0　lr:0x2046e7 = iget-object v0,v2,[email protected]8188 = Landroid/support/v4/media/MediaBrowserServiceCompat;->mSession:Landroid/support/v4/media/session/MediaSessionCompat$Token;lr:0x205ccf = const/4 vA, #+B = const/4 v1,#0lr:0x204c49 = invoke-virtual {v0, v1}, [email protected]61b5method start : >>>>>>>>>>>void android.support.v7.widget.AppCompatImageView.drawableStateChanged()lr:0x2064ad = invoke-super {v0}, [email protected]614clr:0x2046e7 = iget-object v0,v1,[email protected]32aelr:0x20466d = if-eqz v0,0x0005lr:0x204c49 = invoke-virtual {v0},[email protected]4b5b = void android.support.v7.widget.AppCompatBackgroundHelper.applySupportBackgroundTint()method start : >>>>>>>>>>>void android.support.v7.widget.AppCompatBackgroundHelper.applySupportBackgroundTint()lr:0x2046e7 = iget-object v0,v3,[email protected]3285lr:0x204c49 = invoke-virtual {v0},[email protected]5cd5lr:0x206c21 = move-result-object v0lr:0x20466d = if-eqz v0,0x0022lr:0x20c951 = return-voidlr:0x2046e7 = iget-object v0,v1,[email protected]32aflr:0x20466d = if-eqz v0,0x0005lr:0x204c49 = invoke-virtual {v0},[email protected]4befmethod start : >>>>>>>>>>>void android.support.v7.widget.AppCompatImageHelper.applySupportImageTint()lr:0x2046e7 = iget-object v0,v3,[email protected]32adlr:0x204c49 = invoke-virtual {v0},[email protected]6150lr:0x206c21 = move-result-object v0lr:0x20466d = if-eqz v0,0x0005lr:0x203f87 = invoke-static {v0}, [email protected]4e6emethod start : >>>>>>>>>>>void android.support.v7.widget.DrawableUtils.fixDrawable(android.graphics.drawable.Drawable)lr:0x203f09 = sget v0, [email protected]0467lr:0x204023 = const/16 v1, 0x0015lr:0x204301  = if-ne v0,v1,0x0015lr:0x20c951 = return-voidlr:0x20466d = if-eqz v0,0x0022lr:0x206729 = invoke-direct {v3}, [email protected]4bf8method start : >>>>>>>>>>>boolean android.support.v7.widget.AppCompatImageHelper.shouldApplyFrameworkTintUsingColorFilter()lr:0x203f09 = sget v0, [email protected]0467lr:0x205ccf = const/4 v1,#1lr:0x205ccf = const/4 v2,#0lr:0x204023 = const/16 v3, 0x0015lr:0x204b7b = if-le v0,v3,0x0009lr:0x2046e7 = iget-object v0,v4,[email protected]32ablr:0x20466d = if-eqz v0,0x0003lr:0x205ccf = const/4 v1,#0lr:0x20c9f1 = return v1lr:0x2051d5 = move-result v1lr:0x20466d = if-eqz v1,0x0009lr:0x2046e7 = iget-object v1,v3,[email protected]32aalr:0x20466d = if-eqz v1,0x000clr:0x2046e7 = iget-object v1,v3,[email protected]32ablr:0x20466d = if-eqz v1,0x0003lr:0x20c951 = return-voidlr:0x20c951 = return-voidmethod start : >>>>>>>>>>>void android.support.v7.widget.AppCompatTextHelperV17.applyCompoundDrawablesTints()lr:0x2064ad = invoke-super {v3},[email protected]4cbbmethod start : >>>>>>>>>>>void android.support.v7.widget.AppCompatTextHelper.applyCompoundDrawablesTints()lr:0x2046e7 = iget-object v0,v3,[email protected]32e5lr:0x206943 = if-nez v0,+0x000elr:0x2046e7 = iget-object v0,v3,[email protected]32e7lr:0x206943 = if-nez v0,+0x000alr:0x2046e7 = iget-object v0,v3,[email protected]32e6lr:0x206943 = if-nez v0,+0x0006lr:0x2046e7 = iget-object v0,v3,[email protected]32e4lr:0x20466d = if-eqz v0,0x0028lr:0x20c951 = return-voidlr:0x2046e7 = iget-object v0,v3,[email protected]32eclr:0x206943 = if-nez v0,+0x0006lr:0x2046e7 = iget-object v0,v3,[email protected]32eblr:0x20466d = if-eqz v0,0x0018lr:0x20c951 = return-voidlr:0x2046e7 = iget-object v0,v2,[email protected]818alr:0x204c49 = invoke-virtual {v0,v1},[email protected]61b5lr:0x2046e7 = iget-object v0,v2,[email protected]818blr:0x204c49 = invoke-virtual {v0,v1},[email protected]61b5lr:0x2046e7 = iget-object v0,v2,[email protected]8189lr:0x204c49 = invoke-virtual {v0,v1},[email protected]61b5lr:0x205ccf = const/4 v0,#1lr:0x204c49 = invoke-virtual {v3,v0},[email protected]5dabmethod start : >>>>>>>>>>>void android.support.v7.widget.AppCompatImageView.drawableStateChanged()lr:0x2064ad = invoke-super {v1},[email protected]614clr:0x2046e7 = iget-object v0,v1,[email protected]32aelr:0x20466d = if-eqz v0,+0x0005lr:0x204c49 = invoke-virtual {v0},[email protected]4b5b = void android.support.v7.widget.AppCompatBackgroundHelper.applySupportBackgroundTint()lr:0x2046e7 = iget-object v0,v1,[email protected]32aflr:0x20466d = if-eqz v0,+0x0005lr:0x204c49 = invoke-virtual {v0},[email protected]4befmethod start : >>>>>>>>>>>void android.support.v7.widget.AppCompatImageHelper.applySupportImageTint()lr:0x2046e7 = iget-object v0,v3,[email protected]32adlr:0x204c49 = invoke-virtual {v0},[email protected]6150lr:0x206c21 = move-result-object v0lr:0x20466d = if-eqz v0,0x0005lr:0x203f87 = invoke-static {v0}, [email protected]4e6emethod start : >>>>>>>>>>>void android.support.v7.widget.DrawableUtils.fixDrawable(android.graphics.drawable.Drawable)lr:0x203f09 = sget v0, [email protected]0467lr:0x204023 = const/16 v1, 0x0015lr:0x204301 = if-ne v0,v1,0x0015lr:0x20c951 = return-voidlr:0x20466d = if-eqz v0,0x0022lr:0x206729 = invoke-direct {v3}, [email protected]4bf8method start : >>>>>>>>>>>boolean android.support.v7.widget.AppCompatImageHelper.shouldApplyFrameworkTintUsingColorFilter()lr:0x203f09 = sget v0, [email protected]0467lr:0x205ccf = const/4 v1,#1lr:0x205ccf = const/4 v2,#0lr:0x204023 = const/16 v3, 0x0015lr:0x204b7b = if-le v0,v3,0x0009lr:0x2046e7 = iget-object v0,v4,[email protected]32ablr:0x20466d = if-eqz v0,0x0003lr:0x205ccf = const/4 v1,#0lr:0x20c9f1 = return v1lr:0x2051d5 = move-result v1lr:0x20466d = if-eqz v1,0x0009lr:0x2046e7 = iget-object v1,v3,[email protected]32aalr:0x20466d = if-eqz v1,0x000clr:0x2046e7 = iget-object v1,v3,[email protected]32ablr:0x20466d = if-eqz v1,0x0003lr:0x20c951 = return-voidlr:0x20c951 = return-voidmethod start : >>>>>>>>>>>void android.support.v7.widget.AppCompatTextHelperV17.applyCompoundDrawablesTints()lr:0x2064ad = invoke-super {v3},[email protected]4cbbmethod start : >>>>>>>>>>>void android.support.v7.widget.AppCompatTextHelper.applyCompoundDrawablesTints()lr:0x2046e7 = iget-object v0,v3,[email protected]32e5lr:0x206943 = if-nez v0,+0x000elr:0x2046e7 = iget-object v0,v3,[email protected]32e7lr:0x206943 = if-nez v0,+0x000alr:0x2046e7 = iget-object v0,v3,[email protected]32e6lr:0x206943 = if-nez v0,+0x0006lr:0x2046e7 = iget-object v0,v3,[email protected]32e4lr:0x20466d = if-eqz v0,0x0028lr:0x20c951 = return-voidlr:0x2046e7 = iget-object v0,v3,[email protected]32eclr:0x206943 = if-nez v0,+0x0006lr:0x2046e7 = iget-object v0,v3,[email protected]32eblr:0x20466d = if-eqz v0,0x0018lr:0x20c951 = return-voidlr:0x20c951 = return-voidmethod end : >>>>>>>>>>>void com.xgtl.aggregate.activities.MainActivity.a(android.view.View)

# 往期推荐

1.AFL速通——流程及afl-fuzz.c源码简析

2.Android题目分析部分思路总结

3.sql注入学习笔记

4.文件上传和文件包含的各种姿势

5.《安卓高级研修班》推出【看雪安卓应用安全能力认证】证书

6.React Native Hermes 逆向实践