CalebFenton / simplify

Android virtual machine and deobfuscator
Other
4.41k stars 438 forks source link

Using Smali Debugger on single smali file #136

Closed cryptax closed 4 years ago

cryptax commented 4 years ago

I have a very simply Smali file on which I would like to test the Smali debugger, but I haven't been able to find the right syntax. None of the following work:

java -jar ~/softs/simplify/sdbg/build/libs/sdbg.jar mysmali "Lunused;->main([Ljava/lang/String;)V"
java -jar ~/softs/simplify/sdbg/build/libs/sdbg.jar unused "Lunused;->main([Ljava/lang/String;)V"
java -jar ~/softs/simplify/sdbg/build/libs/sdbg.jar unused.zip "Lunused;->main([Ljava/lang/String;)V"
java -jar ~/softs/simplify/sdbg/build/libs/sdbg.jar unused.zip "Lunused/main([Ljava/lang/String;)V"
java -jar ~/softs/simplify/sdbg/build/libs/sdbg.jar classes.dex "Lunused;->main([Ljava/lang/String;)V"

This is my Smali file:

.class public Lunused;
.super Ljava/lang/Object;

.method public static test()Z
    .registers 2

    const/4 v0, 0x0

    const-string v1, "This string is hidden to decompiler"

    const/4 v0, 0x1

    return v0

.end method

.method public static main([Ljava/lang/String;)V
    .registers 2

    invoke-static {}, Lunused;->test()Z

    move-result v0

    if-eqz v0, :cond_2

    sget-object v0, Ljava/lang/System;->out:Ljava/io/PrintStream;

        const-string v1, "Called test() which contains a hidden constant string"

    invoke-virtual {v0, v1}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V

    :cond_2

    return-void

.end method

I compile this as classes.dex using smali. Then, I create a zip containing classes.dex Basically this is my Makefile:

all: unused.zip
    adb push $< /sdcard/$<
    adb shell dalvikvm -cp /sdcard/$< $(basename $<)
    cp classes.dex /tmp/jeb2-share

%.zip: classes.dex
    zip $@ $<

classes.dex: unused.smali
    java -jar $(SMALI) a $< -o $@

%.dex: %.class
    $(DX) --dex --output $@ $<

%.smali: %.dex
    java -jar $(BAKSMALI) $@ -o $<

There is probably no bug in your smali debugger, most probably it's just that I am not calling it the right way.

apkunpacker commented 4 years ago

hy @cryptax can you upload sdbg.jar here or on any 3rd party file host ? Thanks

cryptax commented 4 years ago

@apkunpacker it is better that you compile it for your own system. See https://github.com/CalebFenton/simplify/tree/master/sdbg. It uses gradle. It compiled straight out of the box in my case.

Karim0x1 commented 4 years ago

Hello, As stated in the building section, Simplify contains submodules. You need to download the project through this command git clone --recursive https://github.com/CalebFenton/simplify.git then you can build sdbg with this one ./gradlew :sdbg:fatjar.

CalebFenton commented 4 years ago

Thanks for being the first person to create an sdbg issue :D

I just confirmed it works with smali files, a dex, and a zip with a dex called classes.dex.

Screen Shot 2020-02-07 at 8 40 07 PM

What output are you getting when you try and run it? How big is sdbg.jar? It should be ~75mb.

cryptax commented 4 years ago

My sdbg.jar is "only" 25M (pretty big, but far less than the expected 75M).

When I try your command, I get:

$ java -jar ~/softs/simplify/sdbg/build/libs/sdbg.jar unused "Lunused;->main([Ljava/lang/String;)V"
Starting debugger for Lunused;->main([Ljava/lang/String;)V from unused
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.rits.cloning.Cloner (file:/home/axelle/softs/simplify/sdbg/build/libs/sdbg-0.1.0.jar) to field java.util.TreeSet.m
WARNING: Please consider reporting this to the maintainers of com.rits.cloning.Cloner
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
java.lang.RuntimeException: Error loading class definition: Landroid/icu/text/MessagePatternUtil;
    at org.cf.smalivm.type.ClassManager.parseClass(ClassManager.java:187)
    at org.cf.smalivm.type.ClassManager.parseClassIfNecessary(ClassManager.java:205)
    at org.cf.smalivm.type.ClassManager.getVirtualType(ClassManager.java:137)
    at org.cf.smalivm.type.ClassManager.getVirtualType(ClassManager.java:158)
    at org.cf.smalivm.type.ClassManager.getVirtualClass(ClassManager.java:130)
    at org.cf.smalivm.dex.SmaliClassLoader.findClass(SmaliClassLoader.java:109)
    at org.cf.smalivm.dex.SmaliClassLoader.loadClass(SmaliClassLoader.java:71)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
    at org.cf.smalivm.context.ClonerFactory.build(ClonerFactory.java:57)
    at org.cf.smalivm.context.ExecutionContext.<init>(ExecutionContext.java:39)
    at org.cf.smalivm.VirtualMachine.spawnRootContext(VirtualMachine.java:165)
    at org.cf.smalivm.VirtualMachine.spawnRootContext(VirtualMachine.java:156)
    at org.cf.smalivm.MethodExecutorFactory.build(MethodExecutorFactory.java:46)
    at org.cf.smalivm.debug.Debugger.<init>(Debugger.java:46)
    at org.cf.smalivm.debug.Debugger.<init>(Debugger.java:30)
    at org.cf.sdbg.Initialize.call(Initialize.kt:38)
    at org.cf.sdbg.Initialize.call(Initialize.kt:13)
    at picocli.CommandLine.executeUserObject(CommandLine.java:1783)
    at picocli.CommandLine.access$900(CommandLine.java:145)
    at picocli.CommandLine$RunLast.handle(CommandLine.java:2141)
    at picocli.CommandLine$RunLast.handle(CommandLine.java:2108)
    at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:1975)
    at picocli.CommandLine.execute(CommandLine.java:1904)
    at org.cf.sdbg.Main.main(Main.kt:94)
Caused by: java.lang.NullPointerException
    at java.base/java.io.Reader.<init>(Reader.java:167)
    at java.base/java.io.InputStreamReader.<init>(InputStreamReader.java:113)
    at org.cf.smalivm.dex.SmaliParser.parse(SmaliParser.java:61)
    at org.cf.smalivm.type.ClassManager.parseClass(ClassManager.java:184)
    ... 23 more
(sdbg) quit

This is with OpenJDK 11.0.6

CalebFenton commented 4 years ago

I'm pretty sure the problem is that simplify wasn't cloned recursively. Those classes are part of the smali framework and that's a submodule within simplify (because it's so big)

On Mon, Feb 10, 2020, 10:40 AM cryptax notifications@github.com wrote:

My sdbg.jar is "only" 25M (pretty big, but far less than the expected 75M).

When I try your command, I get:

$ java -jar ~/softs/simplify/sdbg/build/libs/sdbg.jar unused "Lunused;->main([Ljava/lang/String;)V" Starting debugger for Lunused;->main([Ljava/lang/String;)V from unused WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.rits.cloning.Cloner (file:/home/axelle/softs/simplify/sdbg/build/libs/sdbg-0.1.0.jar) to field java.util.TreeSet.m WARNING: Please consider reporting this to the maintainers of com.rits.cloning.Cloner WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release java.lang.RuntimeException: Error loading class definition: Landroid/icu/text/MessagePatternUtil; at org.cf.smalivm.type.ClassManager.parseClass(ClassManager.java:187) at org.cf.smalivm.type.ClassManager.parseClassIfNecessary(ClassManager.java:205) at org.cf.smalivm.type.ClassManager.getVirtualType(ClassManager.java:137) at org.cf.smalivm.type.ClassManager.getVirtualType(ClassManager.java:158) at org.cf.smalivm.type.ClassManager.getVirtualClass(ClassManager.java:130) at org.cf.smalivm.dex.SmaliClassLoader.findClass(SmaliClassLoader.java:109) at org.cf.smalivm.dex.SmaliClassLoader.loadClass(SmaliClassLoader.java:71) at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521) at org.cf.smalivm.context.ClonerFactory.build(ClonerFactory.java:57) at org.cf.smalivm.context.ExecutionContext.(ExecutionContext.java:39) at org.cf.smalivm.VirtualMachine.spawnRootContext(VirtualMachine.java:165) at org.cf.smalivm.VirtualMachine.spawnRootContext(VirtualMachine.java:156) at org.cf.smalivm.MethodExecutorFactory.build(MethodExecutorFactory.java:46) at org.cf.smalivm.debug.Debugger.(Debugger.java:46) at org.cf.smalivm.debug.Debugger.(Debugger.java:30) at org.cf.sdbg.Initialize.call(Initialize.kt:38) at org.cf.sdbg.Initialize.call(Initialize.kt:13) at picocli.CommandLine.executeUserObject(CommandLine.java:1783) at picocli.CommandLine.access$900(CommandLine.java:145) at picocli.CommandLine$RunLast.handle(CommandLine.java:2141) at picocli.CommandLine$RunLast.handle(CommandLine.java:2108) at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:1975) at picocli.CommandLine.execute(CommandLine.java:1904) at org.cf.sdbg.Main.main(Main.kt:94) Caused by: java.lang.NullPointerException at java.base/java.io.Reader.(Reader.java:167) at java.base/java.io.InputStreamReader.(InputStreamReader.java:113) at org.cf.smalivm.dex.SmaliParser.parse(SmaliParser.java:61) at org.cf.smalivm.type.ClassManager.parseClass(ClassManager.java:184) ... 23 more (sdbg) quit

This is with OpenJDK 11.0.6

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/CalebFenton/simplify/issues/136?email_source=notifications&email_token=AAKLG4UCCTOKLZ7Q6WEH3CLRCEHHFA5CNFSM4KRPGD72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELHVJVQ#issuecomment-584013014, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAKLG4UZC25PRTX6LUNR63LRCEHHFANCNFSM4KRPGD7Q .

cryptax commented 4 years ago

@CalebFenton yes, you are right. I had cloned simplify a long time ago, and probably not recursively... Tried again, and it works no problem :-)

(And sdbg is 75M).

CalebFenton commented 4 years ago

Almost all issues take this form. I should really check this and warn during the build process. It's an easy mistake to make.

On Mon, Feb 10, 2020, 11:24 AM cryptax notifications@github.com wrote:

@CalebFenton https://github.com/CalebFenton yes, you are right. I had cloned simplify a long time ago, and probably not recursively... Tried again, and it works no problem :-)

(And sdbg is 75M).

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/CalebFenton/simplify/issues/136?email_source=notifications&email_token=AAKLG4W6BMK4RES6FQ25NJ3RCEMLXA5CNFSM4KRPGD72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELHZKGY#issuecomment-584029467, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAKLG4WJXI7FZO2ZHOLZEMTRCEMLXANCNFSM4KRPGD7Q .