zhkl0228 / unidbg

Allows you to emulate an Android native library, and an experimental iOS emulation
Apache License 2.0
3.77k stars 953 forks source link

大佬帮忙看看,这个环境怎么补, jadx逆向看到是需要返回Field, android.os.ServiceManager 获取sCache,但是环境不知道怎么补 #452

Open wengxianxun opened 2 years ago

wengxianxun commented 2 years ago

链接: https://pan.baidu.com/s/1FH5V6_pK14aBa8HZuSMa8A?pwd=u0kr 提取码: u0kr

错误如下 call JNIOnLoad JNIEnv->FindClass(com/xingin/tiny/internal/t) was called from RX@0x400626c8[libtiny.so]0x626c8 JNIEnv->NewGlobalRef(class com/xingin/tiny/internal/t) was called from RX@0x40062714[libtiny.so]0x62714 JNIEnv->RegisterNatives(com/xingin/tiny/internal/t, unidbg@0xbffff570, 1) was called from RX@0x4000e264[libtiny.so]0xe264 RegisterNative(com/xingin/tiny/internal/t, a(I[Ljava/lang/Object;)Ljava/lang/Object;, RX@0x4000eed0[libtiny.so]0xeed0) JNIEnv->FindClass(com/xingin/tiny/internal/t) was called from RX@0x40062fd0[libtiny.so]0x62fd0 JNIEnv->NewGlobalRef(class com/xingin/tiny/internal/t) was called from RX@0x40062fe8[libtiny.so]0x62fe8 JNIEnv->GetStaticMethodID(com/xingin/tiny/internal/t.b(I[Ljava/lang/Object;)Ljava/lang/Object;) => 0x6af41461 was called from RX@0x40063034[libtiny.so]0x63034 JNIEnv->FindClass(android/content/Intent) was called from RX@0x4000d01c[libtiny.so]0xd01c JNIEnv->NewGlobalRef(class android/content/Intent) was called from RX@0x4000d034[libtiny.so]0xd034 JNIEnv->GetMethodID(android/content/Intent.(Ljava/lang/String;)V) => 0xc14c8f0a was called from RX@0x4000d060[libtiny.so]0xd060 JNIEnv->GetMethodID(android/content/Intent.getIntExtra(Ljava/lang/String;I)I) => 0xddd1beeb was called from RX@0x4000d08c[libtiny.so]0xd08c JNIEnv->GetMethodID(android/content/Intent.getBooleanExtra(Ljava/lang/String;Z)Z) => 0xd9395d74 was called from RX@0x4000d0b8[libtiny.so]0xd0b8 JNIEnv->GetMethodID(android/content/Intent.addCategory(Ljava/lang/String;)Landroid/content/Intent;) => 0xffb4b930 was called from RX@0x4000d0e4[libtiny.so]0xd0e4 JNIEnv->FindClass(android/content/Context) was called from RX@0x4000d11c[libtiny.so]0xd11c JNIEnv->NewGlobalRef(class android/content/Context) was called from RX@0x4000d134[libtiny.so]0xd134 JNIEnv->GetMethodID(android/content/Context.getPackageManager()Landroid/content/pm/PackageManager;) => 0x3acc78f0 was called from RX@0x4000d160[libtiny.so]0xd160 JNIEnv->GetMethodID(android/content/Context.getContentResolver()Landroid/content/ContentResolver;) => 0x3fe770ea was called from RX@0x4000d18c[libtiny.so]0xd18c JNIEnv->GetMethodID(android/content/Context.getSystemService(Ljava/lang/String;)Ljava/lang/Object;) => 0x545bcf2d was called from RX@0x4000d1b8[libtiny.so]0xd1b8 JNIEnv->GetMethodID(android/content/Context.getSharedPreferences(Ljava/lang/String;I)Landroid/content/SharedPreferences;) => 0xa0a12d1f was called from RX@0x4000d1e4[libtiny.so]0xd1e4 JNIEnv->GetMethodID(android/content/Context.checkPermission(Ljava/lang/String;II)I) => 0x9daa2205 was called from RX@0x4000d210[libtiny.so]0xd210 JNIEnv->FindClass(java/lang/Class) was called from RX@0x4000d248[libtiny.so]0xd248 JNIEnv->NewGlobalRef(class java/lang/Class) was called from RX@0x4000d260[libtiny.so]0xd260 JNIEnv->GetMethodID(java/lang/Class.getName()Ljava/lang/String;) => 0x4a974877 was called from RX@0x4000d28c[libtiny.so]0xd28c JNIEnv->FindClass(java/lang/Object) was called from RX@0x4000d2c4[libtiny.so]0xd2c4 JNIEnv->NewGlobalRef(class java/lang/Object) was called from RX@0x4000d2dc[libtiny.so]0xd2dc JNIEnv->FindClass(java/util/Collection) was called from RX@0x4000dd2c[libtiny.so]0xdd2c JNIEnv->GetMethodID(java/util/Collection.iterator()Ljava/util/Iterator;) => 0xecb22abf was called from RX@0x4000dd50[libtiny.so]0xdd50 JNIEnv->FindClass(java/util/Iterator) was called from RX@0x4000dd74[libtiny.so]0xdd74 JNIEnv->GetMethodID(java/util/Iterator.hasNext()Z) => 0x74f5adeb was called from RX@0x4000dd9c[libtiny.so]0xdd9c JNIEnv->GetMethodID(java/util/Iterator.next()Ljava/lang/Object;) => 0xc9be0fcf was called from RX@0x4000ddc8[libtiny.so]0xddc8 JNIEnv->FindClass(java/util/Map) was called from RX@0x4000de00[libtiny.so]0xde00 JNIEnv->NewGlobalRef(class java/util/Map) was called from RX@0x4000de18[libtiny.so]0xde18 JNIEnv->GetMethodID(java/util/Map.size()I) => 0x95e5057a was called from RX@0x4000de44[libtiny.so]0xde44 JNIEnv->GetMethodID(java/util/Map.get(Ljava/lang/Object;)Ljava/lang/Object;) => 0x7f03ab0a was called from RX@0x4000de74[libtiny.so]0xde74 JNIEnv->GetMethodID(java/util/Map.put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;) => 0x6fb34d67 was called from RX@0x4000dea0[libtiny.so]0xdea0 JNIEnv->GetMethodID(java/util/Map.remove(Ljava/lang/Object;)Ljava/lang/Object;) => 0xc7b2e6f2 was called from RX@0x4000dec8[libtiny.so]0xdec8 JNIEnv->GetMethodID(java/util/Map.keySet()Ljava/util/Set;) => 0x24c91734 was called from RX@0x4000def4[libtiny.so]0xdef4 JNIEnv->GetMethodID(java/util/Map.values()Ljava/util/Collection;) => 0x36e11481 was called from RX@0x4000df20[libtiny.so]0xdf20 JNIEnv->FindClass(java/util/HashMap) was called from RX@0x4000df58[libtiny.so]0xdf58 JNIEnv->NewGlobalRef(class java/util/HashMap) was called from RX@0x4000df70[libtiny.so]0xdf70 JNIEnv->GetMethodID(java/util/HashMap.()V) => 0xa7b3cd64 was called from RX@0x4000df9c[libtiny.so]0xdf9c JNIEnv->FindClass(android/content/pm/PackageInfo) was called from RX@0x4000dfd4[libtiny.so]0xdfd4 JNIEnv->NewGlobalRef(class android/content/pm/PackageInfo) was called from RX@0x4000dfec[libtiny.so]0xdfec JNIEnv->GetFieldID(android/content/pm/PackageInfo.packageName Ljava/lang/String;) => 0x20518ffc was called from RX@0x4000e01c[libtiny.so]0xe01c JNIEnv->GetFieldID(android/content/pm/PackageInfo.versionName Ljava/lang/String;) => 0xbcc0232a was called from RX@0x4000e044[libtiny.so]0xe044 JNIEnv->GetFieldID(android/content/pm/PackageInfo.firstInstallTime J) => 0x215b0bd1 was called from RX@0x4000e074[libtiny.so]0xe074 JNIEnv->GetFieldID(android/content/pm/PackageInfo.lastUpdateTime J) => 0xb7c07d45 was called from RX@0x4000e09c[libtiny.so]0xe09c JNIEnv->GetFieldID(android/content/pm/PackageInfo.versionCode I) => 0x41c3e70b was called from RX@0x4000e0c8[libtiny.so]0xe0c8 JNIEnv->GetFieldID(android/content/pm/PackageInfo.applicationInfo Landroid/content/pm/ApplicationInfo;) => 0xb287dbb2 was called from RX@0x4000e0f4[libtiny.so]0xe0f4 JNIEnv->FindClass(android/content/pm/PackageManager) was called from RX@0x4000e2bc[libtiny.so]0xe2bc JNIEnv->GetMethodID(android/content/pm/PackageManager.getPackageInfo(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;) => 0x3bca8377 was called from RX@0x4000e2e4[libtiny.so]0xe2e4 JNIEnv->GetMethodID(android/content/pm/PackageManager.queryIntentActivities(Landroid/content/Intent;I)Ljava/util/List;) => 0x4d4c5819 was called from RX@0x4000e310[libtiny.so]0xe310 JNIEnv->GetMethodID(android/content/pm/PackageManager.getInstallerPackageName(Ljava/lang/String;)Ljava/lang/String;) => 0xed3a354c was called from RX@0x4000e33c[libtiny.so]0xe33c JNIEnv->FindClass(android/content/pm/ApplicationInfo) was called from RX@0x400626c8[libtiny.so]0x626c8 JNIEnv->NewGlobalRef(class android/content/pm/ApplicationInfo) was called from RX@0x40062714[libtiny.so]0x62714 JNIEnv->NewGlobalRef(class android/content/pm/ApplicationInfo) was called from RX@0x40064988[libtiny.so]0x64988 JNIEnv->GetFieldID(android/content/pm/ApplicationInfo.targetSdkVersion I) => 0x74a55c91 was called from RX@0x400649b4[libtiny.so]0x649b4 JNIEnv->GetFieldID(android/content/pm/ApplicationInfo.sourceDir Ljava/lang/String;) => 0x304a6a5 was called from RX@0x400649e4[libtiny.so]0x649e4 JNIEnv->GetFieldID(android/content/pm/ApplicationInfo.dataDir Ljava/lang/String;) => 0xef83d1b4 was called from RX@0x40064a0c[libtiny.so]0x64a0c JNIEnv->GetMethodID(android/content/pm/ApplicationInfo.loadLabel(Landroid/content/pm/PackageManager;)Ljava/lang/CharSequence;) => 0xe6b638b6 was called from RX@0x40064a38[libtiny.so]0x64a38 JNIEnv->FindClass(android/provider/Settings$Global) was called from RX@0x4000e37c[libtiny.so]0xe37c JNIEnv->NewGlobalRef(class android/provider/Settings$Global) was called from RX@0x4000e394[libtiny.so]0xe394 JNIEnv->GetStaticMethodID(android/provider/Settings$Global.getString(Landroid/content/ContentResolver;Ljava/lang/String;)Ljava/lang/String;) => 0x11d9f943 was called from RX@0x4000e3cc[libtiny.so]0xe3cc JNIEnv->GetStaticMethodID(android/provider/Settings$Global.getInt(Landroid/content/ContentResolver;Ljava/lang/String;)I) => 0x49fead70 was called from RX@0x4000e404[libtiny.so]0xe404 JNIEnv->FindClass(android/provider/Settings$Secure) was called from RX@0x4000e43c[libtiny.so]0xe43c JNIEnv->NewGlobalRef(class android/provider/Settings$Secure) was called from RX@0x4000e454[libtiny.so]0xe454 JNIEnv->GetStaticMethodID(android/provider/Settings$Secure.getString(Landroid/content/ContentResolver;Ljava/lang/String;)Ljava/lang/String;) => 0x3efce417 was called from RX@0x4000e478[libtiny.so]0xe478 JNIEnv->GetStaticMethodID(android/provider/Settings$Secure.getInt(Landroid/content/ContentResolver;Ljava/lang/String;)I) => 0x235c4a44 was called from RX@0x4000e49c[libtiny.so]0xe49c JNIEnv->FindClass(android/provider/Settings$System) was called from RX@0x4000e4d4[libtiny.so]0xe4d4 JNIEnv->NewGlobalRef(class android/provider/Settings$System) was called from RX@0x4000e4ec[libtiny.so]0xe4ec JNIEnv->GetStaticMethodID(android/provider/Settings$System.getString(Landroid/content/ContentResolver;Ljava/lang/String;)Ljava/lang/String;) => 0x1798fccf was called from RX@0x4000e518[libtiny.so]0xe518 JNIEnv->GetStaticMethodID(android/provider/Settings$System.getInt(Landroid/content/ContentResolver;Ljava/lang/String;)I) => 0xd541eefc was called from RX@0x4000e558[libtiny.so]0xe558 JNIEnv->FindClass(android/telephony/TelephonyManager) was called from RX@0x4006505c[libtiny.so]0x6505c JNIEnv->NewGlobalRef(class android/telephony/TelephonyManager) was called from RX@0x40065074[libtiny.so]0x65074 JNIEnv->GetMethodID(android/telephony/TelephonyManager.getSimState()I) => 0xbb348335 was called from RX@0x400650a0[libtiny.so]0x650a0 JNIEnv->GetMethodID(android/telephony/TelephonyManager.getSimOperator()Ljava/lang/String;) => 0xa88ed76d was called from RX@0x400650d0[libtiny.so]0x650d0 JNIEnv->GetMethodID(android/telephony/TelephonyManager.getSimOperatorName()Ljava/lang/String;) => 0x369d2198 was called from RX@0x400650f8[libtiny.so]0x650f8 JNIEnv->GetMethodID(android/telephony/TelephonyManager.getImei(I)Ljava/lang/String;) => 0xaaca4c31 was called from RX@0x40065124[libtiny.so]0x65124 JNIEnv->FindClass(android/content/SharedPreferences) was called from RX@0x4000e598[libtiny.so]0xe598 JNIEnv->NewGlobalRef(class android/content/SharedPreferences) was called from RX@0x4000e5b0[libtiny.so]0xe5b0 JNIEnv->GetMethodID(android/content/SharedPreferences.getString(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;) => 0x2c5b4190 was called from RX@0x4000e5dc[libtiny.so]0xe5dc JNIEnv->GetMethodID(android/content/SharedPreferences.edit()Landroid/content/SharedPreferences$Editor;) => 0x5913f014 was called from RX@0x4000e608[libtiny.so]0xe608 JNIEnv->FindClass(android/content/SharedPreferences$Editor) was called from RX@0x4000e640[libtiny.so]0xe640 JNIEnv->NewGlobalRef(class android/content/SharedPreferences$Editor) was called from RX@0x4000e658[libtiny.so]0xe658 JNIEnv->GetMethodID(android/content/SharedPreferences$Editor.putString(Ljava/lang/String;Ljava/lang/String;)Landroid/content/SharedPreferences$Editor;) => 0x201e0563 was called from RX@0x4000e684[libtiny.so]0xe684 JNIEnv->GetMethodID(android/content/SharedPreferences$Editor.remove(Ljava/lang/String;)Landroid/content/SharedPreferences$Editor;) => 0x2eafa01b was called from RX@0x4000e6b4[libtiny.so]0xe6b4 JNIEnv->GetMethodID(android/content/SharedPreferences$Editor.apply()V) => 0x3434ff8c was called from RX@0x4000e6e0[libtiny.so]0xe6e0 JNIEnv->FindClass(android/net/wifi/WifiInfo) was called from RX@0x4000d4a8[libtiny.so]0xd4a8 JNIEnv->NewGlobalRef(class android/net/wifi/WifiInfo) was called from RX@0x4000d4c0[libtiny.so]0xd4c0 JNIEnv->GetMethodID(android/net/wifi/WifiInfo.getSSID()Ljava/lang/String;) => 0x2d3b6000 was called from RX@0x4000d4f0[libtiny.so]0xd4f0 JNIEnv->GetMethodID(android/net/wifi/WifiInfo.getBSSID()Ljava/lang/String;) => 0xffe5450e was called from RX@0x4000d518[libtiny.so]0xd518 JNIEnv->GetMethodID(android/net/wifi/WifiInfo.getIpAddress()I) => 0x6b0928d5 was called from RX@0x4000d548[libtiny.so]0xd548 JNIEnv->GetMethodID(android/net/wifi/WifiInfo.getMacAddress()Ljava/lang/String;) => 0x7e5bebca was called from RX@0x4000d570[libtiny.so]0xd570 JNIEnv->FindClass(android/net/wifi/WifiManager) was called from RX@0x4000d5a8[libtiny.so]0xd5a8 JNIEnv->NewGlobalRef(class android/net/wifi/WifiManager) was called from RX@0x4000d5c0[libtiny.so]0xd5c0 JNIEnv->GetMethodID(android/net/wifi/WifiManager.getWifiState()I) => 0xedbe0581 was called from RX@0x4000d5e8[libtiny.so]0xd5e8 JNIEnv->GetMethodID(android/net/wifi/WifiManager.getConnectionInfo()Landroid/net/wifi/WifiInfo;) => 0x6b848ba was called from RX@0x4000d614[libtiny.so]0xd614 JNIEnv->FindClass(android/hardware/SensorManager) was called from RX@0x4000d64c[libtiny.so]0xd64c JNIEnv->NewGlobalRef(class android/hardware/SensorManager) was called from RX@0x4000d664[libtiny.so]0xd664 JNIEnv->GetMethodID(android/hardware/SensorManager.getSensorList(I)Ljava/util/List;) => 0xcbe7ed08 was called from RX@0x4000d690[libtiny.so]0xd690 JNIEnv->FindClass(android/hardware/Sensor) was called from RX@0x4000d6c8[libtiny.so]0xd6c8 JNIEnv->NewGlobalRef(class android/hardware/Sensor) was called from RX@0x4000d6e0[libtiny.so]0xd6e0 JNIEnv->GetMethodID(android/hardware/Sensor.getName()Ljava/lang/String;) => 0xfc35b75a was called from RX@0x4000d708[libtiny.so]0xd708 JNIEnv->GetMethodID(android/hardware/Sensor.getType()I) => 0xaee0c2ea was called from RX@0x4000d730[libtiny.so]0xd730 JNIEnv->GetMethodID(android/hardware/Sensor.getVendor()Ljava/lang/String;) => 0x3e979097 was called from RX@0x4000d758[libtiny.so]0xd758 JNIEnv->GetMethodID(android/hardware/Sensor.getVersion()I) => 0x38250514 was called from RX@0x4000d780[libtiny.so]0xd780 JNIEnv->FindClass(android/content/pm/ActivityInfo) was called from RX@0x400626c8[libtiny.so]0x626c8 JNIEnv->NewGlobalRef(class android/content/pm/ActivityInfo) was called from RX@0x40062714[libtiny.so]0x62714 JNIEnv->GetFieldID(android/content/pm/ActivityInfo.packageName Ljava/lang/String;) => 0xde64413d was called from RX@0x4006488c[libtiny.so]0x6488c JNIEnv->GetFieldID(android/content/pm/ActivityInfo.applicationInfo Landroid/content/pm/ApplicationInfo;) => 0xd8a7b633 was called from RX@0x400648b8[libtiny.so]0x648b8 JNIEnv->FindClass(android/content/pm/ResolveInfo) was called from RX@0x4000d7c0[libtiny.so]0xd7c0 JNIEnv->GetFieldID(android/content/pm/ResolveInfo.activityInfo Landroid/content/pm/ActivityInfo;) => 0x5c547120 was called from RX@0x4000d7e8[libtiny.so]0xd7e8 JNIEnv->FindClass(java/lang/CharSequence) was called from RX@0x4000d820[libtiny.so]0xd820 JNIEnv->GetMethodID(java/lang/CharSequence.toString()Ljava/lang/String;) => 0x13c3c453 was called from RX@0x4000d844[libtiny.so]0xd844 JNIEnv->FindClass(android/app/ActivityManager) was called from RX@0x400626c8[libtiny.so]0x626c8 JNIEnv->NewGlobalRef(class android/app/ActivityManager) was called from RX@0x40062714[libtiny.so]0x62714 JNIEnv->GetMethodID(android/app/ActivityManager.getMemoryInfo(Landroid/app/ActivityManager$MemoryInfo;)V) => 0xdb1b58dd was called from RX@0x4000d8d8[libtiny.so]0xd8d8 JNIEnv->FindClass(android/app/ActivityManager$MemoryInfo) was called from RX@0x4000d910[libtiny.so]0xd910 JNIEnv->NewGlobalRef(class android/app/ActivityManager$MemoryInfo) was called from RX@0x4000d928[libtiny.so]0xd928 JNIEnv->GetMethodID(android/app/ActivityManager$MemoryInfo.()V) => 0xcba7b8af was called from RX@0x4000d954[libtiny.so]0xd954 JNIEnv->GetFieldID(android/app/ActivityManager$MemoryInfo.totalMem J) => 0x4e593b95 was called from RX@0x4000d984[libtiny.so]0xd984 JNIEnv->GetFieldID(android/app/ActivityManager$MemoryInfo.availMem J) => 0x2c4064ca was called from RX@0x4000d9ac[libtiny.so]0xd9ac JNIEnv->FindClass(android/view/MotionEvent) was called from RX@0x4000d9e4[libtiny.so]0xd9e4 JNIEnv->GetMethodID(android/view/MotionEvent.getDeviceId()I) => 0x3daaa60c was called from RX@0x4000da0c[libtiny.so]0xda0c JNIEnv->GetMethodID(android/view/MotionEvent.getEventTime()J) => 0xa8e0edcd was called from RX@0x4000da3c[libtiny.so]0xda3c JNIEnv->FindClass(android/location/Location) was called from RX@0x4000da74[libtiny.so]0xda74 JNIEnv->GetMethodID(android/location/Location.getLongitude()D) => 0x6a15fe8a was called from RX@0x4000daa0[libtiny.so]0xdaa0 JNIEnv->GetMethodID(android/location/Location.getLatitude()D) => 0x3fb04981 was called from RX@0x4000dac8[libtiny.so]0xdac8 JNIEnv->GetMethodID(android/location/Location.getTime()J) => 0x1e7e9086 was called from RX@0x4000daf0[libtiny.so]0xdaf0 JNIEnv->NewStringUTF("android.os.ServiceManager") was called from RX@0x40063930[libtiny.so]0x63930 callStaticObjectMethodV: com/xingin/tiny/internal/t->b(I[Ljava/lang/Object;)Ljava/lang/Object; JNIEnv->CallStaticObjectMethodV(class com/xingin/tiny/internal/t, b(0xc, ["android.os.ServiceManager"]) => java.lang.Object@6bf0219d) was called from RX@0x400636f4[libtiny.so]0x636f4 JNIEnv->NewGlobalRef(java.lang.Object@6bf0219d) was called from RX@0x40064b84[libtiny.so]0x64b84 JNIEnv->NewStringUTF("sCache") was called from RX@0x400640f0[libtiny.so]0x640f0 callStaticObjectMethodV: com/xingin/tiny/internal/t->b(I[Ljava/lang/Object;)Ljava/lang/Object; ss1 :681008168 ss:12 ss1 :681008168 ss:12 ss1 :231786897 ss:14 JNIEnv->CallStaticObjectMethodV(class com/xingin/tiny/internal/t, b(0xe, [java.lang.Object@6bf0219d, "sCache"]) => java.lang.Object@5552768b) was called from RX@0x400636f4[libtiny.so]0x636f4 java.lang.UnsupportedOperationException at com.github.unidbg.linux.android.dvm.DalvikVM64$5.handle(DalvikVM64.java:100) at com.github.unidbg.linux.ARM64SyscallHandler.hook(ARM64SyscallHandler.java:117) at com.github.unidbg.arm.backend.UnicornBackend$11.hook(UnicornBackend.java:345) at unicorn.Unicorn$NewHook.onInterrupt(Unicorn.java:128) at unicorn.Unicorn.emu_start(Native Method) at com.github.unidbg.arm.backend.UnicornBackend.emu_start(UnicornBackend.java:376) at com.github.unidbg.AbstractEmulator.emulate(AbstractEmulator.java:380) at com.github.unidbg.thread.Function64.run(Function64.java:39) at com.github.unidbg.thread.MainTask.dispatch(MainTask.java:19) at com.github.unidbg.thread.UniThreadDispatcher.run(UniThreadDispatcher.java:172) at com.github.unidbg.thread.UniThreadDispatcher.runMainForResult(UniThreadDispatcher.java:96) at com.github.unidbg.AbstractEmulator.runMainForResult(AbstractEmulator.java:340) at com.github.unidbg.arm.AbstractARM64Emulator.eFunc(AbstractARM64Emulator.java:236) at com.github.unidbg.Module.emulateFunction(Module.java:163) at com.github.unidbg.linux.LinuxModule.callFunction(LinuxModule.java:258) at com.github.unidbg.linux.LinuxSymbol.call(LinuxSymbol.java:27) at com.github.unidbg.linux.android.dvm.DalvikModule.callJNI_OnLoad(DalvikModule.java:33) at com.xingin.xh.xhs742libtiny.(xhs742libtiny.java:94) at com.xingin.xh.xhs742libtiny.main(xhs742libtiny.java:50) debugger break at: 0xfffe00d4 @ Function64 address=0x4000ce10, arguments=[unidbg@0xfffe0080, null]

x0=0xfffe1640(-125376) x1=0x5552768b x2=0x6af41461 x3=0xbffff440 x4=0xdd0c991 x5=0x8080000000000000 x6=0x8080 x7=0xfeff646762604272 x8=0xfffe00d0 x9=0x0 x10=0xbffff440 x11=0x0 x12=0xbffff4b0 x13=0x0 x14=0x1 x15=0x44 x16=0x4006e040 x17=0x401ecbe4 x18=0x17 x19=0xdd0c991 x20=0xfffe1640 x21=0x5552768b x22=0xfffe0080 x23=0xbffff718 x24=0x40070000 x25=0x0 x26=0xd50ed2 x27=0xdfdaf136 x28=0x0 fp=0xbffff4c0 q0=0xbffff44000000000bffff4b0(1.5914954124E-314, 1.591495357E-314) q1=0xffffff80ffffffd800000000bffff410(1.5914953334E-314, NaN) q2=0x40a00000(5.0) q3=0xfa2e6c77e6d8df84238c897f95780fbb(1.9170872259255444E-137, -3.4515810464861845E280) q4=0x10000000000000001(4.9E-324, 4.9E-324) q5=0x40000000000000004(2.0E-323, 2.0E-323) q6=0x20000000000000002(1.0E-323, 1.0E-323) q7=0x510000000000000051(4.0E-322, 4.0E-322) q8=0x0(0.0) q9=0x0(0.0) q10=0x0(0.0) q11=0x0(0.0) q12=0x0(0.0) q13=0x0(0.0) q14=0x0(0.0) q15=0x0(0.0) q16=0x30510000000000002051(4.0874E-320, 6.111E-320) q17=0x0(0.0) q18=0x30510000000000002051(4.0874E-320, 6.111E-320) q19=0x0(0.0) q20=0x0(0.0) q21=0x0(0.0) q22=0x0(0.0) q23=0x0(0.0) q24=0x0(0.0) q25=0x0(0.0) q26=0x0(0.0) q27=0x0(0.0) q28=0x0(0.0) q29=0x0(0.0) q30=0x0(0.0) q31=0x0(0.0) LR=RX@0x400641e0[libtiny.so]0x641e0 SP=0xbffff4b0 PC=unidbg@0xfffe00d4 nzcv: N=0, Z=1, C=0, V=0, EL0, use SP_EL0 => [Arm64Svc 0x000d4][c0035fd6]0xfffe00d4:*"ret"

Disconnected from the target VM, address: '127.0.0.1:64909', transport: 'socket' Exception in thread "main" java.lang.IllegalStateException: Illegal JNI version: 0xffffffff at com.github.unidbg.linux.android.dvm.BaseVM.checkVersion(BaseVM.java:207) at com.github.unidbg.linux.android.dvm.DalvikModule.callJNI_OnLoad(DalvikModule.java:39) at com.xingin.xh.xhs742libtiny.(xhs742libtiny.java:94) at com.xingin.xh.xhs742libtiny.main(xhs742libtiny.java:50)

Process finished with exit code 1

如图是我尝试补环境,不知道 image

源码大概是这样的(目的是反射到android.os.ServiceManager的sCache返回field)

image image
cnlowkey commented 2 years ago

你好,你解决了吗?有联系方式吗?加一个探讨一下