zhkl0228 / unidbg

Allows you to emulate an Android native library, and an experimental iOS emulation
Apache License 2.0
3.79k stars 959 forks source link

关于unidbg模拟执行mtguard.so之mt3.0问题 #602

Open myVison opened 8 months ago

myVison commented 8 months ago

你好,我在构建mtgsig3.0版本时,遇见main(120)调用时,传递的是IIVTQYOSF$1类型对象数组,在unidbg上模拟参数传递的时候,似乎传递不正确,想咨询下有什么办法可以处理该参数传递? 我在unidbg中如下构建参数: mytemp变量则是自定义的java类IIVTQYOSF$1 DvmObject<?> dvmObject1 = vm.resolveClass("com.meituan.android.common.mtguard.wtscore.plugin.sign.core.IIVTQYOSF$1").newObject(mytemp); ArrayObject initSo_arg=new ArrayObject(dvmObject1); DvmObject<?> dvmObject_initSo = ShellBridge.callStaticJniMethodObject(emulator, "main(I[Ljava/lang/Object;)[Ljava/lang/Object;", 120,initSo_arg); 我在使用frida hook得到的结果如下: [120] - arg0:com.meituan.android.common.mtguard.wtscore.plugin.sign.core.IIVTQYOSF$1@2a2d510 在unidbg模拟执行时,报如下错误: TAG Vison ------------------- [call]inti2 ------------------- Find native function Java_com_meituan_android_common_mtguard_ShellBridge_main => RX@0x40025d48[libmtguard.so]0x25d48 Exception in thread "main" java.lang.NullPointerException at com.sankuai.MT3.myMeituan3.Funtion2(myMeituan3.java:192) at com.sankuai.MT3.myMeituan3.main(myMeituan3.java:139) 所以我猜测还是参数没有构造好,不知道各位可否有更好的解决办法?

liuyuanjun520 commented 3 months ago

解决了嘛?

myVison commented 3 months ago

解决了嘛?

没有,都块放弃了都,你也研究mt?