Android software security and reverse analysis

JVM virtual machine: The instruction set is a 0-address instruction set, that is, the source and target parameters of the instruction are implicit and passed through a data structure "evaluation stack" provided in the Java Virtual machine.

Dalvik also maintains a PC counter and call stack for each thread when the virtual computer is running, and this call stack maintains a list of registers that are given in the registers field of the method structure, and the DVM creates a list of virtual registers based on this value.

Dalvik opcodes:http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html

For binary XML files, with a binary-to-textual XML converter like AXMLPrinter2

For the DEX file, use Dedexer

Alternative Products:

–dexdump–comes with the Android SDK, less convenient to use than dedexer because e.g. it does not support labels, produ Ces one large file, etc.

–baksmali–a competing Open-source DEX disassembler. Comes with a Dalvik bytecode assembler (Smali)

The DVM is a CPU that works on a particular architecture, with an arm architecture, and the ARM architecture's CPU itself integrates multiple registers, Dalvik partial registers to arm registers, and a part of the call stack for simulation. A total of 65,526 registers, the value range v0-v65535.

Each register in the virtual machine is 32-bit, and the number of digits that describe the instruction represents the value range of the register value.

Android software security and reverse analysis