Dump DEX files in memory

In today's mobile security environment, the program Packers have become commonplace, if not shelling can not be able to crack the rhythm of the world. Zjdroid as a universal shell is very useful, but when the author publicly released the project has been a variety of Packers, such as the preemption of Zjdroid broadcast receiver so that zjdroid can not receive commands. We will also introduce the universal shell of another architecture in the article "The passionate Ring of seven weapons-customized DVM" in the "Android Dynamic commissioning". But tools are tools that may be targeted by similar zjdroid when we release them. So, manual shelling of this skill still needs to be studied. In this section we will describe the most basic memory dump process. We'll cover more tips in the next article.

Here we take the apk300 in alictf2014 as an example to introduce the basic flow of Ida de-shell. First, we use the technique of debugging Jni_onload to suspend the program before it runs:

ADB shell am start-d-n com.ali.tg.testapp/. Mainactivity

! [Enter image description here] [59]

Then the next breakpoint in the Dvmdexfileopenpartial function in libdvm.so:

Then we click Continue to run, the program will be paused at dvmdexfileopenpartial () This function, R0 register to point to the address is the Dex file in memory address, R1 Register is the size of the Dex file:

Then we can use Ida's script command to dump the Dex file in memory.

123456789

static main(void){  auto fp, begin, end, dexbyte;  fp = fopen("C:\\dump.dex", "wb");  begin = r0;  end = r0 + r1;  for ( dexbyte = begin; dexbyte < end; dexbyte ++ )      fputc(Byte(dexbyte), fp);}

After we dump the Dex file, we can use Baksmali to decompile the Dex file.

Because the process is a bit cumbersome, I recorded a dump Dex file video on my github, interested classmates can go to download to watch.

Of course, this is just the simplest way of shelling, and many high-level shells dynamically modify Dex's structure, such as pointing Codeoffset to other addresses in memory, so that the Dex file you dump is actually incomplete because the code snippet is stored elsewhere in memory. But you don't have to worry, we'll introduce a very simple solution in the next article, so please look forward to it.

Dump DEX files in memory