1
package com.kuaishou;
2

3
import com.github.unidbg.AndroidEmulator;
4
import com.github.unidbg.Emulator;
5
import com.github.unidbg.Module;
6
import com.github.unidbg.file.FileResult;
7
import com.github.unidbg.file.IOResolver;
8
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
9
import com.github.unidbg.linux.android.AndroidResolver;
10
import com.github.unidbg.linux.android.dvm.*;
11
import com.github.unidbg.linux.android.dvm.array.ByteArray;
12
import com.github.unidbg.memory.Memory;
13
import com.github.unidbg.hook.hookzz.HookZz;
14
import com.github.unidbg.hook.hookzz.IHookZz;
15
import com.github.unidbg.hook.hookzz.HookEntryInfo;
16
import com.github.unidbg.arm.context.RegisterContext;
17

18
import java.io.File;
19
import java.nio.charset.StandardCharsets;
20

21
public class Sig extends AbstractJni implements IOResolver {
22

23
    // ========== 每次新项目只改这里 ==========
24

25
    // 模拟器位数：so在armeabi-v7a目录下填false，arm64-v8a目录下填true
26
    private static final boolean IS_64BIT         = true;
27

28
    // app包名（随意，一般填真实包名）
29
    private static final String  PROCESS_NAME     = "com.smile.gifmaker";
30

31
    // apk路径，不需要apk时填null（填null时LOAD_BY_NAME必须为false）
32
    private static final String  APK_PATH         = "apks/kuaishou/ks_11.4.apk";
33

34
    // so加载方式：
35
    //   false = 传文件路径（用SO_PATH），不依赖apk，最常用
36
    //   true  = 传库名（用SO_NAME），unidbg自动去apk内查找，必须提供APK_PATH
37
    private static final boolean LOAD_BY_NAME     = true;
38
    private static final String  SO_PATH          = ""; // LOAD_BY_NAME=false时生效
39
    private static final String  SO_NAME          = "core";                // LOAD_BY_NAME=true时生效，不带lib前缀和.so后缀
40

41

42
    // 是否打印JNI调用细节，调试时改true
43
    private static final boolean VERBOSE          = true;
44

45

46
    // ========================================
47

48
    public static AndroidEmulator emulator;
49
    public static Memory memory;
50
    public static VM vm;
51
    public static Module module;
52
    // 1. 构造方法 —— 初始化模拟器
53
    public Sig() {
54

55
        // 1. 创建模拟器（32/64位由IS_64BIT控制）
56
        emulator = IS_64BIT
57
                ? AndroidEmulatorBuilder.for64Bit().setProcessName(PROCESS_NAME).build()
58
                : AndroidEmulatorBuilder.for32Bit().setProcessName(PROCESS_NAME).build();
59

60
        // 2. 获取内存对象
61
        memory = emulator.getMemory();
62

63
        // 3. 设置安卓SDK版本（只支持19、23）
64
        memory.setLibraryResolver(new AndroidResolver(23));
65

66
        // 4. 创建虚拟机
67
        vm = APK_PATH != null
68
                ? emulator.createDalvikVM(new File(APK_PATH))
69
                : emulator.createDalvikVM();
70
        vm.setJni(this);
71
        vm.setVerbose(VERBOSE);
72

73
        // 5. 加载so文件（两种方式由LOAD_BY_NAME控制）
74
        DalvikModule dm = LOAD_BY_NAME
75
                ? vm.loadLibrary(SO_NAME, false)
76
                : vm.loadLibrary(new File(SO_PATH), false);
77

78
        // 6. 动态注册才需要执行JNI_OnLoad
79
        dm.callJNI_OnLoad(emulator);
80

81
        // 7. 获取module对象（后续拿基址、偏移等）
82
        module = dm.getModule();
83
    }
84

85

86
    public void get_sig(){
87

88
        DvmClass CPU = vm.resolveClass("com/yxcorp/gifshow/util/CPU");
89

90
        DvmObject<?> context = vm.resolveClass(
91
                "com/yxcorp/gifshow/App",vm.resolveClass("android/app/Application",vm.resolveClass("android/content/ContextWrapper",vm.resolveClass("android/content/Context"))
92
                )
93
        ).newObject(null);
94

95
        byte[] data = "abi=arm64androidApiLevel=33android_os=0app=0appver=11.4.20.30984boardPlatform=gs101bottom_navigation=falsebrowseType=4c=VIVOcdid_tag=2client_key=3c2cd3f3cold_launch_time_ms=1776770165527country_code=cncs=falsedarkMode=falseddpi=420deviceBit=0device_abi=arm64did=ANDROID_5da58d729681f1acdid_gt=1776606738892did_tag=0earphoneMode=1egid=DFP6D71BE9FE223F82B29667FCEF6A42F69F5213B5466D5501A40CCFDE93A47Dftt=grant_browse_type=AUTHORIZEDhotfix_ver=is_background=0isp=iuid=kcv=1618keyconfig_state=2kpf=ANDROID_PHONEkpn=KUAISHOUlanguage=zh-cnmax_memory=256mobile=3sCt3iAAMzAyMjczNzYyAM8HAO7Jtk8iu2f5zhAAAAB0Q1LQ3uDWCIOY1UG7OZRpmobileCountryCode=+86mod=Google(Pixel 6)nbh=63net=WIFInewOc=VIVOoDid=ANDROID_729f8a7d5a1ee349oc=VIVOos=androidpUid=rQAJ3a0D9dzzHC3sLzpaIcMmQbfS6_4e3c473f571f4ea6bpassword=ba3253876aed6bc22d4a6ff53d8406c6ad864195ed144ab5c87621b6c233b548baeae6956df346ec8c17f5ea10f35ee3cbc514797ed7ddd3145464e2a0bab413raw=1776770354556rdid=ANDROID_24ada3751f437f2asbh=128secret=eZAfxsoqqkw5rORep70c8HtQ4BIoR28xEyH5SVxNbrwMQytwPHtRwDNj0/7/o3uLnbpkit+VCyHokMPg+cRXiB7afhmXBq7KfFYntjX2GHJ/KjVKgV1f1iCwxyWlGxvHZHX31Vy3KLiFSUurf6+Mdl3J3PbRrF9DrvZ649knzde595wNWQKoAMtIH9pn4PuiIwDV7Hqgf7xTbPEZXKJB/LdTVlMTuUqmBQ9ocSAj/rlBrk2UJ89JjWqFMeN/WlYLCQmN7X9rtg62v/QWfk+ETcyii9Wwp0z4hwRjjwikZYTrw4N8iVG5Plxqb8JFceM7XBHbNagtPGpT1/QF4yRvvQ==sh=2400slh=0socName=Unknownsw=1080sys=ANDROID_13thermal=10000totalMemory=7614uQaTag=ud=0userRecoBit=0ver=11.4videoModelCrowdTag="
96
                .getBytes(StandardCharsets.UTF_8);
97

98
        String ret = CPU.callStaticJniMethodObject(
99
                emulator,
100
                "getClock(Landroid/content/Context;[BI)Ljava/lang/String;",
101
                context,
102
                new ByteArray(vm, data),
103
                33
104
        ).getValue().toString();
105

106
        System.out.println(ret);
107

108
    }
109

110

111

112
    // 5. main方法 —— 右键直接运行
113
    public static void main(String[] args) {
114
        Sig sig = new Sig();
115
//        sig.get_sig();
116
    }
117

118
    @Override
119
    public FileResult resolve(Emulator emulator, String pathname, int oflags) {
120
        System.out.println("pathname:" + pathname);
121
        return null;
122
    }
123
}

1
@Override
2
public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
3
  switch (signature){
4
    case "com/yxcorp/gifshow/App->getPackageName()Ljava/lang/String;":{
5
      String packageName = vm.getPackageName();
6
      if (packageName != null) {
7
        return new StringObject(vm, packageName);
8
      }
9
    }
10
    case "com/yxcorp/gifshow/App->getPackageManager()Landroid/content/pm/PackageManager;":{
11
      return vm.resolveClass("android/content/pm/PackageManager").newObject(null);
12
    }
13
  }
14
  return super.callObjectMethodV(vm, dvmObject, signature, vaList);
15
}

1
package com.kuaishou;
2

3
import com.github.unidbg.AndroidEmulator;
4
import com.github.unidbg.Emulator;
5
import com.github.unidbg.Module;
6
import com.github.unidbg.file.FileResult;
7
import com.github.unidbg.file.IOResolver;
8
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
9
import com.github.unidbg.linux.android.AndroidResolver;
10
import com.github.unidbg.linux.android.dvm.*;
11
import com.github.unidbg.linux.android.dvm.array.ArrayObject;
12
import com.github.unidbg.linux.android.dvm.wrapper.DvmBoolean;
13
import com.github.unidbg.linux.android.dvm.wrapper.DvmInteger;
14
import com.github.unidbg.memory.Memory;
15
import com.github.unidbg.virtualmodule.android.AndroidModule;
16

17
import java.io.File;
18
import java.io.FileNotFoundException;
19
import java.io.FileOutputStream;
20
import java.io.PrintStream;
21

22
public class KS extends AbstractJni implements IOResolver {
23

24
    // ========== 每次新项目只改这里 ==========
25

26
    // 模拟器位数：so在armeabi-v7a目录下填false，arm64-v8a目录下填true
27
    private static final boolean IS_64BIT         = true;
28

29
    // app包名（随意，一般填真实包名）
30
    private static final String  PROCESS_NAME     = "com.smile.gifmaker";
31

32
    // apk路径，不需要apk时填null（填null时LOAD_BY_NAME必须为false）
33
    private static final String APK_PATH = "apks/kuaishou/ks_11.4.apk";
34

35
    // so加载方式：
36
    //   false = 传文件路径（用SO_PATH），不依赖apk，最常用
37
    //   true  = 传库名（用SO_NAME），unidbg自动去apk内查找，必须提供APK_PATH
38
    private static final boolean LOAD_BY_NAME     = true;
39
    private static final String  SO_PATH          = ""; // LOAD_BY_NAME=false时生效
40
    private static final String  SO_NAME          = "kwsgmain";                // LOAD_BY_NAME=true时生效，不带lib前缀和.so后缀
41

42

43
    // 是否打印JNI调用细节，调试时改true
44
    private static final boolean VERBOSE          = true;
45

46

47
    // ========================================
48

49
    public static AndroidEmulator emulator;
50
    public static Memory memory;
51
    public static VM vm;
52
    public static Module module;
53
    public static DvmClass JNICLibrary;
54

55
    // 1. 构造方法 —— 初始化模拟器
56
    public KS() {
57

58
        // 1. 创建模拟器（32/64位由IS_64BIT控制）
59
        emulator = IS_64BIT
60
                ? AndroidEmulatorBuilder.for64Bit().setProcessName(PROCESS_NAME).build()
61
                : AndroidEmulatorBuilder.for32Bit().setProcessName(PROCESS_NAME).build();
62

63
        // 2. 获取内存对象
64
        memory = emulator.getMemory();
65

66
        // 3. 设置安卓SDK版本（只支持19、23）
67
        memory.setLibraryResolver(new AndroidResolver(23));
68

69
        // 4. 创建虚拟机
70
        vm = APK_PATH != null
71
                ? emulator.createDalvikVM(new File(APK_PATH))
72
                : emulator.createDalvikVM();
73
        vm.setJni(this);
74
        vm.setVerbose(VERBOSE);
75

76
        // 5. 加载so文件（两种方式由LOAD_BY_NAME控制）
77
        new AndroidModule(emulator, vm).register(memory);
78
        DalvikModule dm = LOAD_BY_NAME
79
                ? vm.loadLibrary(SO_NAME, false)
80
                : vm.loadLibrary(new File(SO_PATH), false);
81

82
        // 6. 动态注册才需要执行JNI_OnLoad
83
        dm.callJNI_OnLoad(emulator);
84

85
        // 7. 获取module对象（后续拿基址、偏移等）
86
        module = dm.getModule();
87
        JNICLibrary = vm.resolveClass("com.kuaishou.android.security.internal.dispatch.JNICLibrary");
88
    }
89

90
    public void call_doCommandNative(String text) {
91
        StringObject textObj = new StringObject(vm, text);
92
        StringObject arg1 = new StringObject(vm, "d7b7d042-d4f2-4012-be60-d97ff2429c17");
93
        DvmInteger arg2 = DvmInteger.valueOf(vm, -1);
94
        DvmBoolean arg3 = DvmBoolean.valueOf(vm, false);
95
        DvmObject<?> context = vm.resolveClass("com/yxcorp/gifshow/App").newObject(null); // context
96
        StringObject arg4 = new StringObject(vm, "");
97
        ArrayObject arrObj = new ArrayObject(new ArrayObject(textObj), arg1, arg2, arg3, context, null, arg3, arg4);
98
        String retulst = JNICLibrary.callStaticJniMethodObject(emulator,"doCommandNative(I[Ljava/lang/Object;)Ljava/lang/Object;",10418,arrObj).getValue().toString();
99
        System.out.println(retulst);
100
    }
101

102

103
    public void traceCode() {
104
        String traceFile = "unidbg-android/src/test/java/com/kuaishou/traceCode.log";
105
        PrintStream traceStream = null; // 打印流
106
        try {
107
            traceStream = new PrintStream(new FileOutputStream(traceFile), true);
108
        } catch (FileNotFoundException e) {
109
            throw new RuntimeException(e);
110
        }
111
        // traceCode 对代码进行监控
112
        emulator.traceCode(module.base, module.base + module.size).setRedirect(traceStream);
113
    }
114
    // 5. main方法 —— 右键直接运行
115
    public static void main(String[] args) {
116
        KS ks = new KS();
117
//        kuaiShou.traceCode();
118
        ks.call_doCommandNative("0xnonce");
119
    }
120

121
    @Override
122
    public FileResult resolve(Emulator emulator, String pathname, int oflags) {
123
        System.out.println("pathname:" + pathname);
124
        return null;
125
    }
126
}

1
public void call_init() {
2
  StringObject appkey = new StringObject(vm, "d7b7d042-d4f2-4012-be60-d97ff2429c17");
3
  DvmObject<?> context = vm.resolveClass("com/yxcorp/gifshow/App").newObject(null); // context
4
  ArrayObject arg2 = new ArrayObject(null, appkey, null, null, context, null, null);
5
  JNICLibrary.callStaticJniMethodObject(emulator,"doCommandNative(I[Ljava/lang/Object;)Ljava/lang/Object;",10412,arg2);
6
}

1
C:\Users\p1913>adb shell pm path com.smile.gifmaker
2
package:/data/app/~~tFzou1DIESBRZ1LFDyaPvw==/com.smile.gifmaker-6HJLIKArWgIclnWEZ_zuzA==/base.apk

1
@Override
2
public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
3
  switch (signature){
4
    case "com/yxcorp/gifshow/App->getPackageCodePath()Ljava/lang/String;":{
5
      return new StringObject(vm,"/data/app/~~tFzou1DIESBRZ1LFDyaPvw==/com.smile.gifmaker-6HJLIKArWgIclnWEZ_zuzA==/base.apk");
6
    }
7
  }
8
  return super.callObjectMethodV(vm, dvmObject, signature, vaList);
9
}

1
case "com/yxcorp/gifshow/App->getPackageName()Ljava/lang/String;": {
2
  return new StringObject(vm, "com.smile.gifmaker");
3
}

1
@Override
2
public DvmObject<?> callStaticObjectMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
3
   switch (signature) {
4
     case "com/kuaishou/android/security/internal/common/ExceptionProxy->getProcessName(Landroid/content/Context;)Ljava/lang/String;": {
5
       return new StringObject(vm, PROCESS_NAME);
6
     }
7
   }
8
   return super.callStaticObjectMethodV(vm, dvmClass, signature, vaList);
9
}

1
case "com/yxcorp/gifshow/App->getAssets()Landroid/content/res/AssetManager;":{
2
  return vm.resolveClass("android/content/res/AssetManager").newObject(null);
3
}

1
@Override
2
public void callStaticVoidMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
3
  switch (signature){
4
    case "com/kuaishou/android/security/internal/common/ExceptionProxy->nativeReport(ILjava/lang/String;)V":{
5
      int code = vaList.getIntArg(0);
6
      String message = vaList.getObjectArg(1).getValue().toString();
7
      System.out.println("code=" + code + " message=" + message);
8
      return;
9
    }
10
  }
11
  super.callStaticVoidMethodV(vm, dvmClass, signature, vaList);
12
}

1
@Override
2
public boolean callBooleanMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
3
  switch (signature){
4
    case "java/lang/Boolean->booleanValue()Z":{
5
      Boolean value = (Boolean)dvmObject.getValue();
6
      return value != null && value;
7
    }
8
  }
9
  return super.callBooleanMethodV(vm, dvmObject, signature, vaList);
10
}