1
function hook_map() {
2
    console.log("hook hashMap")
3
    var hashMap = Java.use("java.util.HashMap");
4
    hashMap.put.implementation = function (a, b) {
5
        if (a!=null&&a.equals("sp")) {
6
            console.log('输出-->', a, b)
7
            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
8
        }
9
        if (a!=null&&a.equals("sig")) {
10
            console.log('输出-->', a, b)
11
            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
12
        }
13
        return this.put(a, b)
14
    }
15
}

1
var C34104b = Java.use("dc0.b");
2
C34104b["r"].implementation = function (str, str2) {
3
  console.log(`C34104b.m116030r is called: str=${str}, str2=${str2}`);
4
  this["r"](str, str2);
5
};

1
// sp参数的生成
2
var JavaString = Java.use("java.lang.String");
3
var StandardCharsets = Java.use("java.nio.charset.StandardCharsets");
4
var YZWG = Java.use("com.twl.signer.YZWG");
5
YZWG["nativeEncodeRequest"].implementation = function (bArr, str) {
6
  var utf8String = JavaString.$new(bArr, StandardCharsets.UTF_8.value);
7
  console.log("以下是sp参数生成的开始::")
8
  console.log("参数1::", utf8String)
9
  console.log("参数2::", str)
10
  let result = this["nativeEncodeRequest"](bArr, str);
11
  console.log(`YZWG.nativeEncodeRequest result=${result}`);
12
  console.log("sp参数生成完毕")
13
  return result;
14
};
15
// sig参数的生成
16
YZWG["nativeSignature"].implementation = function (bArr, str) {
17
  var utf8String = JavaString.$new(bArr, StandardCharsets.UTF_8.value);
18
  console.log("以下是sig参数生成的开始::")
19
  console.log("参数1::", utf8String)
20
  console.log("参数2::", str)
21
  let result = this["nativeSignature"](bArr, str);
22
  var result_string = JavaString.$new(result, StandardCharsets.UTF_8.value);
23
  console.log(`YZWG.nativeSignature result=${result_string}`);
24
  console.log("sig参数生成完毕")
25
  return result;
26
};

1
package com.boss;
2
import com.github.unidbg.AndroidEmulator;
3
import com.github.unidbg.Emulator;
4
import com.github.unidbg.Module;
5
import com.github.unidbg.file.FileResult;
6
import com.github.unidbg.file.IOResolver;
7
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
8
import com.github.unidbg.linux.android.AndroidResolver;
9
import com.github.unidbg.linux.android.dvm.AbstractJni;
10
import com.github.unidbg.linux.android.dvm.DalvikModule;
11
import com.github.unidbg.linux.android.dvm.VM;
12
import com.github.unidbg.memory.Memory;
13

14
import java.io.File;
15
//必须继承AbstractJni
16
public class YZWG extends AbstractJni implements IOResolver {
17
    public static AndroidEmulator emulator;  // 静态属性，以后对象和类都可以直接使用
18
    public static Memory memory;
19
    public static VM vm;
20
    public static Module module;
21
    // 1 构造方法--》用来初始化
22
    public YZWG(){
23
        // 1.创建设备（32位或64位模拟器）， 具体看so文件在哪个目录。 在armeabi-v7a就选择32位
24
        // 传进设备时，如果是32位，后面so文件就要用32位，同理需要用64位的
25
        // 这个名字可以随便写,一般写成app的包名    以后可能会动
26
        emulator = AndroidEmulatorBuilder.for64Bit().setProcessName("com.hpbr.bosszhipin").build();
27

28
        // 2.获取内存对象（可以操作内存）
29
        memory = emulator.getMemory();
30

31
        //3.设置安卓sdk版本（只支持19、23）
32
        memory.setLibraryResolver(new AndroidResolver(23));
33

34
        // 4.创建虚拟机（运行安卓代码需要虚拟机，就想运行py代码需要python解释器一样）    以后会动
35
        vm = emulator.createDalvikVM(new File("apks/boss/boss.apk"));
36
        vm.setJni(this); // 后期补环境会用，把要补的环境，写在当前这个类中，执行这个代码即可，但是必须继承AbstractJni
37
        vm.setVerbose(true); //是否展示调用过程的细节
38

39
        // 5.加载so文件
40
        DalvikModule dm = vm.loadLibrary("yzwg", true);   // 以后会动
41
        dm.callJNI_OnLoad(emulator); // jni开发动态注册，会执行JNI_OnLoad，如果是动态注册，需要执行一下这个，如果静态注册，这个不需要执行，车智赢案例是静态注册
42

43
        // 6.dm代表so文件，dm.getModule()得到module对象，基于module对象可以访问so中的成员。
44
        module = dm.getModule(); // 把so文件加载到内存后，后期可以获取基地址，偏移量等，该变量代指so文件
45
    }
46

47
    //2 sign 成员方法--》主要用来解密
48
    public void get_sp(){
49

50
    }
51

52
    // 3 main方法---》右键直接运行
53
    public static void main(String[] args) {
54
        YZWG yzwg=new YZWG();
55
    }
56

57
    @Override
58
    public FileResult resolve(Emulator emulator, String pathname, int oflags) {
59
        System.out.println("pathname open:"+pathname);
60
        return null;
61
    }
62
}

1
@Override
2
public DvmObject<?> getStaticObjectField(BaseVM vm, DvmClass dvmClass, String signature) {
3
    switch (signature){
4
        case "com/twl/signer/YZWG->gContext:Landroid/content/Context;":{
5
            return vm.resolveClass("android/content/Context").newObject(null);
6
        }
7
    }
8
    return super.getStaticObjectField(vm, dvmClass, signature);
9
}

1
@Override
2
public DvmObject<?> callObjectMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
3
  switch (signature) {
4
    case "android/content/pm/PackageManager->getPackagesForUid(I)[Ljava/lang/String;": {
5
      int arg = varArg.getIntArg(0);
6
      System.out.println("uid==>" + arg);
7
      return new ArrayObject(new StringObject(vm, vm.getPackageName()));
8
    }
9
  }
10
  return super.callObjectMethod(vm, dvmObject, signature, varArg);
11
}

1
@Override
2
public int callIntMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
3
  switch (signature){
4
    case "java/lang/String->hashCode()I":{
5
      String str = (String)dvmObject.getValue();
6
      return str.hashCode();
7
    }
8
  }
9
  return super.callIntMethod(vm, dvmObject, signature, varArg);
10
}

1
public void get_sp() {
2
  ArrayList<Object> list = new ArrayList<>(10);
3
  list.add(vm.getJNIEnv());
4
  list.add(0);
5
  String arg1 = "client_info=%7B%22version%22%3A%2210%22%2C%22os%22%3A%22Android%22%2C%22start_time%22%3A%221772188217563%22%2C%22resume_time%22%3A%221772188217563%22%2C%22channel%22%3A%2228%22%2C%22model%22%3A%22google%7C%7CPixel+2%22%2C%22dzt%22%3A0%2C%22loc_per%22%3A0%2C%22uniqid%22%3A%22809b4bb9-33e9-4d7c-b59b-0a7d6f0ef0ee%22%2C%22oaid%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22oaid_honor%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22did%22%3A%22DUlRWq6jQRU_Glo4HL5qAwwsy7zpPrAM1600RFVsUldxNmpRUlVfR2xvNEhMNXFBd3dzeTd6cFByQU0xNjAwc2h1%22%2C%22tinker_id%22%3A%22Prod-arm64-v8a-release-13.141.1314110_0812-10-06-09%22%2C%22is_bg_req%22%3A0%2C%22network%22%3A%22wifi%22%2C%22operator%22%3A%22UNKNOWN%22%2C%22abi%22%3A1%7D&curidentity=0&data=%5B%7B%22action%22%3A%22app-active%22%2C%22time%22%3A1772188217717%2C%22p4%22%3A%22%22%2C%22p5%22%3A%221%22%2C%22p9%22%3A%22Prod-arm64-v8a-release-13.141.1314110_0812-10-06-09%22%7D%5D&req_time=1772188217741&uniqid=809b4bb9-33e9-4d7c-b59b-0a7d6f0ef0ee&v=13.141";
6
  ByteArray byteArray = new ByteArray(vm, arg1.getBytes(StandardCharsets.UTF_8));
7
  list.add(vm.addLocalObject(byteArray));
8
  list.add(vm.addLocalObject(null));
9
  Number number = module.callFunction(emulator, 0x209a4, list.toArray());
10
  String result = vm.getObject(number.intValue()).getValue().toString();
11
  System.out.println(result);
12
}
13

14
public void get_sig() {
15
  ArrayList<Object> list = new ArrayList<>(10);
16
  list.add(vm.getJNIEnv());
17
  list.add(0);
18
  String arg1 = "/api/zpCommon/batch/unloginStatisticsclient_info=%7B%22version%22%3A%2210%22%2C%22os%22%3A%22Android%22%2C%22start_time%22%3A%221772188217563%22%2C%22resume_time%22%3A%221772188217563%22%2C%22channel%22%3A%2228%22%2C%22model%22%3A%22google%7C%7CPixel+2%22%2C%22dzt%22%3A0%2C%22loc_per%22%3A0%2C%22uniqid%22%3A%22809b4bb9-33e9-4d7c-b59b-0a7d6f0ef0ee%22%2C%22oaid%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22oaid_honor%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22did%22%3A%22DUlRWq6jQRU_Glo4HL5qAwwsy7zpPrAM1600RFVsUldxNmpRUlVfR2xvNEhMNXFBd3dzeTd6cFByQU0xNjAwc2h1%22%2C%22tinker_id%22%3A%22Prod-arm64-v8a-release-13.141.1314110_0812-10-06-09%22%2C%22is_bg_req%22%3A0%2C%22network%22%3A%22wifi%22%2C%22operator%22%3A%22UNKNOWN%22%2C%22abi%22%3A1%7D&curidentity=0&data=%5B%7B%22action%22%3A%22app-active%22%2C%22time%22%3A1772188217717%2C%22p4%22%3A%22%22%2C%22p5%22%3A%221%22%2C%22p9%22%3A%22Prod-arm64-v8a-release-13.141.1314110_0812-10-06-09%22%7D%5D&req_time=1772188217741&uniqid=809b4bb9-33e9-4d7c-b59b-0a7d6f0ef0ee&v=13.141";
19
  ByteArray byteArray = new ByteArray(vm, arg1.getBytes(StandardCharsets.UTF_8));
20
  list.add(vm.addLocalObject(byteArray));
21
  list.add(vm.addLocalObject(null));
22
  Number number = module.callFunction(emulator, 0x21864, list.toArray());
23
  DvmObject<?> retObj = vm.getObject(number.intValue());
24
  byte[] resultBytes = (byte[]) retObj.getValue();
25
  String result = new String(resultBytes, StandardCharsets.UTF_8);
26
  System.out.println("结果: " + result);
27

28
}
29

30
public void decodeContent() {
31
  byte[] encryptedData = new byte[]{
32
      -10, 114, 76, 25, 44, -37, 100, 101, -124, -69, 64, -18, -101, -32, -119, 121, -125, -10, -36, 42, 125, 34, -68, -48, 102, 107, 91, 107, 88, -42, -125, -19, 69, -95, 90, -127, 56, -28, -108, -69, -101, -78, 1, -2, -70, -84, 12, -91, -106, 98, 27, 89, 71, -37, -87, -37, 71, 110, 111, -65, -22, 71, -16, 15, 111, -106, -30, -1, 8, 31, 46, -60, 38, -110, -21, 71, 126, 34, -16, 62, -106, -40, 16, -107, 2, 64, -65, -56, 71, -36, 85, 40, -3, 69, -71, -65, 24, -20, 4, 125, -114, -112, 126, 17, -28, -63, -100, 61, 58, -24, 6, -55, 87, -59, 124, -112, -26, 50, -41, 26, 25, -9, 33, -48, 80, 22, 46, -119, 112, 78, 5, 24, 96, -86, 36, 68, -71, -7, -90, -71, 111, 76, 87, 116, 56, -19, 2
33
  };
34
  ArrayList<Object> list = new ArrayList<>(10);
35
  list.add(vm.getJNIEnv());
36
  list.add(0);
37
  ByteArray dataArray = new ByteArray(vm, encryptedData);
38
  list.add(vm.addLocalObject(dataArray));
39

40
  list.add(null);
41
  list.add(0);
42
  list.add(1);
43
  list.add(0);
44
  Number number = module.callFunction(emulator, 0x24dc8, list.toArray()); // 替换实际地址
45
  DvmObject<?> retObj = vm.getObject(number.intValue());
46
  byte[] resultBytes = (byte[]) retObj.getValue();
47
  String result = new String(resultBytes, StandardCharsets.UTF_8);
48
  System.out.println("解密结果: " + result);
49
}

1
package com.boss;
2

3
import com.github.unidbg.AndroidEmulator;
4
import com.github.unidbg.Emulator;
5
import com.github.unidbg.Module;
6
import com.github.unidbg.file.FileResult;
7
import com.github.unidbg.file.IOResolver;
8
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
9
import com.github.unidbg.linux.android.AndroidResolver;
10
import com.github.unidbg.linux.android.dvm.*;
11
import com.github.unidbg.linux.android.dvm.array.ArrayObject;
12
import com.github.unidbg.linux.android.dvm.array.ByteArray;
13
import com.github.unidbg.memory.Memory;
14

15
import java.io.File;
16
import java.nio.charset.StandardCharsets;
17
import java.util.ArrayList;
18

19
//必须继承AbstractJni
20
public class YZWG extends AbstractJni implements IOResolver {
21
    public static AndroidEmulator emulator;  // 静态属性，以后对象和类都可以直接使用
22
    public static Memory memory;
23
    public static VM vm;
24
    public static Module module;
25

26
    // 1 构造方法--》用来初始化
27
    public YZWG() {
28
        // 1.创建设备（32位或64位模拟器）， 具体看so文件在哪个目录。 在armeabi-v7a就选择32位
29
        // 传进设备时，如果是32位，后面so文件就要用32位，同理需要用64位的
30
        // 这个名字可以随便写,一般写成app的包名    以后可能会动
31
        emulator = AndroidEmulatorBuilder.for64Bit().setProcessName("com.hpbr.bosszhipin").build();
32

33
        // 2.获取内存对象（可以操作内存）
34
        memory = emulator.getMemory();
35

36
        //3.设置安卓sdk版本（只支持19、23）
37
        memory.setLibraryResolver(new AndroidResolver(23));
38

39
        // 4.创建虚拟机（运行安卓代码需要虚拟机，就想运行py代码需要python解释器一样）    以后会动
40
        vm = emulator.createDalvikVM(new File("apks/boss/boss.apk"));
41
        vm.setJni(this); // 后期补环境会用，把要补的环境，写在当前这个类中，执行这个代码即可，但是必须继承AbstractJni
42
        vm.setVerbose(true); //是否展示调用过程的细节
43

44
        // 5.加载so文件
45
        DalvikModule dm = vm.loadLibrary("yzwg", true);   // 以后会动
46
        dm.callJNI_OnLoad(emulator); // jni开发动态注册，会执行JNI_OnLoad，如果是动态注册，需要执行一下这个，如果静态注册，这个不需要执行，车智赢案例是静态注册
47

48
        // 6.dm代表so文件，dm.getModule()得到module对象，基于module对象可以访问so中的成员。
49
        module = dm.getModule(); // 把so文件加载到内存后，后期可以获取基地址，偏移量等，该变量代指so文件
50
    }
51

52

53
    @Override
54
    public DvmObject<?> getStaticObjectField(BaseVM vm, DvmClass dvmClass, String signature) {
55
        switch (signature) {
56
            case "com/twl/signer/YZWG->gContext:Landroid/content/Context;": {
57
                return vm.resolveClass("android/content/Context").newObject(null);
58
            }
59
        }
60
        return super.getStaticObjectField(vm, dvmClass, signature);
61
    }
62

63
    @Override
64
    public DvmObject<?> callObjectMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
65
        switch (signature) {
66
            case "android/content/pm/PackageManager->getPackagesForUid(I)[Ljava/lang/String;": {
67
                int arg = varArg.getIntArg(0);
68
                System.out.println("uid==>" + arg);
69
                System.out.println("包名==>" + vm.getPackageName());
70
                return new ArrayObject(new StringObject(vm, vm.getPackageName()));
71
            }
72
        }
73
        return super.callObjectMethod(vm, dvmObject, signature, varArg);
74
    }
75

76
    @Override
77
    public int callIntMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
78
        switch (signature) {
79
            case "java/lang/String->hashCode()I": {
80
                String str = (String) dvmObject.getValue();
81
                return str.hashCode();
82
            }
83
        }
84
        return super.callIntMethod(vm, dvmObject, signature, varArg);
85
    }
86

87
    //2 sign 成员方法--》主要用来解密
88
    public void get_sp() {
89
        ArrayList<Object> list = new ArrayList<>(10);
90
        list.add(vm.getJNIEnv());
91
        list.add(0);
92
        String arg1 = "client_info=%7B%22version%22%3A%2210%22%2C%22os%22%3A%22Android%22%2C%22start_time%22%3A%221772188217563%22%2C%22resume_time%22%3A%221772188217563%22%2C%22channel%22%3A%2228%22%2C%22model%22%3A%22google%7C%7CPixel+2%22%2C%22dzt%22%3A0%2C%22loc_per%22%3A0%2C%22uniqid%22%3A%22809b4bb9-33e9-4d7c-b59b-0a7d6f0ef0ee%22%2C%22oaid%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22oaid_honor%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22did%22%3A%22DUlRWq6jQRU_Glo4HL5qAwwsy7zpPrAM1600RFVsUldxNmpRUlVfR2xvNEhMNXFBd3dzeTd6cFByQU0xNjAwc2h1%22%2C%22tinker_id%22%3A%22Prod-arm64-v8a-release-13.141.1314110_0812-10-06-09%22%2C%22is_bg_req%22%3A0%2C%22network%22%3A%22wifi%22%2C%22operator%22%3A%22UNKNOWN%22%2C%22abi%22%3A1%7D&curidentity=0&data=%5B%7B%22action%22%3A%22app-active%22%2C%22time%22%3A1772188217717%2C%22p4%22%3A%22%22%2C%22p5%22%3A%221%22%2C%22p9%22%3A%22Prod-arm64-v8a-release-13.141.1314110_0812-10-06-09%22%7D%5D&req_time=1772188217741&uniqid=809b4bb9-33e9-4d7c-b59b-0a7d6f0ef0ee&v=13.141";
93
        ByteArray byteArray = new ByteArray(vm, arg1.getBytes(StandardCharsets.UTF_8));
94
        list.add(vm.addLocalObject(byteArray));
95
        list.add(vm.addLocalObject(null));
96
        Number number = module.callFunction(emulator, 0x209a4, list.toArray());
97
        String result = vm.getObject(number.intValue()).getValue().toString();
98
        System.out.println(result);
99
    }
100

101
    public void get_sig() {
102
        ArrayList<Object> list = new ArrayList<>(10);
103
        list.add(vm.getJNIEnv());
104
        list.add(0);
105
        String arg1 = "/api/zpCommon/batch/unloginStatisticsclient_info=%7B%22version%22%3A%2210%22%2C%22os%22%3A%22Android%22%2C%22start_time%22%3A%221772188217563%22%2C%22resume_time%22%3A%221772188217563%22%2C%22channel%22%3A%2228%22%2C%22model%22%3A%22google%7C%7CPixel+2%22%2C%22dzt%22%3A0%2C%22loc_per%22%3A0%2C%22uniqid%22%3A%22809b4bb9-33e9-4d7c-b59b-0a7d6f0ef0ee%22%2C%22oaid%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22oaid_honor%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22did%22%3A%22DUlRWq6jQRU_Glo4HL5qAwwsy7zpPrAM1600RFVsUldxNmpRUlVfR2xvNEhMNXFBd3dzeTd6cFByQU0xNjAwc2h1%22%2C%22tinker_id%22%3A%22Prod-arm64-v8a-release-13.141.1314110_0812-10-06-09%22%2C%22is_bg_req%22%3A0%2C%22network%22%3A%22wifi%22%2C%22operator%22%3A%22UNKNOWN%22%2C%22abi%22%3A1%7D&curidentity=0&data=%5B%7B%22action%22%3A%22app-active%22%2C%22time%22%3A1772188217717%2C%22p4%22%3A%22%22%2C%22p5%22%3A%221%22%2C%22p9%22%3A%22Prod-arm64-v8a-release-13.141.1314110_0812-10-06-09%22%7D%5D&req_time=1772188217741&uniqid=809b4bb9-33e9-4d7c-b59b-0a7d6f0ef0ee&v=13.141";
106
        ByteArray byteArray = new ByteArray(vm, arg1.getBytes(StandardCharsets.UTF_8));
107
        list.add(vm.addLocalObject(byteArray));
108
        list.add(vm.addLocalObject(null));
109
        Number number = module.callFunction(emulator, 0x21864, list.toArray());
110
        DvmObject<?> retObj = vm.getObject(number.intValue());
111
        byte[] resultBytes = (byte[]) retObj.getValue();
112
        String result = new String(resultBytes, StandardCharsets.UTF_8);
113
        System.out.println("结果: " + result);
114

115
    }
116

117
    public void decodeContent() {
118
        byte[] encryptedData = new byte[]{
119
                -10, 114, 76, 25, 44, -37, 100, 101, -124, -69, 64, -18, -101, -32, -119, 121, -125, -10, -36, 42, 125, 34, -68, -48, 102, 107, 91, 107, 88, -42, -125, -19, 69, -95, 90, -127, 56, -28, -108, -69, -101, -78, 1, -2, -70, -84, 12, -91, -106, 98, 27, 89, 71, -37, -87, -37, 71, 110, 111, -65, -22, 71, -16, 15, 111, -106, -30, -1, 8, 31, 46, -60, 38, -110, -21, 71, 126, 34, -16, 62, -106, -40, 16, -107, 2, 64, -65, -56, 71, -36, 85, 40, -3, 69, -71, -65, 24, -20, 4, 125, -114, -112, 126, 17, -28, -63, -100, 61, 58, -24, 6, -55, 87, -59, 124, -112, -26, 50, -41, 26, 25, -9, 33, -48, 80, 22, 46, -119, 112, 78, 5, 24, 96, -86, 36, 68, -71, -7, -90, -71, 111, 76, 87, 116, 56, -19, 2
120
        };
121
        ArrayList<Object> list = new ArrayList<>(10);
122
        list.add(vm.getJNIEnv());
123
        list.add(0);
124
        ByteArray dataArray = new ByteArray(vm, encryptedData);
125
        list.add(vm.addLocalObject(dataArray));
126

127
        list.add(null);
128
        list.add(0);
129
        list.add(1);
130
        list.add(0);
131
        Number number = module.callFunction(emulator, 0x24dc8, list.toArray());
132
        DvmObject<?> retObj = vm.getObject(number.intValue());
133
        byte[] resultBytes = (byte[]) retObj.getValue();
134
        String result = new String(resultBytes, StandardCharsets.UTF_8);
135
        System.out.println("解密结果: " + result);
136
    }
137

138
    // 3 main方法---》右键直接运行
139
    public static void main(String[] args) {
140
        YZWG yzwg = new YZWG();
141
        yzwg.get_sp();
142
        yzwg.get_sig();
143
        yzwg.decodeContent();
144
    }
145

146
    @Override
147
    public FileResult resolve(Emulator emulator, String pathname, int oflags) {
148
        System.out.println("pathname open:" + pathname);
149
        return null;
150
    }
151
}
152

153
// zwp_NCTRJTSwi3DewMDkHB6GvU2BAYbyceqJ44s9CxuyL65jv20XaVYg1XpFLNVaF7LolNJtanuLr-ARNMt36qI3RFO3xe8JyDZtt-TQVeh_TOtTgNw-LeFjEs8hx0tJoj7v9ncKmYZWKNui4mO4EMBKqCp54Wi6L8MQyX1JatkuDl9Ec4gZFqDhg7Z1SBl0Q5EvXDZ9Hpb4hZrrp1qpTkEGTjmODhup8HF6VZa0VcxsMFLprFD40lIaRNgU9G7mUIMTy2f0MKwht_lGzm2bw9GnXzCQyGB8Lr9XYvIqmMmmQ8DHWVid8LshMJ0kV52zxZ2rg44Dxcb_cjVfYQd3k5ucb_MgYgZLVJLM4QfkktgfBS3MfS4m3TyKtzi7q5zNIHc52z2fsjpoSrdhmQzh6Bu6-ZMzHJWJ_nbibMppOwVp0HgqJSYdAgYwSwgrTFyUbxw15pDCp830uxCbGNwcHSQjXxi2QgRWAPNLA5ueAa07KMmuMDBrn66vKAqzehxbIFtE4CcoTGstb34UnWCQZ9CHK-DZwfQSrZu_B5i2KIvvFqQG5Fq-ycwEKSZhUmhQJuvLzl5vd6wwh08SdOWSVXsdhHdJaBhEITwc3qRr9K--K8P1fbqdFwd92GQtBdMYqXao5TbaeXuTB0nPAKVcLm67Itr35_UjlCnqciQ_D1gHezlwHiz9xMIosw5DE4hmRLXi_2s6Qm-ohQH9ooezUsQlaPNOPcYqGYA7kqAwhU1qnbISOAhNHjNNCrD-KeWeWb1UJPyg1CE5GJ5KPfTztHGY6zfoJWP7ZKkxM9aOiLMEueJjsCVuE3BpE8h-EMCAeXo_4EXFkeLihAkaNhC9wsphUwZIIS6wTUNQ8yYBBw~~
154
// zwp_NCTRJTSwi3DewMDkHB6GvU2BAYbyceqJ44s9CxuyL65jv20XaVYg1XpFLNVaF7LolNJtanuLr-ARNMt36qI3RFO3xe8JyDZtt-TQVeh_TOtTgNw-LeFjEs8hx0tJoj7v9ncKmYZWKNui4mO4EMBKqCp54Wi6L8MQyX1JatkuDl9Ec4gZFqDhg7Z1SBl0Q5EvXDZ9Hpb4hZrrp1qpTkEGTjmODhup8HF6VZa0VcxsMFLprFD40lIaRNgU9G7mUIMTy2f0MKwht_lGzm2bw9GnXzCQyGB8Lr9XYvIqmMmmQ8DHWVid8LshMJ0kV52zxZ2rg44Dxcb_cjVfYQd3k5ucb_MgYgZLVJLM4QfkktgfBS3MfS4m3TyKtzi7q5zNIHc52z2fsjpoSrdhmQzh6Bu6-ZMzHJWJ_nbibMppOwVp0HgqJSYdAgYwSwgrTFyUbxw15pDCp830uxCbGNwcHSQjXxi2QgRWAPNLA5ueAa07KMmuMDBrn66vKAqzehxbIFtE4CcoTGstb34UnWCQZ9CHK-DZwfQSrZu_B5i2KIvvFqQG5Fq-ycwEKSZhUmhQJuvLzl5vd6wwh08SdOWSVXsdhHdJaBhEITwc3qRr9K--K8P1fbqdFwd92GQtBdMYqXao5TbaeXuTB0nPAKVcLm67Itr35_UjlCnqciQ_D1gHezlwHiz9xMIosw5DE4hmRLXi_2s6Qm-ohQH9ooezUsQlaPNOPcYqGYA7kqAwhU1qnbISOAhNHjNNCrD-KeWeWb1UJPyg1CE5GJ5KPfTztHGY6zfoJWP7ZKkxM9aOiLMEueJjsCVuE3BpE8h-EMCAeXo_4EXFkeLihAkaNhC9wsphUwZIIS6wTUNQ8yYBBw~~

1
public void traceCode() {
2
  String traceFile = "unidbg-android/src/test/java/com/boss/traceCode.log"; // 输出的路径
3
  PrintStream traceStream = null; // 打印流
4
  try {
5
    traceStream = new PrintStream(new FileOutputStream(traceFile), true);
6
  } catch (FileNotFoundException e) {
7
    throw new RuntimeException(e);
8
  }
9
  // traceCode 对代码进行监控
10
  emulator.traceCode(module.base, module.base + module.size).setRedirect(traceStream);
11
}