1
package com.xhs;
2

3
import com.github.unidbg.AndroidEmulator;
4
import com.github.unidbg.Emulator;
5
import com.github.unidbg.Module;
6
import com.github.unidbg.file.FileResult;
7
import com.github.unidbg.file.IOResolver;
8
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
9
import com.github.unidbg.linux.android.AndroidResolver;
10
import com.github.unidbg.linux.android.dvm.AbstractJni;
11
import com.github.unidbg.linux.android.dvm.BaseVM;
12
import com.github.unidbg.linux.android.dvm.DalvikModule;
13
import com.github.unidbg.linux.android.dvm.DvmClass;
14
import com.github.unidbg.linux.android.dvm.VaList;
15
import com.github.unidbg.linux.android.dvm.VM;
16
import com.github.unidbg.memory.Memory;
17
import com.github.unidbg.hook.hookzz.HookZz;
18
import com.github.unidbg.hook.hookzz.IHookZz;
19
import com.github.unidbg.hook.hookzz.HookEntryInfo;
20
import com.github.unidbg.arm.context.RegisterContext;
21

22
import java.io.File;
23

24
public class Shield extends AbstractJni implements IOResolver {
25

26
    // ========== 每次新项目只改这里 ==========
27

28
    // 模拟器位数：so在armeabi-v7a目录下填false，arm64-v8a目录下填true
29
    private static final boolean IS_64BIT         = false;
30

31
    // app包名（随意，一般填真实包名）
32
    private static final String  PROCESS_NAME     = "com.xingin.xhs";
33

34
    // apk路径，不需要apk时填null（填null时LOAD_BY_NAME必须为false）
35
    private static final String  APK_PATH         = "apks/xhs/xhs.apk";
36

37
    // so加载方式：
38
    //   false = 传文件路径（用SO_PATH），不依赖apk，最常用
39
    //   true  = 传库名（用SO_NAME），unidbg自动去apk内查找，必须提供APK_PATH
40
    private static final boolean LOAD_BY_NAME     = true;
41
    private static final String  SO_PATH          = ""; // LOAD_BY_NAME=false时生效
42
    private static final String  SO_NAME          = "xyass";                // LOAD_BY_NAME=true时生效，不带lib前缀和.so后缀
43

44

45
    // 是否打印JNI调用细节，调试时改true
46
    private static final boolean VERBOSE          = true;
47

48

49
    // ========================================
50

51
    public static AndroidEmulator emulator;
52
    public static Memory memory;
53
    public static VM vm;
54
    public static Module module;
55

56
    // 1. 构造方法 —— 初始化模拟器
57
    public Shield() {
58

59
        // 1. 创建模拟器（32/64位由IS_64BIT控制）
60
        emulator = IS_64BIT
61
                ? AndroidEmulatorBuilder.for64Bit().setProcessName(PROCESS_NAME).build()
62
                : AndroidEmulatorBuilder.for32Bit().setProcessName(PROCESS_NAME).build();
63

64
        // 2. 获取内存对象
65
        memory = emulator.getMemory();
66

67
        // 3. 设置安卓SDK版本（只支持19、23）
68
        memory.setLibraryResolver(new AndroidResolver(23));
69

70
        // 4. 创建虚拟机
71
        vm = APK_PATH != null
72
                ? emulator.createDalvikVM(new File(APK_PATH))
73
                : emulator.createDalvikVM();
74
        vm.setJni(this);
75
        vm.setVerbose(VERBOSE);
76

77
        // 5. 加载so文件（两种方式由LOAD_BY_NAME控制）
78
        DalvikModule dm = LOAD_BY_NAME
79
                ? vm.loadLibrary(SO_NAME, false)
80
                : vm.loadLibrary(new File(SO_PATH), false);
81

82
        // 6. 动态注册才需要执行JNI_OnLoad
83
        dm.callJNI_OnLoad(emulator);
84

85
        // 7. 获取module对象（后续拿基址、偏移等）
86
        module = dm.getModule();
87

88
    }
89

90

91

92

93

94
    // 5. main方法 —— 右键直接运行
95
    public static void main(String[] args) {
96
        Shield shield = new Shield();
97
    }
98

99
    @Override
100
    public FileResult resolve(Emulator emulator, String pathname, int oflags) {
101
        System.out.println("pathname:" + pathname);
102
        return null;
103
    }
104
}

1
public void initializeNative(){
2
  Native.callStaticJniMethodObject(emulator,"initializeNative()V");
3
}

1
@Override
2
public void callStaticVoidMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
3
  switch (signature){
4
    case "com/xingin/shield/http/ContextHolder->writeLog(I)V":{
5
      return;
6
    }
7
  }
8
  super.callStaticVoidMethodV(vm, dvmClass, signature, vaList);
9
}

1
java.lang.UnsupportedOperationException: java/nio/charset/Charset->defaultCharset()Ljava/nio/charset/Charset;
2
  at com.github.unidbg.linux.android.dvm.AbstractJni.callStaticObjectMethodV(AbstractJni.java:504)
3
  at com.github.unidbg.linux.android.dvm.AbstractJni.callStaticObjectMethodV(AbstractJni.java:438)
4
  at com.github.unidbg.linux.android.dvm.DvmMethod.callStaticObjectMethodV(DvmMethod.java:59)
5
  at com.github.unidbg.linux.android.dvm.DalvikVM$113.handle(DalvikVM.java:1816)

1
@Override
2
public DvmObject<?> callStaticObjectMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
3
   switch (signature){
4
     case "java/nio/charset/Charset->defaultCharset()Ljava/nio/charset/Charset;":{
5
       return dvmClass.newObject(Charset.defaultCharset());
6
     }
7
   }
8
   return super.callStaticObjectMethodV(vm, dvmClass, signature, vaList);
9
}

1
Java.perform(function () {
2
    var ContextHolder = Java.use("com.xingin.shield.http.ContextHolder");
3
    var sDeviceId = ContextHolder.sDeviceId.value;
4
    console.log("sDeviceId: " + sDeviceId);
5
});

1
Java.perform(function () {
2
    var Native = Java.use("com.xingin.shield.http.Native");
3

4
    Native["initializeNative"].implementation = function () {
5
        console.log(`Native.initializeNative is called`);
6
        this["initializeNative"]();
7
    };
8
    Native["initialize"].implementation = function (str) {
9
        console.log(`Native.initialize is called: str=${str}`);
10
        let result = this["initialize"](str);
11
        console.log(`Native.initialize result=${result}`);
12
        return result;
13
    };
14
});

1
public void initialize(){
2
  cPtr = Native.callStaticJniMethodLong(emulator,"initialize(Ljava/lang/String;)J","main");
3
  System.out.println(cPtr);
4
}

1
@Override
2
public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
3
  switch (signature){
4
    case "android/content/Context->getSharedPreferences(Ljava/lang/String;I)Landroid/content/SharedPreferences;":{
5
      return vm.resolveClass("android/content/SharedPreferences").newObject(vaList.getObjectArg(0).getValue().toString());
6
    }
7
  }
8
  return super.callObjectMethodV(vm, dvmObject, signature, vaList);
9
}

1
case "android/content/SharedPreferences->getString(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;":{
2
  String xml_val = dvmObject.getValue().toString();
3
  System.out.println(xml_val);
4
  String key = vaList.getObjectArg(0).getValue().toString();
5
  System.out.println(key);
6
  if (key.equals("main_hmac")){
7
    return new StringObject(vm,"2VQ6BnkUxADf9jksuKER+rbqJJY6PIBjsMZqYUjXbrMHFF4BaKzHFHGyEWwuBlQW3j8klUI5ZctIAokjwtQlsOih+FWRnUQ17kd6C8oar90n8PQ+Bg+iWsShB88kb9+K");
8
  }
9

10
}

1
case "com/xingin/shield/http/Base64Helper->decode(Ljava/lang/String;)[B":{
2
  String input = vaList.getObjectArg(0).getValue().toString();
3
  return new ByteArray(vm, Base64.decodeBase64(input));
4
}

1
public void intercept(){
2
  DvmObject<?> chain = vm.resolveClass("okhttp3/Interceptor$Chain").newObject(null);
3
Native.callStaticJniMethodObject(emulator,"intercept(Lokhttp3/Interceptor$Chain;J)Lokhttp3/Response;",chain,cPtr).getValue().toString();
4
}

1
case "okhttp3/Interceptor$Chain->request()Lokhttp3/Request;":{
2
  return vm.resolveClass("okhttp3/Request").newObject(request);
3
}

1
java.lang.UnsupportedOperationException: okhttp3/Request->url()Lokhttp3/HttpUrl;
2
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:417)
3
  at com.xhs.Shield.callObjectMethodV(Shield.java:175)
4
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:262)
5
  at com.github.unidbg.linux.android.dvm.DvmMethod.callObjectMethodV(DvmMethod.java:89)

1
case "okhttp3/Request->url()Lokhttp3/HttpUrl;":{
2
  return vm.resolveClass("okhttp3/HttpUrl").newObject(request.url());
3
}

1
case "okhttp3/HttpUrl->encodedPath()Ljava/lang/String;":{
2
   HttpUrl httpUrl = (HttpUrl)dvmObject.getValue();
3
   return new StringObject(vm,httpUrl.encodedPath());
4
}

1
case "okhttp3/HttpUrl->encodedQuery()Ljava/lang/String;":{
2
  HttpUrl httpUrl = (HttpUrl)dvmObject.getValue();
3
  return new StringObject(vm,httpUrl.encodedQuery());
4
}

1
case "okhttp3/Request->body()Lokhttp3/RequestBody;":{
2
  return vm.resolveClass("okhttp3/RequestBody").newObject(request.body());
3
}

1
case "okhttp3/Request->headers()Lokhttp3/Headers;":{
2
  return vm.resolveClass("okhttp3/Headers").newObject(request.headers());
3
}

1
@Override
2
public DvmObject<?> newObjectV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
3
   switch (signature){
4
     case "okio/Buffer-><init>()V":{
5
       return dvmClass.newObject(new Buffer());
6
     }
7
   }
8
   return super.newObjectV(vm, dvmClass, signature, vaList);
9
}

1
case "okio/Buffer->writeString(Ljava/lang/String;Ljava/nio/charset/Charset;)Lokio/Buffer;":{
2
  Buffer buffer = (Buffer)dvmObject.getValue();
3
  buffer.writeString(vaList.getObjectArg(0).getValue().toString(),(Charset) vaList.getObjectArg(1).getValue());
4
  return vm.resolveClass("okio/Buffer").newObject(buffer);
5
}

1
@Override
2
public int callIntMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
3
  switch (signature){
4
    case "okhttp3/Headers->size()I":{
5
      Headers headers = (Headers)dvmObject.getValue();
6
      return headers.size();
7
    }
8
  }
9
  return super.callIntMethodV(vm, dvmObject, signature, vaList);
10
}

1
java.lang.UnsupportedOperationException: okhttp3/Headers->name(I)Ljava/lang/String;
2
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:417)
3
  at com.xhs.Shield.callObjectMethodV(Shield.java:200)
4
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:262)
5
  at com.github.unidbg.linux.android.dvm.DvmMethod.callObjectMethodV(DvmMethod.java:89)

1
case "okhttp3/Headers->name(I)Ljava/lang/String;":{
2
  Headers headers = (Headers)dvmObject.getValue();
3
  return new StringObject(vm,headers.name(vaList.getIntArg(0)));
4
}

1
case "okhttp3/Headers->value(I)Ljava/lang/String;":{
2
   Headers headers = (Headers)dvmObject.getValue();
3
   return new StringObject(vm,headers.value(vaList.getIntArg(0)));
4
}

1
@Override
2
public void callVoidMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
3
  switch (signature){
4
    case "okhttp3/RequestBody->writeTo(Lokio/BufferedSink;)V":{
5
      RequestBody requestBody = (RequestBody)dvmObject.getValue();
6
      BufferedSink bufferedSink = (BufferedSink)vaList.getObjectArg(0).getValue();
7
      if (requestBody!=null){
8
        try {
9
          requestBody.writeTo(bufferedSink);
10
        } catch (IOException e) {
11
          e.printStackTrace();
12
        }
13
      }
14
      return;
15
    }
16
  }
17
  super.callVoidMethodV(vm, dvmObject, signature, vaList);
18
}

1
java.lang.UnsupportedOperationException: okio/Buffer->clone()Lokio/Buffer;
2
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:417)
3
  at com.xhs.Shield.callObjectMethodV(Shield.java:211)
4
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:262)
5
  at com.github.unidbg.linux.android.dvm.DvmMethod.callObjectMethodV(DvmMethod.java:89)

1
case "okio/Buffer->clone()Lokio/Buffer;":{
2
  Buffer buffer = (Buffer)dvmObject.getValue();
3
  return vm.resolveClass("okio/Buffer").newObject(buffer.clone());
4
}

1
case "okio/Buffer->read([B)I":{
2
  Buffer buffer = (Buffer)dvmObject.getValue();
3
  return buffer.read((byte[]) vaList.getObjectArg(0).getValue());
4
}

1
java.lang.UnsupportedOperationException: okhttp3/Request->newBuilder()Lokhttp3/Request$Builder;
2
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:417)
3
  at com.xhs.Shield.callObjectMethodV(Shield.java:215)
4
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:262)
5
  at com.github.unidbg.linux.android.dvm.DvmMethod.callObjectMethodV(DvmMethod.java:89)

1
case "okhttp3/Request->newBuilder()Lokhttp3/Request$Builder;":{
2
  Request request = (Request) dvmObject.getValue();
3
  return vm.resolveClass("okhttp3/Request$Builder").newObject(request.newBuilder());
4
}

1
case "okhttp3/Request$Builder->header(Ljava/lang/String;Ljava/lang/String;)Lokhttp3/Request$Builder;":{
2
  Request.Builder builder = (Request.Builder)dvmObject.getValue();
3
  String key = vaList.getObjectArg(0).getValue().toString();
4
  String value = vaList.getObjectArg(1).getValue().toString();
5
  return vm.resolveClass("okhttp3/Request$Builder").newObject(builder.header(key,value));
6
}

1
java.lang.UnsupportedOperationException: okhttp3/Request$Builder->build()Lokhttp3/Request;
2
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:417)
3
  at com.xhs.Shield.callObjectMethodV(Shield.java:225)
4
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:262)
5
  at com.github.unidbg.linux.android.dvm.DvmMethod.callObjectMethodV(DvmMethod.java:89)

1
case "okhttp3/Request$Builder->build()Lokhttp3/Request;":{
2
  Request.Builder builder = (Request.Builder)dvmObject.getValue();
3
  request = builder.build();
4
  return vm.resolveClass("okhttp3/Request$Builder").newObject(request);
5
}

1
java.lang.UnsupportedOperationException: okhttp3/Interceptor$Chain->proceed(Lokhttp3/Request;)Lokhttp3/Response;
2
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:417)
3
  at com.xhs.Shield.callObjectMethodV(Shield.java:229)
4
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:262)
5
  at com.github.unidbg.linux.android.dvm.DvmMethod.callObjectMethodV(DvmMethod.java:89)

1
case "okhttp3/Interceptor$Chain->proceed(Lokhttp3/Request;)Lokhttp3/Response;":{
2
  return vm.resolveClass("okhttp3/Response").newObject(null);
3
}

1
java.lang.UnsupportedOperationException: okhttp3/Response->code()I
2
  at com.github.unidbg.linux.android.dvm.AbstractJni.callIntMethodV(AbstractJni.java:563)
3
  at com.xhs.Shield.callIntMethodV(Shield.java:254)
4
  at com.github.unidbg.linux.android.dvm.AbstractJni.callIntMethodV(AbstractJni.java:529)
5
  at com.github.unidbg.linux.android.dvm.DvmMethod.callIntMethodV(DvmMethod.java:109)

1
case "okhttp3/Response->code()I":{
2
  return 200;
3
}