Android_smali_代码注入
//日志注入
const-string v8, "----->parameter1:"
invoke-static {v8, p1}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
//栈跟踪信息记录了程序从启动到printStackTrace()被执行期间所有被调用过的方法。
# virtual methods
.method public stack()V
.locals 2
.prologue
.line 20
new-instance v0, Ljava/lang/Exception;
const-string v1, "----->print trace"
invoke-direct {v0, v1}, Ljava/lang/Exception;-><init>(Ljava/lang/String;)V
invoke-virtual {v0}, Ljava/lang/Exception;->printStackTrace()V
.line 21
return-void
.end method
//转换string输出
//publicstaticvoid main(String[] args) {
// int number = 0;
// Log.i("----->", String.valueOf(number));
//}
.method public static main([Ljava/lang/String;)V
.locals 3
.parameter "args"
.prologue
.line 11
const/4 v0, 0x0
.line 12
.local v0, number:I
const-string v1, "----->"
invoke-static {v0}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;
move-result-object v2
invoke-static {v1, v2}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
.line 13
return-void
.end method
//byte数组转换字符串
# virtual methods
.method public byteToString([B)V
.locals 3
.parameter "paramArrayOfByte"
.prologue
:try_start_0
new-instance v1, Ljava/lang/String;
const-string v2, "UTF-8"
invoke-direct {v1, p1, v2}, Ljava/lang/String;-><init>([BLjava/lang/String;)V
.local v1, string:Ljava/lang/String;
const-string v2, "----->"
invoke-static {v2, v1}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
:try_end_0
.catch Ljava/io/UnsupportedEncodingException; {:try_start_0 .. :try_end_0} :catch_0
.end local v1 #string:Ljava/lang/String;
:goto_0
return-void
:catch_0
move-exception v0
.local v0, e:Ljava/io/UnsupportedEncodingException;
invoke-virtual {v0}, Ljava/io/UnsupportedEncodingException;->printStackTrace()V
goto :goto_0
.end method
//另一种byte数组转换字符串
new-instance v6, Ljava/lang/String;
invoke-direct {v6, v0}, Ljava/lang/String;-><init>([B)V
const-string v5, "----->d.smali_b([BIII)[B_return"
invoke-static {v5, v6}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
//JSON转字符串
//v0寄存器代表JSONObject
const-string v1, "-->json"
invoke-virtual {v0}, Lorg/json/JSONObject;->toString()Ljava/lang/String;
move-result-object v2
invoke-static {v1, v2}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
则是因为很多指令不能够使用大于15的寄存器，故应该加上“move-object/from16 v1, px”语句进行转换。
//调用对象的toString方法 输出
invoke-virtual {p0}, Lcom/huawei/appmarket/datasource/pojo/b;->toString()Ljava/lang/String;
move-result-object v3
const-string v2, "@@@@@>1a>pojo"
invoke-static {v2, v3}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
//Int转换string
const-string v1, "----->"
invoke-static {v0}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;
move-result-object v2
invoke-static {v1, v2}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
//for( : ) 遍历
.method public static main([Ljava/lang/String;)V
.locals 4
.parameter "args"
.prologue
.line 18
new-instance v0, Ljava/util/ArrayList;
invoke-direct {v0}, Ljava/util/ArrayList;-><init>()V
.line 19
.local v0, list:Ljava/util/List;,"Ljava/util/List<Ljava/lang/String;>;"
const-string v2, "a"
invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z
.line 20
const-string v2, "b"
invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z
.line 21
const-string v2, "c"
invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z
.line 22
const-string v2, "d"
invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z
.line 24
invoke-interface {v0}, Ljava/util/List;->iterator()Ljava/util/Iterator; #获取集合迭代器
move-result-object v2
:goto_0 #迭代循环开始
invoke-interface {v2}, Ljava/util/Iterator;->hasNext()Z #开始迭代
move-result v3
if-nez v3, :cond_0 #如果迭代器不为空就跳走
.line 27
return-void
.line 24
:cond_0
invoke-interface {v2}, Ljava/util/Iterator;->next()Ljava/lang/Object; #循环获取每一项
move-result-object v1
check-cast v1, Ljava/lang/String;
.line 25
.local v1, string:Ljava/lang/String;
sget-object v3, Ljava/lang/System;->out:Ljava/io/PrintStream;
invoke-virtual {v3, v1}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V
goto :goto_0 #跳转到循环开始处
.end method
//for (int i = 0; i < 10; i++) {
// System.out.println(i);
//}
.method public static main([Ljava/lang/String;)V
.locals 2
.parameter "args"
.prologue
.line 15
const/4 v0, 0x0
.local v0, i:I #初始化v0为0
:goto_0 #循环开始
const/16 v1, 0xa
if-lt v0, v1, :cond_0 #判断v0小于v1，则跳转到cond_0标号处
.line 18
return-void
.line 16
:cond_0
sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;
invoke-virtual {v1, v0}, Ljava/io/PrintStream;->println(I)V
.line 15
add-int/lit8 v0, v0, 0x1 #下一个索引
goto :goto_0 #跳转到循环起始处
.end method
int number = 1;
switch (number) {
case 0:
System.out.println(0);
break;
case 1:
System.out.println(1);
break;
case 2:
System.out.println(2);
break;
case 3:
System.out.println(3);
break;
default:
break;
}
.method public static main([Ljava/lang/String;)V
.locals 3
.parameter "args"
.prologue
.line 15
const/4 v0, 0x1
.line 16
.local v0, number:I
packed-switch v0, :pswitch_data_0 #packed-switch分支，pswitch_data_0指定case区域
.line 32
:goto_0 #所有case的出口
return-void
.line 18
:pswitch_0
sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;
const/4 v2, 0x0 #case 0
invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V
goto :goto_0 #跳转到goto_0标号处
.line 21
:pswitch_1
sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;
const/4 v2, 0x1 #case 1
invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V
goto :goto_0 #跳转到goto_0标号处
.line 24
:pswitch_2
sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;
const/4 v2, 0x2 #case 2
invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V
goto :goto_0 #跳转到goto_0标号处
.line 27
:pswitch_3
sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;
const/4 v2, 0x3 #case 3
invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V
goto :goto_0 #跳转到goto_0标号处
.line 16
nop
:pswitch_data_0
.packed-switch 0x0 #case区域，从0开始，依次递增
:pswitch_0
:pswitch_1
:pswitch_2
:pswitch_3
.end packed-switch
.end method
//写文件
publicvoid writeFileData(String fileName, String message) {
try {
FileOutputStream fout = openFileOutput(fileName, MODE_PRIVATE);
byte[] bytes = message.getBytes();
fout.write(bytes);
fout.close();
} catch (Exception e) {
e.printStackTrace();
}
}
---------------------------------------------------------------------------------------
//调用
const-string v0, "001.txt"
const-string v1, "test"
invoke-virtual {p0, v0, v1}, Lcom/example/writefiles/MainActivity;->writeFileData(Ljava/lang/String;Ljava/lang/String;)V
---------------------------------------------------------------------------------------
.method public writeFileData(Ljava/lang/String;Ljava/lang/String;)V
.locals 4
.parameter "fileName"
.parameter "message"
.prologue
.line 27
const/4 v3, 0x0
:try_start_0
invoke-virtual {p0, p1, v3}, Lcom/example/writefiles/MainActivity;->openFileOutput(Ljava/lang/String;I)Ljava/io/FileOutputStream;
move-result-object v2
.line 28
.local v2, fout:Ljava/io/FileOutputStream;
invoke-virtual {p2}, Ljava/lang/String;->getBytes()[B
move-result-object v0
.line 29
.local v0, bytes:[B
invoke-virtual {v2, v0}, Ljava/io/FileOutputStream;->write([B)V
.line 30
invoke-virtual {v2}, Ljava/io/FileOutputStream;->close()V
:try_end_0
.catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0
.line 34
.end local v0 #bytes:[B
.end local v2 #fout:Ljava/io/FileOutputStream;
:goto_0
return-void
.line 31
:catch_0
move-exception v1
.line 32
.local v1, e:Ljava/lang/Exception;
invoke-virtual {v1}, Ljava/lang/Exception;->printStackTrace()V
goto :goto_0
.end method
