def getClsObj(ref, refFile, refOff, fDict, addr, off): ret=[] [name, classFlag, primType, ifields_,methods_, sfields_, dexCache, objSize, refSize, super_class_] = cls.getClassMembers(ref, refFile, refOff, mapList) ret.append("Number of Reference Instance Fields = "+str(refSize)) #print " PrimType "+primType +classFlag if(name and name.startswith('[')): arrData=[] addr.seek(off+8) length_ = unpack_dec(addr.read(4))[0] ret.append("length "+str(length_)) [arrData, length_] = checkArray(name,length_, addr, arrData) objSize = 8+4+length_ ret.append("Object Size " + str(objSize)) ret.append("The array data for "+name +" is " +str(arrData)) addr.close() elif(name == "java.lang.String"):#&& Its a string prettyName='' addr.seek(off+8) count = unpack_dec(addr.read(4))[0] l = count >> 1 if l >65536: l=0 if (l >0): addr.seek(addr.tell()+4) prettyName = addr.read(l) ret.append("The data for "+name +" is " +prettyName) else: ret.append("Null String") #print art.getStringClass(off, addr) addr.close() objSize = 8+4+4+l elif(name):#&& classFlag==kClassFlagNormal if(super_class_ and name !="java.lang.Object"): getSuperClass(super_class_,fDict, ret) if ifields_!="0x0": fields = fld.getFields(ifields_, mapList) for key, values in fields.items(): fieldIdx = values[2] cl,type ,name1 = dx.getMeta(dexCache,fieldIdx,mapList, memList) #print "FieldName - "+name+ " - "+type+" offset "+str(values[3]) fDict[values[3]] = [name1,type] if (classFlag=="kClassFlagClass"): ret.append("Is ClassClass "+name) [buf,objSize, sFields, dexCache] = fld.getValueClass(fDict, addr, off) ret.append("Class Size " + str(objSize)) ret.append('\n'.join(buf)) else: ret.append(name+" "+classFlag) #+" "+ primType #+" "+ ifields_+" "+ methods_+" "+ sfields_+" "+ dexCache ret.append("Object Size " + str(objSize)) if fDict: r = fld.getValue(fDict, addr, off) [ret.append(i) for i in r] else: ret.append("No Instance Fields for the object") else: ret.append("Object is either null or cannot be dereferenced") objSize=8 return objSize, ret
def getClsObj(ref, refFile, refOff, fDict, addr, off): [ name, classFlag, primType, ifields_, methods_, sfields_, dexCache, objSize, refSize, super_class_ ] = cls.getClassMembers(ref, refFile, refOff, mapList) oSize = objSize if (name and name.startswith('[')): arrData = [] addr.seek(off + 8) length_ = struct.unpack("<i", addr.read(4))[0] [arrData, length_] = checkArray(name, length_, addr, arrData) oSize = 8 + 4 + length_ #print "Object Size " + str(objSize) #print "The array data for "+name +" is " +str(arrData) elif (name == "java.lang.String"): #&& Its a string prettyName = '' addr.seek(off + 8) count = struct.unpack("<i", addr.read(4))[0] l = count >> 1 oSize = 8 + 4 + 4 + l elif (name and classFlag == "kClassFlagClass"): if ifields_ != "0x0": fields = fld.getFields(dexCache, ifields_, mapList) for key, values in fields.items(): fieldIdx = values[2] cl, type, name1 = dx.getMeta(dexCache, fieldIdx, mapList, memList) #print "FieldName - "+name+ " - "+type+" offset "+str(values[3]) fDict[values[3]] = [name1, type] [buf, s] = fld.getValueClass(fDict, addr, off) oSize = int(s) return [name, oSize]
def resolveKlass(buf, dexCache, mapList, memList): addr = buf[23] addr = addr.rsplit(" ")[-1] addr = hex(int(addr, 10)) fields = fld.getFields(dexCache, mapList) print fields for key, values in fields.items(): fieldIdx = values[2] cl, type, name1 = dx.getMeta(dexCache, fieldIdx, mapList, memList) print "FieldName - " + name + " - " + type + " offset " + str( values[3])
def getSuperClass(super_class_,fDict, ret): superC = True while superC: [sPath, sOffset] = art.getOffset(super_class_, mapList) sAddr = art.getFhandle(sPath) [name, classFlag, primType, ifields_,methods_, sfields_, dexCache, objSize, refSize, super_class_] = cls.getClassMembers(super_class_, sAddr, sOffset, mapList) sAddr.close() if (name =="java.lang.Object" or super_class_ == None): superC = False elif ifields_!="0x0": ret.append("Super Class Offset " + name) fields = fld.getFields(ifields_, mapList) for key, values in fields.items(): fieldIdx = values[2] cl,type ,name = dx.getMeta(dexCache,fieldIdx,mapList, memList) fDict[values[3]] = [name,type]
def getClsObj(ref, refFile, refOff, fDict, addr, off): [ name, classFlag, primType, ifields_, methods_, sfields_, dexCache, objSize, refSize, super_class_ ] = cls.getClassMembers(ref, refFile, refOff, mapList) oSize = objSize if name == None: oSize = 8 elif (name and name.startswith('[')): arrData = [] addr.seek(off + 8) length_ = unpack_dec(addr.read(4))[0] [arrData, length_] = checkArray(name, length_, addr, arrData) oSize = 8 + 4 + length_ #print "Object Size " + str(objSize) #print "The array data for "+name +" is " +str(arrData) elif (name == "java.lang.String"): #&& Its a string prettyName = '' addr.seek(off + 8) count = unpack_dec(addr.read(4))[0] l = count >> 1 if l > 65536: l = 0 oSize = 8 + 4 + 4 + l elif (name): fSize = 0 if (classFlag == "kClassFlagClass" and ifields_ != "0x0"): fields = fld.getFieldsIdx(ifields_, mapList) for key, value in sorted(fields.items()): fieldIdx = value cl, type, name1 = dx.getMeta(dexCache, fieldIdx, mapList, memList) #print "FieldName - "+name+ " - "+type+" offset "+str(values[3]) fDict[key] = [name1, type] [buf, s, sFields, cDexCache] = fld.getValueClass(fDict, addr, off) #resolveKlass() #print sFields oSize = int(s) if sFields and (sFields != "0x0"): sDict = OrderedDict() sDict = fld.getFieldsIdx(sFields, mapList) offsets_ = sorted(sDict.keys()) cl, type, sfName = dx.getMeta(cDexCache, sDict.get(offsets_[-1]), mapList, memList) fSize = getSize(type) + offsets_[-1] - offsets_[0] #[sDict.keys()[-1] for key, value in sorted(sDict.items())] #for key, value in sorted(sDict.items()): # cl,type ,sfName = dx.getMeta(cDexCache,value,mapList, memList) # fSize +=getSize(type) #print fSize #print "FieldName - "+name+ " - "+type+" offset "+str(values[3]) +" "+cl #sDict[values[3]] = [name,type] #if sDict: #fld.getValue(sDict, addr, off) #else: #print "No Static Fields for the object" #if not "-3" in buf[45]: # resolveKlass(buf, dexCache, mapList, memList) oSize = oSize + fSize + 4 oSize = 32 * (int(oSize / 32) + (oSize % 32 > 0)) return [name, oSize]