def getName(sIdsOff, mapList, nameIdx, beginOff): [strHandle, strIdxOdd] = art.fromPointer(sIdsOff, mapList) strHandle.seek(strIdxOdd + 4 * nameIdx) strDataItemOff = unpack_dec(strHandle.read(4))[0] [bHandle, bOdd] = art.fromPointer(beginOff, mapList) strHandle.close() return uleb128_decode(bOdd + strDataItemOff, bHandle)
def getDex(dexCache, mapList): [g, offset] = art.fromPointer(dexCache, mapList) dexFileIdx = art.getIndex("DexCache", "dex_file_") g.seek(offset + dexFileIdx) dexFile = hex(struct.unpack("<Q", g.read(8))[0]) #print "dexFile "+dexFile loc_ = art.getIndex("DexCache", "location_") g.seek(offset + loc_) loc = hex(struct.unpack("<I", g.read(4))[0]) [g, offset] = art.fromPointer(loc, mapList) #print "DexFile Location "+art.getStringClass(offset, g) return dexFile
def getDex(dexCache, mapList): [g, offset] = art.fromPointer(dexCache, mapList) dexFileIdx = get_index("DexCache", "dex_file_") g.seek(offset + dexFileIdx) dexFile = hex(unpack_ulong(g)) #print "dexFile "+dexFile loc_ = get_index("DexCache", "location_") g.seek(offset + loc_) loc = hex(unpack_uint(g)) g.close() [g, offset] = art.fromPointer(loc, mapList) #print "DexFile Location "+art.getStringClass(offset, g) g.close() return dexFile
def getFields(ifields_, mapList): fields = OrderedDict() [g, objOff] = art.fromPointer(ifields_, mapList) g.seek(objOff) size = unpack_int(g) counter = 0 declaring_class_index = get_index("Field", "declaring_class_") access_flags_index = get_index("Field", "access_flags_") dex_field_index = get_index("Field", "dex_field_index_") offset_index = get_index("Field", "offset_") while counter < size: #declaring_class_ = hex(struct.unpack("<I", g.read(4))[0]) declaring_class_ = hex(unpack_uint(g)) access_flags_ = unpack_int(g) dex_field_index_ = unpack_int(g) offset_ = unpack_int(g) fields.update({ counter: [ cls.resolveName(declaring_class_, mapList), access_flags_, dex_field_index_, offset_ ] }) counter += 1 g.close() return fields
def getOwner(monitor): [g, objOff] = art.fromPointer(monitor, mapList) index = get_index('Monitor', 'obj_') g.seek(objOff + index) ret = hex(unpack_uint(g)) g.close() return ret
def getIdx(Idxs, idx, dexFile, memList): idsOff = hex(int(dexFile, 16) + Idxs) [g, offset] = art.fromPointer(idsOff, memList) g.seek(offset + idx) id = hex(idx + int(idsOff, 16)) g.close() return id
def getStringArray(arrSize, i, arrData): #Needs to fix while (arrSize > 0): strPointer = hex(struct.unpack("<I", i.read(4))[0]) [j, strOff] = art.fromPointer(strPointer, mapList) if j: arrData.append(art.getStringClass(strOff, j)) arrSize = arrSize - 1 return arrData
def getType(tIdsOff, mapList, typeIdx, beginOff, sIdsOff, clsIdx): [tHandle, tIdxOdd] = art.fromPointer(tIdsOff, mapList) tHandle.seek(tIdxOdd + (4 * typeIdx)) descIdx_T = struct.unpack("<i", tHandle.read(4))[0] type = getName(sIdsOff, mapList, descIdx_T, beginOff) tHandle.seek(tIdxOdd + (4 * clsIdx)) descIdx_C = struct.unpack("<i", tHandle.read(4))[0] cls = getName(sIdsOff, mapList, descIdx_C, beginOff) return [type, cls]
def getOKlass(reference, mapList): [g, objOff] = art.fromPointer(reference, mapList) if g == None: return ['0x0','0x0', None, objOff] else: g.seek(objOff) klass = hex(unpack_uint(g)) monitor = hex(unpack_uint(g)) return [klass,monitor, g, objOff]
def getFieldIdx(fIdsOff, dex_field_index_, mapList): [g, offset] = art.fromPointer(fIdsOff, mapList) g.seek(offset + (8 * dex_field_index_)) clsIdx = struct.unpack("<H", g.read(2))[0] typeIdx = struct.unpack("<H", g.read(2))[0] nameIdx = struct.unpack("<i", g.read(4))[0] #typeAddr = hex(int(fIdsOff,16)+dex_field_index_+ art.getIndex("FieldId","type_idx_")) #nameAddr = hex(int(fIdsOff,16)+dex_field_index_+ art.getIndex("FieldId","name_idx_")) return [clsIdx, typeIdx, nameIdx]
def getNamePointer(klass, mapList): nameOff = art.getIndex('Class_Obj', 'name_') [k, clOff] = art.fromPointer(klass, mapList) if k != None: k.seek(clOff+nameOff) nameOff = hex(struct.unpack("<I", k.read(4))[0]) return nameOff else: return "0x0"
def getOKlass(reference, mapList): [g, objOff] = art.fromPointer(reference, mapList) if g == None: return ['0x0','0x0', None, objOff] else: g.seek(objOff) klass = hex(struct.unpack("<I", g.read(4))[0]) monitor = hex(struct.unpack("<I", g.read(4))[0]) return [klass,monitor, g, objOff]
def getFieldIdx(fIdsOff, dex_field_index_, mapList): [g, offset] = art.fromPointer(fIdsOff, mapList) g.seek(offset + (8 * dex_field_index_)) clsIdx = unpack_ushort(g) typeIdx = unpack_ushort(g) nameIdx = unpack_int(g) #typeAddr = hex(int(fIdsOff,16)+dex_field_index_+ get_index("FieldId","type_idx_")) #nameAddr = hex(int(fIdsOff,16)+dex_field_index_+ get_index("FieldId","name_idx_")) g.close() return [clsIdx, typeIdx, nameIdx]
def getMeta(dexCache, dex_field_index_, mapList, memList): dexFile = getDex(dexCache, mapList) [dexHandle, dexOffset] = art.fromPointer(dexFile, memList) [beginOff, sIdsOff, fIdsOff, mIdsOff, tIdsOff] = getIds(dexHandle, dexOffset) [clsIdx, typeIdx, nameIdx] = getFieldIdx(fIdsOff, dex_field_index_, mapList) name = getName(sIdsOff, mapList, nameIdx, beginOff) [type, cls] = getType(tIdsOff, mapList, typeIdx, beginOff, sIdsOff, clsIdx) return [cls, type, name]
def resolveName(klass, mapList): name ='Cannot Be Resolved' nameOff = getNamePointer(klass, mapList) if (int(nameOff, 16)> 0): [i, strOff] = art.fromPointer(nameOff, mapList) if i == None: name ='Cannot Be Resolved' else: name = art.getStringClass(strOff, i) return name
def getType(tIdsOff, mapList, typeIdx, beginOff, sIdsOff, clsIdx): [tHandle, tIdxOdd] = art.fromPointer(tIdsOff, mapList) tHandle.seek(tIdxOdd + (4 * typeIdx)) descIdx_T = unpack_int(tHandle) type = getName(sIdsOff, mapList, descIdx_T, beginOff) tHandle.seek(tIdxOdd + (4 * clsIdx)) descIdx_C = unpack_int(tHandle) cls = getName(sIdsOff, mapList, descIdx_C, beginOff) tHandle.close() return [type, cls]
def getNamePointer(klass, mapList): nameOff = get_index('Class', 'name_') [k, clOff] = art.fromPointer(klass, mapList) if k != None: k.seek(clOff+nameOff) nameOff = hex(unpack_uint(k)) k.close() return nameOff else: return "0x0"
def getStringArray(arrSize, i, arrData): #Needs to fix while (arrSize > 0): strPointer = hex(unpack_int(i.read(4))[0]) if strPointer != "0x0": [j, strOff] = art.fromPointer(strPointer, mapList) if j: arrData.append(art.getStringClass(strOff, j)) j.close() arrSize = arrSize - 1 return arrData
def getFields(dexCache, ifields_, mapList): fields= OrderedDict() [g, objOff] = art.fromPointer(ifields_, mapList) g.seek(objOff) size = struct.unpack("<i", g.read(4))[0] counter=1; while counter<=size: declaring_class_ = hex(struct.unpack("<I", g.read(4))[0]) access_flags_ = struct.unpack("<i", g.read(4))[0] dex_field_index_ = struct.unpack("<i", g.read(4))[0] offset_ =struct.unpack("<i", g.read(4))[0] fields[counter] = [cls.resolveName(declaring_class_, mapList),access_flags_,dex_field_index_,offset_] counter+=1 return fields
def getFieldsIdx(ifields_, mapList): fields = OrderedDict() [g, objOff] = art.fromPointer(ifields_, mapList) g.seek(objOff) size = struct.unpack("<i", g.read(4))[0] counter = 0 while counter < size: #declaring_class_ = hex(struct.unpack("<I", g.read(4))[0]) hex(unpack_int(g.read(4))[0]) unpack_dec(g.read(4))[0] dex_field_index_ = unpack_dec(g.read(4))[0] offset_ = unpack_dec(g.read(4))[0] fields.update({offset_: dex_field_index_}) counter += 1 g.close() return fields
def getOwner(monitor): [g, objOff] = art.fromPointer(monitor, mapList) g.seek(objOff + 68) return hex(struct.unpack("<I", g.read(4))[0])
def getOwner(monitor): [g, objOff] = art.fromPointer(monitor, mapList) g.seek(objOff + 68) return hex(unpack_int(g.read(4))[0])