将代码添加到 smali 源

Question

我有一个相关来源的 smali 代码：

original_file.java:

package com.android.commands.locksettings;

import android.os.ResultReceiver;

import android.os.ServiceManager;

import android.os.ShellCallback;

import com.android.internal.os.BaseCommand;

import com.android.internal.widget.ILockSettings;

import java.io.FileDescriptor;

import java.io.PrintStream;

public final class LockSettingsCmd extends BaseCommand {

    private static final String USAGE =

            "usage: locksettings set-pattern [--old OLD_CREDENTIAL] NEW_PATTERN\n" +

            "       locksettings set-pin [--old OLD_CREDENTIAL] NEW_PIN\n" +

            "       locksettings set-password [--old OLD_CREDENTIAL] NEW_PASSWORD\n" +

            "       locksettings clear [--old OLD_CREDENTIAL]\n" +

            "\n" +

            "locksettings set-pattern: sets a pattern\n" +

            "    A pattern is specified by a non-separated list of numbers that index the cell\n" +

            "    on the pattern in a 1-based manner in left to right and top to bottom order,\n" +

            "    i.e. the top-left cell is indexed with 1, whereas the bottom-right cell\n" +

            "    is indexed with 9. Example: 1234\n" +

            "\n" +

            "locksettings set-pin: sets a PIN\n" +

            "\n" +

            "locksettings set-password: sets a password\n" +

            "\n" +

            "locksettings clear: clears the unlock credential\n";

    public static void main(String[] args) {

        (new LockSettingsCmd()).run(args);

    }

    @Override

    public void onShowUsage(PrintStream out) {

        out.println(USAGE);

    }

辑上面的 smali 文件并将代码添加到main函数中所以我在一个新的 java 文件中编写了相同的代码并将其编译为class文件，javac然后使用dx.jar将其转换为classes.dex并重新编译dex文件并获取 smali 代码注入但每次a 添加文件破解的代码并且永远不会工作。

Answer 1

当你编辑 smali 代码时，你应该小心处理寄存器。my_code的 main 方法有 5 个寄存器（即 4 个本地和 1 个参数），而original_file' 的 main 方法有 2 个寄存器（即 1 个本地和 1 个参数）。在添加my_codeto之前original_file，您应该决定需要多少寄存器。在这个例子中，5 个寄存器（即 4 个本地和 1 个参数）就足够了。最终main方法（没有.line和.param指令）：.method public static main([Ljava/lang/String;)V&nbsp; &nbsp; .registers 5&nbsp; &nbsp; .prologue&nbsp; &nbsp; array-length v1, p0&nbsp; &nbsp; const/4 v0, 0x0&nbsp; &nbsp; :goto_2&nbsp; &nbsp; if-ge v0, v1, :cond_e&nbsp; &nbsp; aget-object v2, p0, v0&nbsp; &nbsp; sget-object v3, Ljava/lang/System;->out:Ljava/io/PrintStream;&nbsp; &nbsp; invoke-virtual {v3, v2}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V&nbsp; &nbsp; add-int/lit8 v0, v0, 0x1&nbsp; &nbsp; goto :goto_2&nbsp; &nbsp; :cond_e&nbsp; &nbsp; new-instance v0, Lcom/android/commands/locksettings/LockSettingsCmd;&nbsp; &nbsp; invoke-direct {v0}, Lcom/android/commands/locksettings/LockSettingsCmd;-><init>()V&nbsp; &nbsp; invoke-virtual {v0, p0}, Lcom/android/commands/locksettings/LockSettingsCmd;->run([Ljava/lang/String;)V&nbsp; &nbsp; const/4 v0, 0x0&nbsp; &nbsp; invoke-virtual {v0, p0}, Ljava/io/PrintStream;->println(Ljava/lang/Object;)V&nbsp; &nbsp; return-void.end method