Android smali逆向還原練習(xí)之switch case

一、背景
熟悉VC編譯器的朋友，對(duì)switch case匯編代碼不會(huì)感到陌生。
switch case 代碼基本分位3類：
1、case分支小于等于3,數(shù)值連續(xù)。編譯器生成的匯編代碼，直接用 cmp [ebp+var_4], 0 jz short loc_401042之類指令代替
2、case分支大于3小于等于256。編譯器會(huì)生成一張或者兩張table表，case分支通過(guò)查表找到代碼地址
2、case分支大于3，數(shù)值很離散。編譯器會(huì)用平衡樹的結(jié)構(gòu)，即生成的代碼邏輯上構(gòu)成一顆平衡樹。

二、研究目的
Android apk軟件的逆向，一般的主戰(zhàn)場(chǎng)仍然在java層，有反調(diào)試和加固的apk除外。在jeb、jadx、jd-gui工具橫行的今天，很多時(shí)候我們不需要熟悉smali源碼，直接使用工具反中間碼為java源碼就OK了。那還分析smali干嘛呢？

熟悉smali中間代碼主要意義如下：
1、在動(dòng)態(tài)調(diào)試smali代碼時(shí)會(huì)比較有幫助
2、工具不管用情況下，需要靜態(tài)分析手工還原smali代碼為java代碼，會(huì)大大提高還原效率。
3、給了我們一個(gè)窺探j(luò)ava 語(yǔ)法設(shè)計(jì)原理的方法

三、這里只分析編譯器會(huì)生成table的情形

含有table表的switch case中間碼分兩種類型：
sparse-switch 和 packed-switch
它們兩的區(qū)別：
A packed-switch uses a simple jump table, indexed by the form low + n, where low is the lowest test value among the case labels, and n is the input to the switch. The values at each index represent the bytecode offsets for each case. Finding the correct jump address is a constant-time operation.
packed-switch 簡(jiǎn)單實(shí)用跳表，實(shí)際上就是一個(gè)數(shù)組，數(shù)值元素是地址值。跳表索引值 = base值(low) + n

A sparse-switch uses a sorted list of key-value pairs, where each key is a test value from a caselabel, and the values are jump offsets. Finding the correct jump target for a lookupswitch requires a binary search on the key, so it is a logarithmic-time operation.
sparse-switch 實(shí)用鍵值對(duì)實(shí)現(xiàn)，一個(gè)key對(duì)應(yīng)一個(gè)地址值

3.1 sparse-switch 基本語(yǔ)法格式舉例：
sparse-switch v1, :sswitch_data_0
default: code
....
:sswitch_data_0
.sparse-switch
0x5ec5cc94 -> :sswitch_0
0x5ec5cc96 -> :sswitch_1
0x5ec5cc98 -> :sswitch_2
0x5ec5cc99 -> :sswitch_3
0x5ec5ccb0 -> :sswitch_4
.end sparse-switch

說(shuō)明：上述代碼使用sparse 解析v1,如果查表成功則走入相應(yīng)的分支，如果查表不成功，則順序執(zhí)行（實(shí)際上走的是default分支）
第一case值是：0x5ec5cc94 ，第二個(gè)case值是0x5ec5cc96 ...

3.2 packed-switch 基本語(yǔ)法格式舉例：
packed-switch v0, :pswitch_data_0

default: code

:pswitch_data_0
.packed-switch 0x0
    :pswitch_0
    :pswitch_1
    :pswitch_2
    :pswitch_3
    :pswitch_4
.end packed-switch

說(shuō)明：上述代碼使用pswitch解析v0,如果查表成功則走入相應(yīng)的分支，如果查表不成功，則順序執(zhí)行（實(shí)際上走的是default分支）
第一個(gè)case值是 0，第二個(gè)case值是 1 ...

舉一個(gè)實(shí)戰(zhàn)荔枝：

舉例smali源代碼：
.class public Lme/veryyoung/wechat/luckymoney/VersionParam;
.super Ljava/lang/Object;

static fields

.field public static getMessageClass:Ljava/lang/String;
.field public static getNetworkByModelMethod:Ljava/lang/String;
.field public static receiveUIFunctionName:Ljava/lang/String;
.field public static receiveUIParamName:Ljava/lang/String;

direct methods

.method static constructor <clinit>()V
.locals 1
const-string v0, "c"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vS"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.v.k"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bv"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
return-void
.end method
.method public constructor <init>()V
.locals 0
invoke-direct {p0}, Ljava/lang/Object;-><init>()V
return-void
.end method
.method public static init(Ljava/lang/String;)V
.locals 2
const/4 v0, -0x1
invoke-virtual {p0}, Ljava/lang/String;->hashCode()I
move-result v1
sparse-switch v1, :sswitch_data_0
:cond_0
:goto_0
packed-switch v0, :pswitch_data_0
const-string v0, "c"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vS"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.v.k"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bv"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
:goto_1
return-void
:sswitch_0
const-string v1, "6.3.23"
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x0
goto :goto_0
:sswitch_1
const-string v1, "6.3.25"
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x1
goto :goto_0
:sswitch_2
const-string v1, "6.3.27"
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x2
goto :goto_0
:sswitch_3
const-string v1, "6.3.28"
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x3
goto :goto_0
:sswitch_4
const-string v1, "6.3.30"
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x4
goto :goto_0
:pswitch_0
const-string v0, "d"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vE"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.t.j"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bl"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_1
const-string v0, "d"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vF"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.t.j"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bl"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_2
const-string v0, "e"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "yj"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.u.k"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.br"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_3
const-string v0, "c"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vP"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.v.k"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bu"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_4
const-string v0, "c"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vS"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.v.k"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bv"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto/16 :goto_1
:sswitch_data_0
.sparse-switch
0x5ec5cc94 -> :sswitch_0
0x5ec5cc96 -> :sswitch_1
0x5ec5cc98 -> :sswitch_2
0x5ec5cc99 -> :sswitch_3
0x5ec5ccb0 -> :sswitch_4
.end sparse-switch
:pswitch_data_0
.packed-switch 0x0
:pswitch_0
:pswitch_1
:pswitch_2
:pswitch_3
:pswitch_4
.end packed-switch
.end method

手工還原成java源代碼：
pakage me.veryyoung.wechat.luckymoney
public class VersionParam{
public static String getMessageClass;
public static String getNetworkByModelMethod;
public static String receiveUIFunctionName;
public static String receiveUIParamName;
static{//clinit
receiveUIFunctionName = "c";
getNetworkByModelMethod = "vS";
receiveUIParamName = "com.tencent.mm.v.k";
getMessageClass = "com.tencent.mm.e.b.bv";
}
public VersionParam(){
super();
}
public static init(String str){
int hashCode = str.hashCode();
int index = -1;
switch(hashCode){//sparse-switch
case 0x5ec5cc94:
if(str.equals("6.3.23")){
index = 0;
}
break;
case 0x5ec5cc96:
if(str.equals("6.3.25")){
index = 1;
}
break;
case 0x5ec5cc98:
if(str.equals("6.3.27")){
index = 2;
}
break;
case 0x5ec5cc99:
if(str.equals("6.3.28")){
index = 3;
}
break;
case 0x5ec5ccb0:
if(str.equals("6.3.30")){
index = 4;
}
default:
break;
}
switch(index){
case 0:
receiveUIFunctionName = "d";
getNetworkByModelMethod = "vE";
receiveUIParamName = "com.tencent.mm.t.j";
getMessageClass = "com.tencent.mm.e.b.bl";
break;
case 1:
receiveUIFunctionName = "d";
getNetworkByModelMethod = "vF";
receiveUIParamName = "com.tencent.mm.t.j";
getMessageClass = "com.tencent.mm.e.b.bl";

            break;
        case 2:
            receiveUIFunctionName = "e";
            getNetworkByModelMethod = "yj";
            receiveUIParamName = "com.tencent.mm.u.k";
            getMessageClass = "com.tencent.mm.e.b.br";
            break;
        case 3:
            receiveUIFunctionName = "c";
            getNetworkByModelMethod = "vP";
            receiveUIParamName = "com.tencent.mm.v.k";
            getMessageClass = "com.tencent.mm.e.b.bu";
            break;
        case 4:
            receiveUIFunctionName = "c";
            getNetworkByModelMethod = "vS";
            receiveUIParamName = "com.tencent.mm.v.k";
            getMessageClass = "com.tencent.mm.e.b.bv";
            break;
        default:
            receiveUIFunctionName = "c";
            getNetworkByModelMethod = "vS";
            receiveUIParamName = "com.tencent.mm.v.k";
            getMessageClass = "com.tencent.mm.e.b.bv";
            break;
    }
}

}

比較作者源代碼：
package me.veryyoung.wechat.luckymoney;
public class VersionParam {
public static String receiveUIFunctionName = "c";
public static String getNetworkByModelMethod = "vS";
public static String receiveUIParamName = "com.tencent.mm.v.k";
public static String getMessageClass = "com.tencent.mm.e.b.bv";
public static void init(String version) {
switch (version) {
case "6.3.23":
receiveUIFunctionName = "d";
getNetworkByModelMethod = "vE";
receiveUIParamName = "com.tencent.mm.t.j";
getMessageClass = "com.tencent.mm.e.b.bl";
break;
case "6.3.25":
receiveUIFunctionName = "d";
getNetworkByModelMethod = "vF";
receiveUIParamName = "com.tencent.mm.t.j";
getMessageClass = "com.tencent.mm.e.b.bl";
break;
case "6.3.27":
receiveUIFunctionName = "e";
getNetworkByModelMethod = "yj";
receiveUIParamName = "com.tencent.mm.u.k";
getMessageClass = "com.tencent.mm.e.b.br";
break;
case "6.3.28":
receiveUIFunctionName = "c";
getNetworkByModelMethod = "vP";
receiveUIParamName = "com.tencent.mm.v.k";
getMessageClass = "com.tencent.mm.e.b.bu";
break;
case "6.3.30":
receiveUIFunctionName = "c";
getNetworkByModelMethod = "vS";
receiveUIParamName = "com.tencent.mm.v.k";
getMessageClass = "com.tencent.mm.e.b.bv";
break;
default:
receiveUIFunctionName = "c";
getNetworkByModelMethod = "vS";
receiveUIParamName = "com.tencent.mm.v.k";
getMessageClass = "com.tencent.mm.e.b.bv";
}
}
}

最后編輯于：2017.12.05 02:00:26

?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者
平臺(tái)聲明：文章內(nèi)容（如有圖片或視頻亦包括在內(nèi)）由作者上傳并發(fā)布，文章內(nèi)容僅代表作者本人觀點(diǎn)，簡(jiǎn)書系信息發(fā)布平臺(tái)，僅提供信息存儲(chǔ)服務(wù)。

人面猴
序言：七十年代末，一起剝皮案震驚了整個(gè)濱河市，隨后出現(xiàn)的幾起案子，更是在濱河造成了極大的恐慌，老刑警劉巖，帶你破解...
沈念sama閱讀 229,963評(píng)論 6贊 542
死咒
序言：濱河連續(xù)發(fā)生了三起死亡事件，死亡現(xiàn)場(chǎng)離奇詭異，居然都是意外死亡，警方通過(guò)查閱死者的電腦和手機(jī)，發(fā)現(xiàn)死者居然都...
沈念sama閱讀 99,348評(píng)論 3贊 429
救了他兩次的神仙讓他今天三更去死
文/潘曉璐我一進(jìn)店門，熙熙樓的掌柜王于貴愁眉苦臉地迎上來(lái)，“玉大人，你說(shuō)我怎么就攤上這事。” “怎么了？”我有些...
開封第一講書人閱讀 178,083評(píng)論 0贊 383
道士緝兇錄：失蹤的賣姜人
文/不壞的土叔我叫張陵，是天一觀的道長(zhǎng)。經(jīng)常有香客問(wèn)我，道長(zhǎng)，這世上最難降的妖魔是什么？我笑而不...
開封第一講書人閱讀 63,706評(píng)論 1贊 317
?港島之戀（遺憾婚禮）
正文為了忘掉前任，我火速辦了婚禮，結(jié)果婚禮上，老公的妹妹穿的比我還像新娘。我一直安慰自己，他們只是感情好，可當(dāng)我...
茶點(diǎn)故事閱讀 72,442評(píng)論 6贊 412
惡毒庶女頂嫁案：這布局不是一般人想出來(lái)的
文/花漫我一把揭開白布。她就那樣靜靜地躺著，像睡著了一般。火紅的嫁衣襯著肌膚如雪。梳的紋絲不亂的頭發(fā)上，一...
開封第一講書人閱讀 55,802評(píng)論 1贊 328
城市分裂傳說(shuō)
那天，我揣著相機(jī)與錄音，去河邊找鬼。笑死，一個(gè)胖子當(dāng)著我的面吹牛，可吹牛的內(nèi)容都是我干的。我是一名探鬼主播，決...
沈念sama閱讀 43,795評(píng)論 3贊 446
雙鴛鴦連環(huán)套：你想象不到人心有多黑
文/蒼蘭香墨我猛地睜開眼，長(zhǎng)吁一口氣：“原來(lái)是場(chǎng)噩夢(mèng)啊……” “哼！你這毒婦竟也來(lái)了？” 一聲冷哼從身側(cè)響起，我...
開封第一講書人閱讀 42,983評(píng)論 0贊 290
萬(wàn)榮殺人案實(shí)錄
序言：老撾萬(wàn)榮一對(duì)情侶失蹤，失蹤者是張志新（化名）和其女友劉穎，沒(méi)想到半個(gè)月后，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體，經(jīng)...
沈念sama閱讀 49,542評(píng)論 1贊 335
?護(hù)林員之死
正文獨(dú)居荒郊野嶺守林人離奇死亡，尸身上長(zhǎng)有42處帶血的膿包…… 初始之章·張勛以下內(nèi)容為張勛視角年9月15日...
茶點(diǎn)故事閱讀 41,287評(píng)論 3贊 358
?白月光啟示錄
正文我和宋清朗相戀三年，在試婚紗的時(shí)候發(fā)現(xiàn)自己被綠了。大學(xué)時(shí)的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片。...
茶點(diǎn)故事閱讀 43,486評(píng)論 1贊 374
活死人
序言：一個(gè)原本活蹦亂跳的男人離奇死亡，死狀恐怖，靈堂內(nèi)的尸體忽然破棺而出，到底是詐尸還是另有隱情，我是刑警寧澤，帶...
沈念sama閱讀 39,030評(píng)論 5贊 363
?日本核電站爆炸內(nèi)幕
正文年R本政府宣布，位于F島的核電站，受9級(jí)特大地震影響，放射性物質(zhì)發(fā)生泄漏。R本人自食惡果不足惜，卻給世界環(huán)境...
茶點(diǎn)故事閱讀 44,710評(píng)論 3贊 348
男人毒藥：我在死后第九天來(lái)索命
文/蒙蒙一、第九天我趴在偏房一處隱蔽的房頂上張望。院中可真熱鬧，春花似錦、人聲如沸。這莊子的主人今日做“春日...
開封第一講書人閱讀 35,116評(píng)論 0贊 28
一樁弒父案，背后竟有這般陰謀
文/蒼蘭香墨我抬頭看了看天上的太陽(yáng)。三九已至，卻和暖如春，著一層夾襖步出監(jiān)牢的瞬間，已是汗流浹背。一陣腳步聲響...
開封第一講書人閱讀 36,412評(píng)論 1贊 294
情欲美人皮
我被黑心中介騙來(lái)泰國(guó)打工，沒(méi)想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留，地道東北人。一個(gè)月前我還...
沈念sama閱讀 52,224評(píng)論 3贊 398
代替公主和親
正文我出身青樓，卻偏偏與公主長(zhǎng)得像，于是被迫代替她去往敵國(guó)和親。傳聞我的和親對(duì)象是個(gè)殘疾皇子，可洞房花燭夜當(dāng)晚...
茶點(diǎn)故事閱讀 48,462評(píng)論 2贊 378

三个男躁一个女,国精产品一区一手机的秘密,麦子交换系列最经典十句话,欧美国产综合欧美视频

Android smali逆向還原練習(xí)之switch case

Android smali逆向還原練習(xí)之switch case

static fields

direct methods

推薦閱讀更多精彩內(nèi)容

三个男躁一个女,国精产品一区一手机的秘密,麦子交换系列最经典十句话,欧美 国产 综合 欧美 视频

Android smali逆向還原練習(xí)之switch case

static fields

direct methods

推薦閱讀更多精彩內(nèi)容

三个男躁一个女,国精产品一区一手机的秘密,麦子交换系列最经典十句话,欧美国产综合欧美视频