unidbg-consoleDebugger快键指令详解

素颜马尾好姑娘i 2023-09-26 16:25 48阅读 0赞

快键指令详解：

help         帮助信息
    d|dis        反编译信息
    d0x地址      地址信息
    m eg:mr0 mr0s  mr0 16(长度)    读取寄存器内存
    mOx         指定地址内存
    w0x         写入hex数据
    bt          调用栈信息
    b           断点指令
    c           继续
    blr         返回上一层
    r           删除当前断点
    exit|quic   推出
    n           执行下一条  步出步过
    s           步入
    msp         查看栈数据
    st (hex)    搜索栈数据
    vm          当前so加载情况
    shr (hex)   堆类查找
    vbs         查看到断点
    cc          生成汇编及C

源码指令：

package com.github.unidbg.arm;
    
    import com.github.unidbg.Emulator;
    import com.github.unidbg.Family;
    import com.github.unidbg.Module;
    import com.github.unidbg.Utils;
    import com.github.unidbg.arm.backend.Backend;
    import com.github.unidbg.arm.backend.BackendException;
    import com.github.unidbg.debugger.DebugRunnable;
    import com.github.unidbg.debugger.Debugger;
    import com.github.unidbg.debugger.FunctionCallListener;
    import com.github.unidbg.memory.Memory;
    import com.github.unidbg.pointer.UnidbgPointer;
    import com.github.unidbg.thread.RunnableTask;
    import com.sun.jna.Pointer;
    import keystone.Keystone;
    import keystone.KeystoneArchitecture;
    import keystone.KeystoneMode;
    import org.apache.commons.codec.DecoderException;
    import org.apache.commons.codec.binary.Hex;
    import unicorn.Arm64Const;
    
    import java.util.Scanner;
    
    class SimpleARM64Debugger extends AbstractARMDebugger implements Debugger {
        
    
        SimpleARM64Debugger(Emulator<?> emulator) {
        
            super(emulator);
        }
    
        @Override
        public void traceFunctionCall(Module module, FunctionCallListener listener) {
        
            Backend backend = emulator.getBackend();
            TraceFunctionCall hook = new TraceFunctionCall64(emulator, listener);
            long begin = module == null ? 1 : module.base;
            long end = module == null ? 0 : module.base + module.size;
            backend.hook_add_new(hook, begin, end, emulator);
        }
    
        @Override
        protected final void loop(Emulator<?> emulator, long address, int size, DebugRunnable<?> runnable) throws Exception {
        
            Backend backend = emulator.getBackend();
            long nextAddress = 0;
    
            try {
        
                if (address != -1) {
        
                    RunnableTask runningTask = emulator.getThreadDispatcher().getRunningTask();
                    System.out.println("debugger break at: 0x" + Long.toHexString(address) + (runningTask == null ? "" : (" @ " + runningTask)));
                    emulator.showRegs();
                }
                if (address > 0) {
        
                    nextAddress = disassemble(emulator, address, size, false);
                }
            } catch (BackendException e) {
        
                e.printStackTrace();
            }
    
            Scanner scanner = new Scanner(System.in);
            String line;
            while ((line = scanner.nextLine()) != null) {
        
                line = line.trim();
                try {
        
                    if ("help".equals(line)) {
        
                        showHelp(address);
                        continue;
                    }
                    if (line.startsWith("run") && runnable != null) {
        
                        try {
        
                            callbackRunning = true;
                            String arg = line.substring(3).trim();
                            if (arg.length() > 0) {
        
                                String[] args = arg.split("\\s+");
                                runnable.runWithArgs(args);
                            } else {
        
                                runnable.runWithArgs(null);
                            }
                        } finally {
        
                            callbackRunning = false;
                        }
                        continue;
                    }
                    if ("d".equals(line) || "dis".equals(line)) {
        
                        emulator.showRegs();
                        disassemble(emulator, address, size, false);
                        continue;
                    }
                    if (line.startsWith("d0x")) {
        
                        disassembleBlock(emulator, Long.parseLong(line.substring(3), 16), false);
                        continue;
                    }
                    if (line.startsWith("m")) {
        
                        String command = line;
                        String[] tokens = line.split("\\s+");
                        int length = 0x70;
                        try {
        
                            if (tokens.length >= 2) {
        
                                command = tokens[0];
                                String str = tokens[1];
                                length = (int) Utils.parseNumber(str);
                            }
                        } catch(NumberFormatException ignored) {
        }
                        StringType stringType = null;
                        if (command.endsWith("s")) {
        
                            stringType = StringType.nullTerminated;
                            command = command.substring(0, command.length() - 1);
                        } else if (command.endsWith("std")) {
        
                            stringType = StringType.std_string;
                            command = command.substring(0, command.length() - 3);
                        }
    
                        int reg = -1;
                        String name = null;
                        if (command.startsWith("mx") && (command.length() == 3 || command.length() == 4)) {
        
                            int idx = Integer.parseInt(command.substring(2));
                            if (idx >= 0 && idx <= 28) {
        
                                reg = Arm64Const.UC_ARM64_REG_X0 + idx;
                                name = "x" + idx;
                            }
                        } else if ("mfp".equals(command)) {
        
                            reg = Arm64Const.UC_ARM64_REG_FP;
                            name = "fp";
                        } else if ("mip".equals(command)) {
        
                            reg = Arm64Const.UC_ARM64_REG_IP0;
                            name = "ip";
                        } else if ("msp".equals(command)) {
        
                            reg = Arm64Const.UC_ARM64_REG_SP;
                            name = "sp";
                        } else if (command.startsWith("m0x")) {
        
                            long addr = Long.parseLong(command.substring(3).trim(), 16);
                            Pointer pointer = UnidbgPointer.pointer(emulator, addr);
                            if (pointer != null) {
        
                                dumpMemory(pointer, length, pointer.toString(), stringType);
                            } else {
        
                                System.out.println(addr + " is null");
                            }
                            continue;
                        }
                        if (reg != -1) {
        
                            Pointer pointer = UnidbgPointer.register(emulator, reg);
                            if (pointer != null) {
        
                                dumpMemory(pointer, length, name + "=" + pointer, stringType);
                            } else {
        
                                System.out.println(name + " is null");
                            }
                            continue;
                        }
                    }
                    if ("where".equals(line)) {
        
                        new Exception("here").printStackTrace(System.out);
                        continue;
                    }
                    if (line.startsWith("wx0x")) {
        
                        String[] tokens = line.split("\\s+");
                        long addr = Long.parseLong(tokens[0].substring(4).trim(), 16);
                        Pointer pointer = UnidbgPointer.pointer(emulator, addr);
                        if (pointer != null && tokens.length > 1) {
        
                            byte[] data = Hex.decodeHex(tokens[1].toCharArray());
                            pointer.write(0, data, 0, data.length);
                            dumpMemory(pointer, data.length, pointer.toString(), null);
                        } else {
        
                            System.out.println(addr + " is null");
                        }
                        continue;
                    }
                    if (line.startsWith("w")) {
        
                        String command;
                        String[] tokens = line.split("\\s+");
                        if (tokens.length < 2) {
        
                            System.out.println("wx0-wx28, wfp, wip, wsp <value>: write specified register");
                            System.out.println("wb(address), ws(address), wi(address), wl(address) <value>: write (byte, short, integer, long) memory of specified address, address must start with 0x");
                            continue;
                        }
                        long value;
                        try {
        
                            command = tokens[0];
                            String str = tokens[1];
                            value = Utils.parseNumber(str);
                        } catch(NumberFormatException e) {
        
                            e.printStackTrace();
                            continue;
                        }
    
                        int reg = -1;
                        if (command.startsWith("wx") && (command.length() == 3 || command.length() == 4)) {
        
                            int idx = Integer.parseInt(command.substring(2));
                            if (idx >= 0 && idx <= 28) {
        
                                reg = Arm64Const.UC_ARM64_REG_X0 + idx;
                            }
                        } else if ("wfp".equals(command)) {
        
                            reg = Arm64Const.UC_ARM64_REG_FP;
                        } else if ("wip".equals(command)) {
        
                            reg = Arm64Const.UC_ARM64_REG_IP0;
                        } else if ("wsp".equals(command)) {
        
                            reg = Arm64Const.UC_ARM64_REG_SP;
                        } else if (command.startsWith("wb0x") || command.startsWith("ws0x") || command.startsWith("wi0x") || command.startsWith("wl0x")) {
        
                            long addr = Long.parseLong(command.substring(4).trim(), 16);
                            Pointer pointer = UnidbgPointer.pointer(emulator, addr);
                            if (pointer != null) {
        
                                if (command.startsWith("wb")) {
        
                                    pointer.setByte(0, (byte) value);
                                } else if (command.startsWith("ws")) {
        
                                    pointer.setShort(0, (short) value);
                                } else if (command.startsWith("wi")) {
        
                                    pointer.setInt(0, (int) value);
                                } else if (command.startsWith("wl")) {
        
                                    pointer.setLong(0, value);
                                }
                                dumpMemory(pointer, 16, pointer.toString(), null);
                            } else {
        
                                System.out.println(addr + " is null");
                            }
                            continue;
                        }
                        if (reg != -1) {
        
                            backend.reg_write(reg, value);
                            ARM.showRegs64(emulator, new int[] {
         reg });
                            continue;
                        }
                    }
                    if (emulator.isRunning() && "bt".equals(line)) {
        
                        try {
        
                            emulator.getUnwinder().unwind();
                        } catch (Throwable e) {
        
                            e.printStackTrace();
                        }
                        continue;
                    }
                    if (line.startsWith("b0x")) {
        
                        try {
        
                            long addr = Long.parseLong(line.substring(3), 16) & 0xfffffffffffffffeL;
                            Module module = null;
                            if (addr < Memory.MMAP_BASE && (module = findModuleByAddress(emulator, address)) != null) {
        
                                addr += module.base;
                            }
                            addBreakPoint(addr); // temp breakpoint
                            if (module == null) {
        
                                module = findModuleByAddress(emulator, addr);
                            }
                            System.out.println("Add breakpoint: 0x" + Long.toHexString(addr) + (module == null ? "" : (" in " + module.name + " [0x" + Long.toHexString(addr - module.base) + "]")));
                            continue;
                        } catch(NumberFormatException ignored) {
        
                        }
                    }
                    if ("blr".equals(line)) {
         // break LR
                        long addr = backend.reg_read(Arm64Const.UC_ARM64_REG_LR).longValue();
                        addBreakPoint(addr);
                        Module module = findModuleByAddress(emulator, addr);
                        System.out.println("Add breakpoint: 0x" + Long.toHexString(addr) + (module == null ? "" : (" in " + module.name + " [0x" + Long.toHexString(addr - module.base) + "]")));
                        continue;
                    }
                    if ("r".equals(line)) {
        
                        long addr = backend.reg_read(Arm64Const.UC_ARM64_REG_PC).longValue();
                        if (removeBreakPoint(addr)) {
        
                            Module module = findModuleByAddress(emulator, addr);
                            System.out.println("Remove breakpoint: 0x" + Long.toHexString(addr) + (module == null ? "" : (" in " + module.name + " [0x" + Long.toHexString(addr - module.base) + "]")));
                        }
                        continue;
                    }
                    if ("b".equals(line)) {
        
                        long addr = backend.reg_read(Arm64Const.UC_ARM64_REG_PC).longValue();
                        addBreakPoint(addr);
                        Module module = findModuleByAddress(emulator, addr);
                        System.out.println("Add breakpoint: 0x" + Long.toHexString(addr) + (module == null ? "" : (" in " + module.name + " [0x" + Long.toHexString(addr - module.base) + "]")));
                        continue;
                    }
                    if(handleCommon(backend, line, address, size, nextAddress, runnable)) {
        
                        break;
                    }
                } catch (RuntimeException | DecoderException e) {
        
                    e.printStackTrace();
                }
            }
        }
    
        @Override
        final void showHelp(long address) {
        
            System.out.println("c: continue");
            System.out.println("n: step over");
            if (emulator.isRunning()) {
        
                System.out.println("bt: back trace");
            }
            System.out.println();
            System.out.println("st hex: search stack");
            System.out.println("shw hex: search writable heap");
            System.out.println("shr hex: search readable heap");
            System.out.println("shx hex: search executable heap");
            System.out.println();
            System.out.println("nb: break at next block");
            System.out.println("s|si: step into");
            System.out.println("s[decimal]: execute specified amount instruction");
            System.out.println("s(bl): execute util BL mnemonic, low performance");
            System.out.println();
            System.out.println("m(op) [size]: show memory, default size is 0x70, size may hex or decimal");
            System.out.println("mx0-mx28, mfp, mip, msp [size]: show memory of specified register");
            System.out.println("m(address) [size]: show memory of specified address, address must start with 0x");
            System.out.println();
            System.out.println("wx0-wx28, wfp, wip, wsp <value>: write specified register");
            System.out.println("wb(address), ws(address), wi(address), wl(address) <value>: write (byte, short, integer, long) memory of specified address, address must start with 0x");
            System.out.println("wx(address) <hex>: write bytes to memory at specified address, address must start with 0x");
            System.out.println();
            System.out.println("b(address): add temporarily breakpoint, address must start with 0x, can be module offset");
            System.out.println("b: add breakpoint of register PC");
            System.out.println("r: remove breakpoint of register PC");
            System.out.println("blr: add temporarily breakpoint of register LR");
            System.out.println();
            System.out.println("p (assembly): patch assembly at PC address");
            System.out.println("where: show java stack trace");
            System.out.println();
            System.out.println("trace [begin end]: Set trace instructions");
            System.out.println("traceRead [begin end]: Set trace memory read");
            System.out.println("traceWrite [begin end]: Set trace memory write");
            System.out.println("vm: view loaded modules");
            System.out.println("vbs: view breakpoints");
            System.out.println("d|dis: show disassemble");
            System.out.println("d(0x): show disassemble at specify address");
            System.out.println("stop: stop emulation");
            System.out.println("run [arg]: run test");
            System.out.println("gc: Run System.gc()");
            System.out.println("threads: show thread list");
    
            if (emulator.getFamily() == Family.iOS && !emulator.isRunning()) {
        
                System.out.println("dump [class name]: dump objc class");
                System.out.println("search [keywords]: search objc classes");
                System.out.println("gpb [class name]: dump GPB protobuf msg def");
            }
    
            Module module = emulator.getMemory().findModuleByAddress(address);
            if (module != null) {
        
                System.out.printf("cc (size): convert asm from (0x%x) to (0x%x + size) bytes to c function%n", address, address);
            }
        }
    
        @Override
        protected Keystone createKeystone(boolean isThumb) {
        
            return new Keystone(KeystoneArchitecture.Arm64, KeystoneMode.LittleEndian);
        }
    
    }