安卓逆向ida脱dex so壳内存脱壳教程

idc脚本：

static main(void)
{
auto fp, dexAddress, end, size;
dexAddress = 0xA644C008;
size = 0x0086CAB0;
end = dexAddress + size;
fp = fopen("D:\\classes.dex", "wb");
for ( ; dexAddress < end; dexAddress++ )
fputc(Byte(dexAddress), fp);
}

脱so文件脚本：

static main(void)
{
auto fp, dexAddress, end, size;
dexAddress = 0xA644C008;
size = 0x0086CAB0;
end = dexAddress + size;
fp = fopen("D:\\xxx.so", "wb");
for ( ; dexAddress < end; dexAddress++ )
fputc(Byte(dexAddress), fp);
}

ida操作教程：

adb push d:\as /data/local/tmp/as
adb shell
su  获取root权限
chmod 777 给文件777权限
cd data/local/tmp 进入这个目录
./as    启动android_server 我这边改名为as
再开一个cmd窗口
adb forward tcp:23946 tcp:23946  默认23946端口转发
adb forward tcp:15923 tcp:15923  -p修改端口转发
adb shell am start -D -n com.example.protectapp/org.isclab.shh.protectapp.MainActivity 调式模式启动
jdb -connect com.sun.jdi.SocketAttach:hostname=127.0.0.1,port=8614  jdb恢复程序运行
5.1下断点位置: dvmdexfileparse   libdvmso: dvmDexFileOpenPartial  libart.so: Openmemory