Android smali逆向还原练习之switch case

2023年4月20日 268次阅读 来源: unsummon

一、背景
熟悉VC编译器的朋友，对switch case汇编代码不会感到陌生。
switch case 代码基本分位3类：
1、case分支小于等于3,数值连续。编译器生成的汇编代码，直接用 cmp [ebp+var_4], 0 jz short loc_401042之类指令代替
2、case分支大于3小于等于256。编译器会生成一张或者两张table表，case分支通过查表找到代码地址
2、case分支大于3，数值很离散。编译器会用平衡树的结构，即生成的代码逻辑上构成一颗平衡树。

二、研究目的
Android apk软件的逆向，一般的主战场仍然在java层，有反调试和加固的apk除外。在jeb、jadx、jd-gui工具横行的今天，很多时候我们不需要熟悉smali源码，直接使用工具反中间码为java源码就OK了。那还分析smali干嘛呢？

熟悉smali中间代码主要意义如下：
1、在动态调试smali代码时会比较有帮助
2、工具不管用情况下，需要静态分析手工还原smali代码为java代码，会大大提高还原效率。
3、给了我们一个窥探java 语法设计原理的方法

三、这里只分析编译器会生成table的情形

含有table表的switch case中间码分两种类型：
sparse-switch 和 packed-switch
它们两的区别：
A packed-switch uses a simple jump table, indexed by the form low + n, where low is the lowest test value among the case labels, and n is the input to the switch. The values at each index represent the bytecode offsets for each case. Finding the correct jump address is a constant-time operation.
packed-switch 简单实用跳表，实际上就是一个数组，数值元素是地址值。跳表索引值 = base值(low) + n

A sparse-switch uses a sorted list of key-value pairs, where each key is a test value from a caselabel, and the values are jump offsets. Finding the correct jump target for a lookupswitch requires a binary search on the key, so it is a logarithmic-time operation.
sparse-switch 实用键值对实现，一个key对应一个地址值

3.1 sparse-switch 基本语法格式举例：
sparse-switch v1, :sswitch_data_0
default: code
….
:sswitch_data_0
.sparse-switch
0x5ec5cc94 -> :sswitch_0
0x5ec5cc96 -> :sswitch_1
0x5ec5cc98 -> :sswitch_2
0x5ec5cc99 -> :sswitch_3
0x5ec5ccb0 -> :sswitch_4
.end sparse-switch

说明：上述代码使用sparse 解析v1,如果查表成功则走入相应的分支，如果查表不成功，则顺序执行（实际上走的是default分支）
第一case值是：0x5ec5cc94 ，第二个case值是0x5ec5cc96 …

3.2 packed-switch 基本语法格式举例：
packed-switch v0, :pswitch_data_0

default: code

:pswitch_data_0
.packed-switch 0x0
    :pswitch_0
    :pswitch_1
    :pswitch_2
    :pswitch_3
    :pswitch_4
.end packed-switch

说明：上述代码 使用pswitch解析v0,如果查表成功则走入相应的分支，如果查表不成功，则顺序执行（实际上走的是default分支）
第一个case值是 0，第二个case值是 1 …

举一个实战荔枝：

举例smali源代码：
.class public Lme/veryyoung/wechat/luckymoney/VersionParam;
.super Ljava/lang/Object;

static fields

.field public static getMessageClass:Ljava/lang/String;
.field public static getNetworkByModelMethod:Ljava/lang/String;
.field public static receiveUIFunctionName:Ljava/lang/String;
.field public static receiveUIParamName:Ljava/lang/String;

direct methods

.method static constructor <clinit>()V
.locals 1
const-string v0, “c”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, “vS”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, “com.tencent.mm.v.k”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, “com.tencent.mm.e.b.bv”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
return-void
.end method
.method public constructor <init>()V
.locals 0
invoke-direct {p0}, Ljava/lang/Object;-><init>()V
return-void
.end method
.method public static init(Ljava/lang/String;)V
.locals 2
const/4 v0, -0x1
invoke-virtual {p0}, Ljava/lang/String;->hashCode()I
move-result v1
sparse-switch v1, :sswitch_data_0
:cond_0
:goto_0
packed-switch v0, :pswitch_data_0
const-string v0, “c”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, “vS”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, “com.tencent.mm.v.k”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, “com.tencent.mm.e.b.bv”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
:goto_1
return-void
:sswitch_0
const-string v1, “6.3.23”
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x0
goto :goto_0
:sswitch_1
const-string v1, “6.3.25”
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x1
goto :goto_0
:sswitch_2
const-string v1, “6.3.27”
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x2
goto :goto_0
:sswitch_3
const-string v1, “6.3.28”
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x3
goto :goto_0
:sswitch_4
const-string v1, “6.3.30”
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x4
goto :goto_0
:pswitch_0
const-string v0, “d”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, “vE”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, “com.tencent.mm.t.j”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, “com.tencent.mm.e.b.bl”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_1
const-string v0, “d”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, “vF”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, “com.tencent.mm.t.j”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, “com.tencent.mm.e.b.bl”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_2
const-string v0, “e”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, “yj”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, “com.tencent.mm.u.k”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, “com.tencent.mm.e.b.br”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_3
const-string v0, “c”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, “vP”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, “com.tencent.mm.v.k”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, “com.tencent.mm.e.b.bu”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_4
const-string v0, “c”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, “vS”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, “com.tencent.mm.v.k”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, “com.tencent.mm.e.b.bv”
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto/16 :goto_1
:sswitch_data_0
.sparse-switch
0x5ec5cc94 -> :sswitch_0
0x5ec5cc96 -> :sswitch_1
0x5ec5cc98 -> :sswitch_2
0x5ec5cc99 -> :sswitch_3
0x5ec5ccb0 -> :sswitch_4
.end sparse-switch
:pswitch_data_0
.packed-switch 0x0
:pswitch_0
:pswitch_1
:pswitch_2
:pswitch_3
:pswitch_4
.end packed-switch
.end method

手工还原成java源代码：
pakage me.veryyoung.wechat.luckymoney
public class VersionParam{
public static String getMessageClass;
public static String getNetworkByModelMethod;
public static String receiveUIFunctionName;
public static String receiveUIParamName;
static{//clinit
receiveUIFunctionName = “c”;
getNetworkByModelMethod = “vS”;
receiveUIParamName = “com.tencent.mm.v.k”;
getMessageClass = “com.tencent.mm.e.b.bv”;
}
public VersionParam(){
super();
}
public static init(String str){
int hashCode = str.hashCode();
int index = -1;
switch(hashCode){//sparse-switch
case 0x5ec5cc94:
if(str.equals(“6.3.23”)){
index = 0;
}
break;
case 0x5ec5cc96:
if(str.equals(“6.3.25”)){
index = 1;
}
break;
case 0x5ec5cc98:
if(str.equals(“6.3.27”)){
index = 2;
}
break;
case 0x5ec5cc99:
if(str.equals(“6.3.28”)){
index = 3;
}
break;
case 0x5ec5ccb0:
if(str.equals(“6.3.30”)){
index = 4;
}
default:
break;
}
switch(index){
case 0:
receiveUIFunctionName = “d”;
getNetworkByModelMethod = “vE”;
receiveUIParamName = “com.tencent.mm.t.j”;
getMessageClass = “com.tencent.mm.e.b.bl”;
break;
case 1:
receiveUIFunctionName = “d”;
getNetworkByModelMethod = “vF”;
receiveUIParamName = “com.tencent.mm.t.j”;
getMessageClass = “com.tencent.mm.e.b.bl”;

            break;
        case 2:
            receiveUIFunctionName = "e";
            getNetworkByModelMethod = "yj";
            receiveUIParamName = "com.tencent.mm.u.k";
            getMessageClass = "com.tencent.mm.e.b.br";
            break;
        case 3:
            receiveUIFunctionName = "c";
            getNetworkByModelMethod = "vP";
            receiveUIParamName = "com.tencent.mm.v.k";
            getMessageClass = "com.tencent.mm.e.b.bu";
            break;
        case 4:
            receiveUIFunctionName = "c";
            getNetworkByModelMethod = "vS";
            receiveUIParamName = "com.tencent.mm.v.k";
            getMessageClass = "com.tencent.mm.e.b.bv";
            break;
        default:
            receiveUIFunctionName = "c";
            getNetworkByModelMethod = "vS";
            receiveUIParamName = "com.tencent.mm.v.k";
            getMessageClass = "com.tencent.mm.e.b.bv";
            break;
    }
}

}

比较作者源代码：
package me.veryyoung.wechat.luckymoney;
public class VersionParam {
public static String receiveUIFunctionName = “c”;
public static String getNetworkByModelMethod = “vS”;
public static String receiveUIParamName = “com.tencent.mm.v.k”;
public static String getMessageClass = “com.tencent.mm.e.b.bv”;
public static void init(String version) {
switch (version) {
case “6.3.23”:
receiveUIFunctionName = “d”;
getNetworkByModelMethod = “vE”;
receiveUIParamName = “com.tencent.mm.t.j”;
getMessageClass = “com.tencent.mm.e.b.bl”;
break;
case “6.3.25”:
receiveUIFunctionName = “d”;
getNetworkByModelMethod = “vF”;
receiveUIParamName = “com.tencent.mm.t.j”;
getMessageClass = “com.tencent.mm.e.b.bl”;
break;
case “6.3.27”:
receiveUIFunctionName = “e”;
getNetworkByModelMethod = “yj”;
receiveUIParamName = “com.tencent.mm.u.k”;
getMessageClass = “com.tencent.mm.e.b.br”;
break;
case “6.3.28”:
receiveUIFunctionName = “c”;
getNetworkByModelMethod = “vP”;
receiveUIParamName = “com.tencent.mm.v.k”;
getMessageClass = “com.tencent.mm.e.b.bu”;
break;
case “6.3.30”:
receiveUIFunctionName = “c”;
getNetworkByModelMethod = “vS”;
receiveUIParamName = “com.tencent.mm.v.k”;
getMessageClass = “com.tencent.mm.e.b.bv”;
break;
default:
receiveUIFunctionName = “c”;
getNetworkByModelMethod = “vS”;
receiveUIParamName = “com.tencent.mm.v.k”;
getMessageClass = “com.tencent.mm.e.b.bv”;
}
}
}

    原文作者：unsummon
    原文地址: https://www.jianshu.com/p/5b2b5466d99b
    本文转自网络文章，转载此文章仅为分享知识，如有侵权，请联系博主进行删除。
点赞