smali 언어 체험

아래는 apk 를 decompile 할 때 생성되는 smali 파일과 dex2jar 로 decompile 한 jar 을 비교한거(아래 관련글 2개에 이어 쓴 글).

2013/01/15 - [bring/steal] - 안드로이드 apk 디컴파일(Decompile) / 소스보기

2013/01/29 - [bring/steal] - 안드로이드 apk 디컴파일(Decompile) 후 다시 컴파일(Recompile) / 소스수정

compile 전 원본 source:

protected void onCreate(Bundle savedInstanceState) {

super.onCreate(savedInstanceState);

setContentView(R.layout.activity_main);

TextView tv = (TextView) findViewById(R.id.test_text);

int a = 33;

String b = "abcd";

a = a * b.length();

tv.setText(String.valueOf(a) + "QQ" + b);

Log.d("PPP", "RRR" + String.valueOf(a));

}

dex2jar 로 만든 jar 를 decompile 한 java source:

  protected void onCreate(Bundle paramBundle)

  {

    super.onCreate(paramBundle);

    setContentView(2130903040);

    TextView localTextView = (TextView)findViewById(2131165184);

    int i = 33 * "abcd".length();

    localTextView.setText(String.valueOf(i) + "QQ" + "abcd");

    Log.d("PPP", "RRR" + String.valueOf(i));

  }

smali code:

# virtual methods

.method protected onCreate(Landroid/os/Bundle;)V

    .locals 6

    .parameter "savedInstanceState"

    .prologue

    .line 13

    invoke-super {p0, p1}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V

    .line 14

    const/high16 v3, 0x7f03

    invoke-virtual {p0, v3}, Lorg/azki/smali/MainActivity;->setContentView(I)V

    .line 16

    const/high16 v3, 0x7f07

    invoke-virtual {p0, v3}, Lorg/azki/smali/MainActivity;->findViewById(I)Landroid/view/View;

    move-result-object v2

    check-cast v2, Landroid/widget/TextView;

    .line 18

    .local v2, tv:Landroid/widget/TextView;

    const/16 v0, 0x21

    .line 19

    .local v0, a:I

    const-string v1, "abcd"

    .line 20

    .local v1, b:Ljava/lang/String;

    invoke-virtual {v1}, Ljava/lang/String;->length()I

    move-result v3

    mul-int/2addr v0, v3

    .line 21

    new-instance v3, Ljava/lang/StringBuilder;

    invoke-static {v0}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

    move-result-object v4

    invoke-static {v4}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

    move-result-object v4

    invoke-direct {v3, v4}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    const-string v4, "QQ"

    invoke-virtual {v3, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v3

    invoke-virtual {v3, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v3

    invoke-virtual {v3}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v3

    invoke-virtual {v2, v3}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    .line 22

    const-string v3, "PPP"

    new-instance v4, Ljava/lang/StringBuilder;

    const-string v5, "RRR"

    invoke-direct {v4, v5}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-static {v0}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

    move-result-object v5

    invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v4

    invoke-virtual {v4}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v4

    invoke-static {v3, v4}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

    .line 23

    return-void

.end method

ps. 다른 apk를 해킹할 때 가장 유용할 것 같은 smali 구문을 뽑아본다면..

실제 찍어보고 싶은 값이 v4 이고, 해당 메소드에서 마지막 변수가 v5 일 때 임시 태그인 v6를 생성하고 Log.d

const-string v6, "TAG"

invoke-static {v6, v4}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

분기문

if-ne v0, v1, :cond_0

# v0 과 v1 이 틀리면 cond_0 로 jump.

:cond_0

if-eq v0, v1, :cond_1

# v0 과 v1 이 같으면 cond_0 로 jump.

:cond_1

if-ge v0, v1, :cond_2

# v0 가 v1 보다 크거나 같으면 cond_2 로 jump.

:cond_2

if-le v0, v1, :cond_3

# v0 가 v1 보다 작거나 같으면 cond_3 로 jump.

:cond_3

자세히

http://code.google.com/p/smali/w/list

dalvik bytecode : http://source.android.com/tech/dalvik/dalvik-bytecode.html

dalvik dex format : http://source.android.com/tech/dalvik/dex-format.html

즐핵 with 양심.