Android_smali_代码注入

//日志注入

const-string v8, "----->parameter1:"

invoke-static {v8, p1}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

//栈跟踪信息记录了程序从启动到printStackTrace()被执行期间所有被调用过的方法。

# virtual methods

.method public stack()V

.locals 2

.prologue

.line 20

new-instance v0, Ljava/lang/Exception;

const-string v1, "----->print trace"

invoke-direct {v0, v1}, Ljava/lang/Exception;-><init>(Ljava/lang/String;)V

invoke-virtual {v0}, Ljava/lang/Exception;->printStackTrace()V

.line 21

return-void

.end method

//转换string输出

//publicstaticvoid main(String[] args) {

// int number = 0;

// Log.i("----->", String.valueOf(number));

//}

.method public static main([Ljava/lang/String;)V

.locals 3

.parameter "args"

.prologue

.line 11

const/4 v0, 0x0

.line 12

.local v0, number:I

const-string v1, "----->"

invoke-static {v0}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

move-result-object v2

invoke-static {v1, v2}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

.line 13

return-void

.end method

//byte数组转换字符串

# virtual methods

.method public byteToString([B)V

.locals 3

.parameter "paramArrayOfByte"

.prologue

:try_start_0

new-instance v1, Ljava/lang/String;

const-string v2, "UTF-8"

invoke-direct {v1, p1, v2}, Ljava/lang/String;-><init>([BLjava/lang/String;)V

.local v1, string:Ljava/lang/String;

const-string v2, "----->"

invoke-static {v2, v1}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

:try_end_0

.catch Ljava/io/UnsupportedEncodingException; {:try_start_0 .. :try_end_0} :catch_0

.end local v1 #string:Ljava/lang/String;

:goto_0

return-void

:catch_0

move-exception v0

.local v0, e:Ljava/io/UnsupportedEncodingException;

invoke-virtual {v0}, Ljava/io/UnsupportedEncodingException;->printStackTrace()V

goto :goto_0

.end method

//另一种byte数组转换字符串

new-instance v6, Ljava/lang/String;

invoke-direct {v6, v0}, Ljava/lang/String;-><init>([B)V

const-string v5, "----->d.smali_b([BIII)[B_return"

invoke-static {v5, v6}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

//JSON转字符串

//v0寄存器代表JSONObject

const-string v1, "-->json"

invoke-virtual {v0}, Lorg/json/JSONObject;->toString()Ljava/lang/String;

move-result-object v2

invoke-static {v1, v2}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

则是因为很多指令不能够使用大于15的寄存器，故应该加上“move-object/from16 v1, px”语句进行转换。

//调用对象的toString方法输出

invoke-virtual {p0}, Lcom/huawei/appmarket/datasource/pojo/b;->toString()Ljava/lang/String;

move-result-object v3

const-string v2, "@@@@@>1a>pojo"

invoke-static {v2, v3}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

//Int转换string

const-string v1, "----->"

invoke-static {v0}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

move-result-object v2

invoke-static {v1, v2}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

//for( : ) 遍历

.method public static main([Ljava/lang/String;)V

.locals 4

.parameter "args"

.prologue

.line 18

new-instance v0, Ljava/util/ArrayList;

invoke-direct {v0}, Ljava/util/ArrayList;-><init>()V

.line 19

.local v0, list:Ljava/util/List;,"Ljava/util/List<Ljava/lang/String;>;"

const-string v2, "a"

invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z

.line 20

const-string v2, "b"

invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z

.line 21

const-string v2, "c"

invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z

.line 22

const-string v2, "d"

invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z

.line 24

invoke-interface {v0}, Ljava/util/List;->iterator()Ljava/util/Iterator; #获取集合迭代器

move-result-object v2

:goto_0 #迭代循环开始

invoke-interface {v2}, Ljava/util/Iterator;->hasNext()Z #开始迭代

move-result v3

if-nez v3, :cond_0 #如果迭代器不为空就跳走

.line 27

return-void

.line 24

:cond_0

invoke-interface {v2}, Ljava/util/Iterator;->next()Ljava/lang/Object; #循环获取每一项

move-result-object v1

check-cast v1, Ljava/lang/String;

.line 25

.local v1, string:Ljava/lang/String;

sget-object v3, Ljava/lang/System;->out:Ljava/io/PrintStream;

invoke-virtual {v3, v1}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V

goto :goto_0 #跳转到循环开始处

.end method

//for (int i = 0; i < 10; i++) {

// System.out.println(i);

//}

.method public static main([Ljava/lang/String;)V

.locals 2

.parameter "args"

.prologue

.line 15

const/4 v0, 0x0

.local v0, i:I #初始化v0为0

:goto_0 #循环开始

const/16 v1, 0xa

if-lt v0, v1, :cond_0 #判断v0小于v1，则跳转到cond_0标号处

.line 18

return-void

.line 16

:cond_0

sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

invoke-virtual {v1, v0}, Ljava/io/PrintStream;->println(I)V

.line 15

add-int/lit8 v0, v0, 0x1 #下一个索引

goto :goto_0 #跳转到循环起始处

.end method

int number = 1;

switch (number) {

case 0:

System.out.println(0);

break;

case 1:

System.out.println(1);

break;

case 2:

System.out.println(2);

break;

case 3:

System.out.println(3);

break;

default:

break;

}

.method public static main([Ljava/lang/String;)V

.locals 3

.parameter "args"

.prologue

.line 15

const/4 v0, 0x1

.line 16

.local v0, number:I

packed-switch v0, :pswitch_data_0 #packed-switch分支，pswitch_data_0指定case区域

.line 32

:goto_0 #所有case的出口

return-void

.line 18

:pswitch_0

sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

const/4 v2, 0x0 #case 0

invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V

goto :goto_0 #跳转到goto_0标号处

.line 21

:pswitch_1

sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

const/4 v2, 0x1 #case 1

invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V

goto :goto_0 #跳转到goto_0标号处

.line 24

:pswitch_2

sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

const/4 v2, 0x2 #case 2

invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V

goto :goto_0 #跳转到goto_0标号处

.line 27

:pswitch_3

sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

const/4 v2, 0x3 #case 3

invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V

goto :goto_0 #跳转到goto_0标号处

.line 16

nop

:pswitch_data_0

.packed-switch 0x0 #case区域，从0开始，依次递增

:pswitch_0

:pswitch_1

:pswitch_2

:pswitch_3

.end packed-switch

.end method

//写文件

publicvoid writeFileData(String fileName, String message) {

try {

FileOutputStream fout = openFileOutput(fileName, MODE_PRIVATE);

byte[] bytes = message.getBytes();

fout.write(bytes);

fout.close();

} catch (Exception e) {

e.printStackTrace();

}

---------------------------------------------------------------------------------------

//调用

const-string v0, "001.txt"

const-string v1, "test"

invoke-virtual {p0, v0, v1}, Lcom/example/writefiles/MainActivity;->writeFileData(Ljava/lang/String;Ljava/lang/String;)V

---------------------------------------------------------------------------------------

.method public writeFileData(Ljava/lang/String;Ljava/lang/String;)V

.locals 4

.parameter "fileName"

.parameter "message"

.prologue

.line 27

const/4 v3, 0x0

:try_start_0

invoke-virtual {p0, p1, v3}, Lcom/example/writefiles/MainActivity;->openFileOutput(Ljava/lang/String;I)Ljava/io/FileOutputStream;

move-result-object v2

.line 28

.local v2, fout:Ljava/io/FileOutputStream;

invoke-virtual {p2}, Ljava/lang/String;->getBytes()[B

move-result-object v0

.line 29

.local v0, bytes:[B

invoke-virtual {v2, v0}, Ljava/io/FileOutputStream;->write([B)V

.line 30

invoke-virtual {v2}, Ljava/io/FileOutputStream;->close()V

:try_end_0

.catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0

.line 34

.end local v0 #bytes:[B

.end local v2 #fout:Ljava/io/FileOutputStream;

:goto_0

return-void

.line 31

:catch_0

move-exception v1

.line 32

.local v1, e:Ljava/lang/Exception;

invoke-virtual {v1}, Ljava/lang/Exception;->printStackTrace()V

goto :goto_0

.end method