Smali add debug log
up vote
0
down vote
favorite
For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static
logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:
- As methods usually use
v0
tov15
registers, i can use registersvx
where15<x<256
by declaring.registers 256
in logger method but as stated here, some instructions can accept only first 16 registers. For exampleinvoke-static
uses 4 bits to encode each parameter register so i can not pass it registers likev50
or so. So i need to useinvoke-static/range
instead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it) - In the beginning of the logger method, save first 16 registers inside some unused range such as
v100-v115
, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.
Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.
android smali
add a comment |
up vote
0
down vote
favorite
For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static
logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:
- As methods usually use
v0
tov15
registers, i can use registersvx
where15<x<256
by declaring.registers 256
in logger method but as stated here, some instructions can accept only first 16 registers. For exampleinvoke-static
uses 4 bits to encode each parameter register so i can not pass it registers likev50
or so. So i need to useinvoke-static/range
instead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it) - In the beginning of the logger method, save first 16 registers inside some unused range such as
v100-v115
, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.
Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.
android smali
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static
logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:
- As methods usually use
v0
tov15
registers, i can use registersvx
where15<x<256
by declaring.registers 256
in logger method but as stated here, some instructions can accept only first 16 registers. For exampleinvoke-static
uses 4 bits to encode each parameter register so i can not pass it registers likev50
or so. So i need to useinvoke-static/range
instead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it) - In the beginning of the logger method, save first 16 registers inside some unused range such as
v100-v115
, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.
Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.
android smali
For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static
logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:
- As methods usually use
v0
tov15
registers, i can use registersvx
where15<x<256
by declaring.registers 256
in logger method but as stated here, some instructions can accept only first 16 registers. For exampleinvoke-static
uses 4 bits to encode each parameter register so i can not pass it registers likev50
or so. So i need to useinvoke-static/range
instead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it) - In the beginning of the logger method, save first 16 registers inside some unused range such as
v100-v115
, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.
Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.
android smali
android smali
asked Nov 18 at 8:42
Mehran Torki
551624
551624
add a comment |
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53359178%2fsmali-add-debug-log%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown