Smali add debug log











up vote
0
down vote

favorite












For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:




  1. As methods usually use v0 to v15 registers, i can use registers vx where 15<x<256 by declaring .registers 256 in logger method but as stated here, some instructions can accept only first 16 registers. For example invoke-static uses 4 bits to encode each parameter register so i can not pass it registers like v50 or so. So i need to use invoke-static/range instead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it)

  2. In the beginning of the logger method, save first 16 registers inside some unused range such as v100-v115, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.


Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.










share|improve this question


























    up vote
    0
    down vote

    favorite












    For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:




    1. As methods usually use v0 to v15 registers, i can use registers vx where 15<x<256 by declaring .registers 256 in logger method but as stated here, some instructions can accept only first 16 registers. For example invoke-static uses 4 bits to encode each parameter register so i can not pass it registers like v50 or so. So i need to use invoke-static/range instead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it)

    2. In the beginning of the logger method, save first 16 registers inside some unused range such as v100-v115, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.


    Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.










    share|improve this question
























      up vote
      0
      down vote

      favorite









      up vote
      0
      down vote

      favorite











      For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:




      1. As methods usually use v0 to v15 registers, i can use registers vx where 15<x<256 by declaring .registers 256 in logger method but as stated here, some instructions can accept only first 16 registers. For example invoke-static uses 4 bits to encode each parameter register so i can not pass it registers like v50 or so. So i need to use invoke-static/range instead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it)

      2. In the beginning of the logger method, save first 16 registers inside some unused range such as v100-v115, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.


      Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.










      share|improve this question













      For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:




      1. As methods usually use v0 to v15 registers, i can use registers vx where 15<x<256 by declaring .registers 256 in logger method but as stated here, some instructions can accept only first 16 registers. For example invoke-static uses 4 bits to encode each parameter register so i can not pass it registers like v50 or so. So i need to use invoke-static/range instead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it)

      2. In the beginning of the logger method, save first 16 registers inside some unused range such as v100-v115, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.


      Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.







      android smali






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Nov 18 at 8:42









      Mehran Torki

      551624




      551624





























          active

          oldest

          votes











          Your Answer






          StackExchange.ifUsing("editor", function () {
          StackExchange.using("externalEditor", function () {
          StackExchange.using("snippets", function () {
          StackExchange.snippets.init();
          });
          });
          }, "code-snippets");

          StackExchange.ready(function() {
          var channelOptions = {
          tags: "".split(" "),
          id: "1"
          };
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function() {
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled) {
          StackExchange.using("snippets", function() {
          createEditor();
          });
          }
          else {
          createEditor();
          }
          });

          function createEditor() {
          StackExchange.prepareEditor({
          heartbeatType: 'answer',
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader: {
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          },
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          });


          }
          });














           

          draft saved


          draft discarded


















          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53359178%2fsmali-add-debug-log%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown






























          active

          oldest

          votes













          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes
















           

          draft saved


          draft discarded



















































           


          draft saved


          draft discarded














          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53359178%2fsmali-add-debug-log%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          Popular posts from this blog

          Costa Masnaga

          Fotorealismo

          Sidney Franklin