Smali add debug log
up vote
0
down vote
favorite
For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:
- As methods usually use
v0tov15registers, i can use registersvxwhere15<x<256by declaring.registers 256in logger method but as stated here, some instructions can accept only first 16 registers. For exampleinvoke-staticuses 4 bits to encode each parameter register so i can not pass it registers likev50or so. So i need to useinvoke-static/rangeinstead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it) - In the beginning of the logger method, save first 16 registers inside some unused range such as
v100-v115, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.
Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.
add a comment |
up vote
0
down vote
favorite
For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:
- As methods usually use
v0tov15registers, i can use registersvxwhere15<x<256by declaring.registers 256in logger method but as stated here, some instructions can accept only first 16 registers. For exampleinvoke-staticuses 4 bits to encode each parameter register so i can not pass it registers likev50or so. So i need to useinvoke-static/rangeinstead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it) - In the beginning of the logger method, save first 16 registers inside some unused range such as
v100-v115, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.
Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:
- As methods usually use
v0tov15registers, i can use registersvxwhere15<x<256by declaring.registers 256in logger method but as stated here, some instructions can accept only first 16 registers. For exampleinvoke-staticuses 4 bits to encode each parameter register so i can not pass it registers likev50or so. So i need to useinvoke-static/rangeinstead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it) - In the beginning of the logger method, save first 16 registers inside some unused range such as
v100-v115, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.
Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.
For malware analysis purpose, i need to log some variables by modifying smali codes. I thought it would be a good idea to write a static logger method and add it to every class where i want to log some variable and then calling it inside other methods. As i have to make sure that i don't modify caller's registers, i came up with two options to write such a logger method:
- As methods usually use
v0tov15registers, i can use registersvxwhere15<x<256by declaring.registers 256in logger method but as stated here, some instructions can accept only first 16 registers. For exampleinvoke-staticuses 4 bits to encode each parameter register so i can not pass it registers likev50or so. So i need to useinvoke-static/rangeinstead. I don't know where to look and find other instructions with such limitation. (Actually i read Dalvik instruction format but couldn't understand it) - In the beginning of the logger method, save first 16 registers inside some unused range such as
v100-v115, do what i want with first 16 registers and at end of logger method, load back actual values of first 16 registers from that unused range.
Any comment on pros/cons of each option? Actually i prefer option 1 as it provides more registers and is easier to implement but i don't know if it can make problems with some instructions.
asked Nov 18 at 8:42
Mehran Torki
551624
551624
add a comment |
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53359178%2fsmali-add-debug-log%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown