classes.dex memory dump

메모리 및 파일에 프로세스에 매핑 된 classes.dex를 저장하는 방법입니다.

저장 중에 ptrace가 실패할 경우 0xdeadbeef 가 저장됩니다.

#include <stdio.h> #include <stdlib.h> #include <sys/mman.h> #include <dirent.h> #include <stdbool.h> #include <fcntl.h> #include <errno.h> #include <sys/ptrace.h> #define APK_NAME "codetronik.rootchecker" pid_t GetPid(const char* process_name) { DIR* dir = opendir("/proc"); if (dir == NULL) { return -1; } struct dirent* entry; while ((entry = readdir(dir)) != NULL) { int pid = atoi(entry->d_name); if (pid == 0) { continue; } char path[128]; snprintf(path, 128, "/proc/%d/cmdline", pid); FILE *fp = fopen(path, "r"); char temp_name[128]; if (fp == NULL) { continue; } fgets(temp_name, 128, fp); fclose(fp); if (0 == strcmp(process_name, temp_name)) { return pid; } } return -1; } int main(int argc, char **argv) { long success; FILE *maps = NULL; int fd = 0; unsigned char* pDexMem = NULL; pid_t pid = GetPid(APK_NAME); if (-1 == pid) { printf("no process\n"); goto EXIT_ERROR; } char buf_line[512]; size_t memSize = 0; size_t imageStartAddr = 0; size_t imageEndAddr = 0; char pidPath[128]; sprintf(pidPath, "/proc/%d/maps", pid); maps = fopen(pidPath, "r"); bool first = true; while (fgets(buf_line, 512, maps)) { if (strstr(buf_line, "classes.dex") && strstr(buf_line, APK_NAME)) { size_t temp1 = 0; size_t temp2 = 0; sscanf(buf_line, "%zx-%zx", &temp1, &temp2); printf("%s",buf_line); if (first == true) { imageStartAddr = temp1; first = false; } if (temp2 > imageEndAddr) { imageEndAddr = temp2; } } } printf("start %zx end %zx\n", imageStartAddr, imageEndAddr); if (0 == imageStartAddr || 0 == imageEndAddr) { printf("cannot find classes.dex\n"); goto EXIT_ERROR; } fclose(maps); maps = NULL; memSize = imageEndAddr - imageStartAddr; pDexMem = malloc(memSize); fd = open("memory", O_WRONLY | O_TRUNC | O_CREAT, 0777); if (-1 == fd) { printf("cannot create file.\n"); goto EXIT_ERROR; } success = ptrace(PTRACE_ATTACH, pid, NULL, NULL); if (-1 == success) { printf("process attach error\n"); goto EXIT_ERROR; } int i; for (i = 0; imageStartAddr + i < imageEndAddr; i = i + sizeof(long)) { long data; data = ptrace(PTRACE_PEEKDATA, pid, (void *)imageStartAddr + i, NULL); if (-1 == data) { data = 0xdeadbeef; printf("peekdata error! address : %zx (%d)\n", imageStartAddr+i, errno); } // write to local var memcpy(pDexMem + i, &data, sizeof(long)); ssize_t written = write(fd, &data, sizeof(long)); if (-1 == written) { printf("writing error!\n"); goto EXIT_ERROR; } } ptrace(PTRACE_DETACH, pid, NULL, NULL); goto EXIT; EXIT_ERROR: EXIT: if (fd) { close(fd); } if (maps) { fclose(maps); } if (pDexMem) { free(pDexMem); } return 0; }