Android_smali_代码注入

//日志注入

const-string v8, "----->parameter1:"

invoke-static {v8, p1}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

   

//栈跟踪信息记录了程序从启动到printStackTrace()被执行期间所有被调用过的方法。

# virtual methods

.method public stack()V

    .locals 2

    .prologue

.line 20

    new-instance v0, Ljava/lang/Exception;

    const-string v1, "----->print trace"

    invoke-direct {v0, v1}, Ljava/lang/Exception;-><init>(Ljava/lang/String;)V

    invoke-virtual {v0}, Ljava/lang/Exception;->printStackTrace()V

    .line 21

    return-void

.end method

//转换string输出

//publicstaticvoid main(String[] args) {

// int number = 0;

// Log.i("----->", String.valueOf(number));

//}

.method public static main([Ljava/lang/String;)V

    .locals 3

    .parameter "args"

    .prologue

    .line 11

    const/4 v0, 0x0

.line 12

.local v0, number:I

    const-string v1, "----->"

    invoke-static {v0}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

    move-result-object v2

    invoke-static {v1, v2}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

    .line 13

    return-void

.end method

//byte数组转换字符串

# virtual methods

.method public byteToString([B)V

    .locals 3

    .parameter "paramArrayOfByte"

.prologue

:try_start_0

    new-instance v1, Ljava/lang/String;

    const-string v2, "UTF-8"

    invoke-direct {v1, p1, v2}, Ljava/lang/String;-><init>([BLjava/lang/String;)V

    .local v1, string:Ljava/lang/String;

    const-string v2, "----->"

invoke-static {v2, v1}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

    :try_end_0

    .catch Ljava/io/UnsupportedEncodingException; {:try_start_0 .. :try_end_0} :catch_0

    .end local v1           #string:Ljava/lang/String;

    :goto_0

    return-void

    :catch_0

    move-exception v0

    .local v0, e:Ljava/io/UnsupportedEncodingException;

    invoke-virtual {v0}, Ljava/io/UnsupportedEncodingException;->printStackTrace()V

goto :goto_0

.end method

//另一种byte数组转换字符串

new-instance v6, Ljava/lang/String;

invoke-direct {v6, v0}, Ljava/lang/String;-><init>([B)V

const-string v5, "----->d.smali_b([BIII)[B_return"

invoke-static {v5, v6}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

//JSON转字符串

   //v0寄存器代表JSONObject

   const-string v1, "-->json"

   invoke-virtual {v0}, Lorg/json/JSONObject;->toString()Ljava/lang/String;

   move-result-object v2

   invoke-static {v1, v2}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

则是因为很多指令不能够使用大于15的寄存器，故应该加上“move-object/from16 v1, px”语句进行转换。

//调用对象的toString方法 输出

   invoke-virtual {p0}, Lcom/huawei/appmarket/datasource/pojo/b;->toString()Ljava/lang/String;

   move-result-object v3

   const-string v2, "@@@@@>1a>pojo"

   invoke-static {v2, v3}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

//Int转换string

const-string v1, "----->"

    invoke-static {v0}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

    move-result-object v2

    invoke-static {v1, v2}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

//for( : ) 遍历

.method public static main([Ljava/lang/String;)V

    .locals 4

    .parameter "args"

    .prologue

    .line 18

    new-instance v0, Ljava/util/ArrayList;

    invoke-direct {v0}, Ljava/util/ArrayList;-><init>()V

    .line 19

    .local v0, list:Ljava/util/List;,"Ljava/util/List<Ljava/lang/String;>;"

    const-string v2, "a"

    invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z

    .line 20

    const-string v2, "b"

    invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z

    .line 21

    const-string v2, "c"

    invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z

    .line 22

    const-string v2, "d"

    invoke-interface {v0, v2}, Ljava/util/List;->add(Ljava/lang/Object;)Z

    .line 24

    invoke-interface {v0}, Ljava/util/List;->iterator()Ljava/util/Iterator;   #获取集合迭代器

    move-result-object v2

    :goto_0  #迭代循环开始

    invoke-interface {v2}, Ljava/util/Iterator;->hasNext()Z #开始迭代

    move-result v3

    if-nez v3, :cond_0 #如果迭代器不为空就跳走

    .line 27

    return-void

    .line 24

    :cond_0

    invoke-interface {v2}, Ljava/util/Iterator;->next()Ljava/lang/Object;  #循环获取每一项

    move-result-object v1 

    check-cast v1, Ljava/lang/String;

    .line 25

    .local v1, string:Ljava/lang/String;

    sget-object v3, Ljava/lang/System;->out:Ljava/io/PrintStream;

    invoke-virtual {v3, v1}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V

    goto :goto_0   #跳转到循环开始处

.end method

//for (int i = 0; i < 10; i++) {

// System.out.println(i);

//}

.method public static main([Ljava/lang/String;)V

    .locals 2

    .parameter "args"

    .prologue

    .line 15

    const/4 v0, 0x0

    .local v0, i:I #初始化v0为0

    :goto_0  #循环开始

    const/16 v1, 0xa

    if-lt v0, v1, :cond_0 #判断v0小于v1，则跳转到cond_0标号处

    .line 18

    return-void

    .line 16

    :cond_0

    sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

    invoke-virtual {v1, v0}, Ljava/io/PrintStream;->println(I)V

    .line 15

    add-int/lit8 v0, v0, 0x1 #下一个索引

    goto :goto_0   #跳转到循环起始处

.end method

int number = 1;

      switch (number) {

      case 0:

         System.out.println(0);

         break;

      case 1:

         System.out.println(1);

         break;

      case 2:

         System.out.println(2);

         break;

      case 3:

         System.out.println(3);

         break;

      default:

         break;

}

.method public static main([Ljava/lang/String;)V

    .locals 3

    .parameter "args"

    .prologue

    .line 15

    const/4 v0, 0x1

    .line 16

    .local v0, number:I

    packed-switch v0, :pswitch_data_0 #packed-switch分支，pswitch_data_0指定case区域

.line 32

    :goto_0  #所有case的出口

    return-void

    .line 18

    :pswitch_0

    sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

    const/4 v2, 0x0   #case 0

    invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V

    goto :goto_0 #跳转到goto_0标号处

    .line 21

    :pswitch_1

    sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

    const/4 v2, 0x1   #case 1

    invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V

    goto :goto_0 #跳转到goto_0标号处

    .line 24

    :pswitch_2

    sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

    const/4 v2, 0x2   #case 2

    invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V

    goto :goto_0 #跳转到goto_0标号处

    .line 27

    :pswitch_3

    sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

    const/4 v2, 0x3   #case 3

    invoke-virtual {v1, v2}, Ljava/io/PrintStream;->println(I)V

    goto :goto_0 #跳转到goto_0标号处

    .line 16

    nop

    :pswitch_data_0

    .packed-switch 0x0   #case区域，从0开始，依次递增

        :pswitch_0

        :pswitch_1

        :pswitch_2

        :pswitch_3

    .end packed-switch

.end method

//写文件

publicvoid writeFileData(String fileName, String message) {

try {

FileOutputStream fout = openFileOutput(fileName, MODE_PRIVATE);

byte[] bytes = message.getBytes();

fout.write(bytes);

   fout.close();

} catch (Exception e) {

   e.printStackTrace();

}

}

---------------------------------------------------------------------------------------

//调用

    const-string v0, "001.txt"

    const-string v1, "test"

    invoke-virtual {p0, v0, v1}, Lcom/example/writefiles/MainActivity;->writeFileData(Ljava/lang/String;Ljava/lang/String;)V

---------------------------------------------------------------------------------------

.method public writeFileData(Ljava/lang/String;Ljava/lang/String;)V

    .locals 4

    .parameter "fileName"

    .parameter "message"

    .prologue

    .line 27

    const/4 v3, 0x0

    :try_start_0

    invoke-virtual {p0, p1, v3}, Lcom/example/writefiles/MainActivity;->openFileOutput(Ljava/lang/String;I)Ljava/io/FileOutputStream;

    move-result-object v2

    .line 28

    .local v2, fout:Ljava/io/FileOutputStream;

    invoke-virtual {p2}, Ljava/lang/String;->getBytes()[B

    move-result-object v0

    .line 29

    .local v0, bytes:[B

    invoke-virtual {v2, v0}, Ljava/io/FileOutputStream;->write([B)V

    .line 30

    invoke-virtual {v2}, Ljava/io/FileOutputStream;->close()V

    :try_end_0

    .catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0

    .line 34

    .end local v0           #bytes:[B

    .end local v2           #fout:Ljava/io/FileOutputStream;

    :goto_0

    return-void

    .line 31

    :catch_0

    move-exception v1

    .line 32

    .local v1, e:Ljava/lang/Exception;

    invoke-virtual {v1}, Ljava/lang/Exception;->printStackTrace()V

    goto :goto_0

.end method