Android smali逆向還原練習(xí)之switch case

一搂橙、背景
熟悉VC編譯器的朋友往弓，對switch case匯編代碼不會感到陌生旦装。
switch case 代碼基本分位3類：
1页衙、case分支小于等于3,數(shù)值連續(xù)。編譯器生成的匯編代碼阴绢，直接用 cmp [ebp+var_4], 0 jz short loc_401042之類指令代替
2店乐、case分支大于3小于等于256。編譯器會生成一張或者兩張table表呻袭，case分支通過查表找到代碼地址
2眨八、case分支大于3，數(shù)值很離散左电。編譯器會用平衡樹的結(jié)構(gòu)廉侧，即生成的代碼邏輯上構(gòu)成一顆平衡樹含长。

二、研究目的
Android apk軟件的逆向伏穆，一般的主戰(zhàn)場仍然在java層，有反調(diào)試和加固的apk除外纷纫。在jeb枕扫、jadx、jd-gui工具橫行的今天辱魁，很多時候我們不需要熟悉smali源碼烟瞧，直接使用工具反中間碼為java源碼就OK了。那還分析smali干嘛呢染簇？

熟悉smali中間代碼主要意義如下：
1参滴、在動態(tài)調(diào)試smali代碼時會比較有幫助
2、工具不管用情況下锻弓，需要靜態(tài)分析手工還原smali代碼為java代碼砾赔，會大大提高還原效率。
3青灼、給了我們一個窺探j(luò)ava 語法設(shè)計原理的方法

三暴心、這里只分析編譯器會生成table的情形

含有table表的switch case中間碼分兩種類型：
sparse-switch 和 packed-switch
它們兩的區(qū)別：
A packed-switch uses a simple jump table, indexed by the form low + n, where low is the lowest test value among the case labels, and n is the input to the switch. The values at each index represent the bytecode offsets for each case. Finding the correct jump address is a constant-time operation.
packed-switch 簡單實(shí)用跳表，實(shí)際上就是一個數(shù)組杂拨，數(shù)值元素是地址值专普。跳表索引值 = base值(low) + n

A sparse-switch uses a sorted list of key-value pairs, where each key is a test value from a caselabel, and the values are jump offsets. Finding the correct jump target for a lookupswitch requires a binary search on the key, so it is a logarithmic-time operation.
sparse-switch 實(shí)用鍵值對實(shí)現(xiàn)，一個key對應(yīng)一個地址值

3.1 sparse-switch 基本語法格式舉例：
sparse-switch v1, :sswitch_data_0
default: code
....
:sswitch_data_0
.sparse-switch
0x5ec5cc94 -> :sswitch_0
0x5ec5cc96 -> :sswitch_1
0x5ec5cc98 -> :sswitch_2
0x5ec5cc99 -> :sswitch_3
0x5ec5ccb0 -> :sswitch_4
.end sparse-switch

說明：上述代碼使用sparse 解析v1,如果查表成功則走入相應(yīng)的分支弹沽，如果查表不成功檀夹，則順序執(zhí)行（實(shí)際上走的是default分支）
第一case值是：0x5ec5cc94 ，第二個case值是0x5ec5cc96 ...

3.2 packed-switch 基本語法格式舉例：
packed-switch v0, :pswitch_data_0

default: code

:pswitch_data_0
.packed-switch 0x0
    :pswitch_0
    :pswitch_1
    :pswitch_2
    :pswitch_3
    :pswitch_4
.end packed-switch

說明：上述代碼 使用pswitch解析v0,如果查表成功則走入相應(yīng)的分支策橘，如果查表不成功炸渡，則順序執(zhí)行（實(shí)際上走的是default分支）
第一個case值是 0，第二個case值是 1 ...

舉一個實(shí)戰(zhàn)荔枝：

舉例smali源代碼：
.class public Lme/veryyoung/wechat/luckymoney/VersionParam;
.super Ljava/lang/Object;

static fields

.field public static getMessageClass:Ljava/lang/String;
.field public static getNetworkByModelMethod:Ljava/lang/String;
.field public static receiveUIFunctionName:Ljava/lang/String;
.field public static receiveUIParamName:Ljava/lang/String;

direct methods

.method static constructor <clinit>()V
.locals 1
const-string v0, "c"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vS"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.v.k"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bv"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
return-void
.end method
.method public constructor <init>()V
.locals 0
invoke-direct {p0}, Ljava/lang/Object;-><init>()V
return-void
.end method
.method public static init(Ljava/lang/String;)V
.locals 2
const/4 v0, -0x1
invoke-virtual {p0}, Ljava/lang/String;->hashCode()I
move-result v1
sparse-switch v1, :sswitch_data_0
:cond_0
:goto_0
packed-switch v0, :pswitch_data_0
const-string v0, "c"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vS"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.v.k"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bv"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
:goto_1
return-void
:sswitch_0
const-string v1, "6.3.23"
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x0
goto :goto_0
:sswitch_1
const-string v1, "6.3.25"
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x1
goto :goto_0
:sswitch_2
const-string v1, "6.3.27"
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x2
goto :goto_0
:sswitch_3
const-string v1, "6.3.28"
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x3
goto :goto_0
:sswitch_4
const-string v1, "6.3.30"
invoke-virtual {p0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1, :cond_0
const/4 v0, 0x4
goto :goto_0
:pswitch_0
const-string v0, "d"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vE"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.t.j"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bl"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_1
const-string v0, "d"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vF"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.t.j"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bl"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_2
const-string v0, "e"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "yj"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.u.k"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.br"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_3
const-string v0, "c"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vP"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.v.k"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bu"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto :goto_1
:pswitch_4
const-string v0, "c"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIFunctionName:Ljava/lang/String;
const-string v0, "vS"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getNetworkByModelMethod:Ljava/lang/String;
const-string v0, "com.tencent.mm.v.k"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->receiveUIParamName:Ljava/lang/String;
const-string v0, "com.tencent.mm.e.b.bv"
sput-object v0, Lme/veryyoung/wechat/luckymoney/VersionParam;->getMessageClass:Ljava/lang/String;
goto/16 :goto_1
:sswitch_data_0
.sparse-switch
0x5ec5cc94 -> :sswitch_0
0x5ec5cc96 -> :sswitch_1
0x5ec5cc98 -> :sswitch_2
0x5ec5cc99 -> :sswitch_3
0x5ec5ccb0 -> :sswitch_4
.end sparse-switch
:pswitch_data_0
.packed-switch 0x0
:pswitch_0
:pswitch_1
:pswitch_2
:pswitch_3
:pswitch_4
.end packed-switch
.end method

手工還原成java源代碼：
pakage me.veryyoung.wechat.luckymoney
public class VersionParam{
public static String getMessageClass;
public static String getNetworkByModelMethod;
public static String receiveUIFunctionName;
public static String receiveUIParamName;
static{//clinit
receiveUIFunctionName = "c";
getNetworkByModelMethod = "vS";
receiveUIParamName = "com.tencent.mm.v.k";
getMessageClass = "com.tencent.mm.e.b.bv";
}
public VersionParam(){
super();
}
public static init(String str){
int hashCode = str.hashCode();
int index = -1;
switch(hashCode){//sparse-switch
case 0x5ec5cc94:
if(str.equals("6.3.23")){
index = 0;
}
break;
case 0x5ec5cc96:
if(str.equals("6.3.25")){
index = 1;
}
break;
case 0x5ec5cc98:
if(str.equals("6.3.27")){
index = 2;
}
break;
case 0x5ec5cc99:
if(str.equals("6.3.28")){
index = 3;
}
break;
case 0x5ec5ccb0:
if(str.equals("6.3.30")){
index = 4;
}
default:
break;
}
switch(index){
case 0:
receiveUIFunctionName = "d";
getNetworkByModelMethod = "vE";
receiveUIParamName = "com.tencent.mm.t.j";
getMessageClass = "com.tencent.mm.e.b.bl";
break;
case 1:
receiveUIFunctionName = "d";
getNetworkByModelMethod = "vF";
receiveUIParamName = "com.tencent.mm.t.j";
getMessageClass = "com.tencent.mm.e.b.bl";

            break;
        case 2:
            receiveUIFunctionName = "e";
            getNetworkByModelMethod = "yj";
            receiveUIParamName = "com.tencent.mm.u.k";
            getMessageClass = "com.tencent.mm.e.b.br";
            break;
        case 3:
            receiveUIFunctionName = "c";
            getNetworkByModelMethod = "vP";
            receiveUIParamName = "com.tencent.mm.v.k";
            getMessageClass = "com.tencent.mm.e.b.bu";
            break;
        case 4:
            receiveUIFunctionName = "c";
            getNetworkByModelMethod = "vS";
            receiveUIParamName = "com.tencent.mm.v.k";
            getMessageClass = "com.tencent.mm.e.b.bv";
            break;
        default:
            receiveUIFunctionName = "c";
            getNetworkByModelMethod = "vS";
            receiveUIParamName = "com.tencent.mm.v.k";
            getMessageClass = "com.tencent.mm.e.b.bv";
            break;
    }
}

}

比較作者源代碼：
package me.veryyoung.wechat.luckymoney;
public class VersionParam {
public static String receiveUIFunctionName = "c";
public static String getNetworkByModelMethod = "vS";
public static String receiveUIParamName = "com.tencent.mm.v.k";
public static String getMessageClass = "com.tencent.mm.e.b.bv";
public static void init(String version) {
switch (version) {
case "6.3.23":
receiveUIFunctionName = "d";
getNetworkByModelMethod = "vE";
receiveUIParamName = "com.tencent.mm.t.j";
getMessageClass = "com.tencent.mm.e.b.bl";
break;
case "6.3.25":
receiveUIFunctionName = "d";
getNetworkByModelMethod = "vF";
receiveUIParamName = "com.tencent.mm.t.j";
getMessageClass = "com.tencent.mm.e.b.bl";
break;
case "6.3.27":
receiveUIFunctionName = "e";
getNetworkByModelMethod = "yj";
receiveUIParamName = "com.tencent.mm.u.k";
getMessageClass = "com.tencent.mm.e.b.br";
break;
case "6.3.28":
receiveUIFunctionName = "c";
getNetworkByModelMethod = "vP";
receiveUIParamName = "com.tencent.mm.v.k";
getMessageClass = "com.tencent.mm.e.b.bu";
break;
case "6.3.30":
receiveUIFunctionName = "c";
getNetworkByModelMethod = "vS";
receiveUIParamName = "com.tencent.mm.v.k";
getMessageClass = "com.tencent.mm.e.b.bv";
break;
default:
receiveUIFunctionName = "c";
getNetworkByModelMethod = "vS";
receiveUIParamName = "com.tencent.mm.v.k";
getMessageClass = "com.tencent.mm.e.b.bv";
}
}
}

最后編輯于 ：
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
  • 人面猴
    序言：七十年代末役纹，一起剝皮案震驚了整個濱河市偶摔，隨后出現(xiàn)的幾起案子，更是在濱河造成了極大的恐慌促脉，老刑警劉巖辰斋，帶你破解...
    沈念sama閱讀 222,590評論 6贊 517
  • 死咒
    序言：濱河連續(xù)發(fā)生了三起死亡事件，死亡現(xiàn)場離奇詭異瘸味，居然都是意外死亡宫仗，警方通過查閱死者的電腦和手機(jī)，發(fā)現(xiàn)死者居然都...
    沈念sama閱讀 95,157評論 3贊 399
  • 救了他兩次的神仙讓他今天三更去死
    文/潘曉璐 我一進(jìn)店門旁仿，熙熙樓的掌柜王于貴愁眉苦臉地迎上來藕夫，“玉大人孽糖，你說我怎么就攤上這事∫阒” “怎么了办悟？”我有些...
    開封第一講書人閱讀 169,301評論 0贊 362
  • 道士緝兇錄：失蹤的賣姜人
    文/不壞的土叔 我叫張陵，是天一觀的道長滩褥。 經(jīng)常有香客問我病蛉，道長，這世上最難降的妖魔是什么瑰煎？ 我笑而不...
    開封第一講書人閱讀 60,078評論 1贊 300
  • ?港島之戀（遺憾婚禮）
    正文 為了忘掉前任铺然，我火速辦了婚禮，結(jié)果婚禮上酒甸，老公的妹妹穿的比我還像新娘魄健。我一直安慰自己，他們只是感情好插勤，可當(dāng)我...
    茶點(diǎn)故事閱讀 69,082評論 6贊 398
  • 惡毒庶女頂嫁案：這布局不是一般人想出來的
    文/花漫 我一把揭開白布沽瘦。 她就那樣靜靜地躺著，像睡著了一般农尖。 火紅的嫁衣襯著肌膚如雪其垄。 梳的紋絲不亂的頭發(fā)上，一...
    開封第一講書人閱讀 52,682評論 1贊 312
  • 城市分裂傳說
    那天卤橄，我揣著相機(jī)與錄音绿满，去河邊找鬼。 笑死窟扑，一個胖子當(dāng)著我的面吹牛喇颁，可吹牛的內(nèi)容都是我干的。 我是一名探鬼主播嚎货，決...
    沈念sama閱讀 41,155評論 3贊 422
  • 雙鴛鴦連環(huán)套：你想象不到人心有多黑
    文/蒼蘭香墨 我猛地睜開眼橘霎，長吁一口氣：“原來是場噩夢啊……” “哼！你這毒婦竟也來了殖属？” 一聲冷哼從身側(cè)響起姐叁，我...
    開封第一講書人閱讀 40,098評論 0贊 277
  • 萬榮殺人案實(shí)錄
    序言：老撾萬榮一對情侶失蹤，失蹤者是張志新（化名）和其女友劉穎洗显，沒想到半個月后外潜，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體，經(jīng)...
    沈念sama閱讀 46,638評論 1贊 319
  • ?護(hù)林員之死
    正文 獨(dú)居荒郊野嶺守林人離奇死亡挠唆，尸身上長有42處帶血的膿包…… 初始之章·張勛 以下內(nèi)容為張勛視角 年9月15日...
    茶點(diǎn)故事閱讀 38,701評論 3贊 342
  • ?白月光啟示錄
    正文 我和宋清朗相戀三年处窥，在試婚紗的時候發(fā)現(xiàn)自己被綠了。 大學(xué)時的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片玄组。...
    茶點(diǎn)故事閱讀 40,852評論 1贊 353
  • 活死人
    序言：一個原本活蹦亂跳的男人離奇死亡滔驾，死狀恐怖谒麦，靈堂內(nèi)的尸體忽然破棺而出，到底是詐尸還是另有隱情哆致，我是刑警寧澤绕德，帶...
    沈念sama閱讀 36,520評論 5贊 351
  • ?日本核電站爆炸內(nèi)幕
    正文 年R本政府宣布，位于F島的核電站摊阀，受9級特大地震影響迁匠，放射性物質(zhì)發(fā)生泄漏。R本人自食惡果不足惜驹溃，卻給世界環(huán)境...
    茶點(diǎn)故事閱讀 42,181評論 3贊 335
  • 男人毒藥：我在死后第九天來索命
    文/蒙蒙 一、第九天 我趴在偏房一處隱蔽的房頂上張望延曙。 院中可真熱鬧豌鹤，春花似錦、人聲如沸枝缔。這莊子的主人今日做“春日...
    開封第一講書人閱讀 32,674評論 0贊 25
  • 一樁弒父案，背后竟有這般陰謀
    文/蒼蘭香墨 我抬頭看了看天上的太陽愿卸。三九已至灵临，卻和暖如春，著一層夾襖步出監(jiān)牢的瞬間趴荸，已是汗流浹背儒溉。 一陣腳步聲響...
    開封第一講書人閱讀 33,788評論 1贊 274
  • 情欲美人皮
    我被黑心中介騙來泰國打工， 沒想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留发钝，地道東北人顿涣。 一個月前我還...
    沈念sama閱讀 49,279評論 3贊 379
  • 代替公主和親
    正文 我出身青樓，卻偏偏與公主長得像酝豪，于是被迫代替她去往敵國和親涛碑。 傳聞我的和親對象是個殘疾皇子，可洞房花燭夜當(dāng)晚...
    茶點(diǎn)故事閱讀 45,851評論 2贊 361

推薦閱讀更多精彩內(nèi)容

  • 前言 附參考鏈接:smali文件語法參考 類型 字節(jié)碼類型描述符 其中L類型可以表示Java類型中的任何類.例如 ...
    Bui_vlee閱讀 4,153評論 1贊 3
  • 安卓逆向系列教程（一）Dalvik 指令集 作者：飛龍 寄存器 Dalvik 指令集完全基于寄存器孵淘，也就是說蒲障，沒有...
    布客飛龍閱讀 2,068評論 0贊 28
  • smali學(xué)習(xí) 數(shù)據(jù)類型dalvik字節(jié)碼有兩種數(shù)據(jù)類型，原始類型和引用類型瘫证。對象和數(shù)組是引用類型揉阎，其他都是原始類...
    臥槽歡爺閱讀 1,277評論 2贊 2
  • Spring Cloud為開發(fā)人員提供了快速構(gòu)建分布式系統(tǒng)中一些常見模式的工具（例如配置管理，服務(wù)發(fā)現(xiàn)背捌，斷路器余黎，智...
    卡卡羅2017閱讀 134,715評論 18贊 139
  • 8月份的自己總是因?yàn)楣ぷ鞫鵁谰宀疲踔烈恢币驗(yàn)樵诤踝约旱膽艨诖婵钍?而在痛苦巡扇，在傷心，甚至吃不下垮衷，睡不著厅翔，擔(dān)心著接下...
    張艾婷閱讀 369評論 0贊 0