forked from CalebFenton/simplify
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ideas.txt
59 lines (38 loc) · 2.27 KB
/
ideas.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
6494727's phone/b;->a([Ljava/lang/String;) is not working and looks like it should
whitelist methods
many Class.is*, other stuff
emulate
Ljava/lang/Class;->getMethod(Ljava/lang/String;[Ljava/lang/Class;)Ljava/lang/reflect/Method;
return methods from any whitelisted class
getField() - emulated methods should support many Class.* methods, either as part of the interface, or inherited
if they're inherited, base class can implement all of them and return unknown values of the correct type
Ljava/lang/reflect/Method;->invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;
invoke ourselves or run emulated method
Ljava/lang/Class;->forName(Ljava/lang/String;)Ljava/lang/Class;
easy: return any whitelisted class
hard: easy + do something with emulated classes
Emulate / spoof stack traces
new-instance v1, Ljava/lang/Exception;
invoke-direct {v1}, Ljava/lang/Exception;-><init>()V
invoke-virtual {v1}, Ljava/lang/Exception;->getStackTrace()[Ljava/lang/StackTraceElement;
invoke-virtual {v1}, Ljava/lang/StackTraceElement;->getMethodName()Ljava/lang/String;
move-result-object v2
invoke-direct {v0, v2}, Ljava/lang/StringBuffer;-><init>(Ljava/lang/String;)V
invoke-virtual {v1}, Ljava/lang/StackTraceElement;->getClassName()Ljava/lang/String;
invoke-static {}, Ljava/lang/Thread;->currentThread()Ljava/lang/Thread;
move-result-object v2
invoke-virtual {v2}, Ljava/lang/Thread;->getStackTrace()[Ljava/lang/StackTraceElement;
Hashcode? / Equals?
ExecutionNode, Op, *State, etc.
Success stories
java -jar simplify/build/libs/simplify-0.1.0-all.jar -i 6247332 -it 'Configs;-><clinit>'
java -Xmx6g -jar simplify/build/libs/simplify-0.1.0-all.jar -i 7958300/smali -it '/smv;'
Android class lifecycle initialization
sometimes it can be assumed onCreate has been called
or just give a list of methods to be called before whatever else
java -jar simplify/build/libs/simplify-0.1.0-all.jar -i 7604399 -it 'PornApplication;->i2c1cqop3faop3cdhokggmd97ce\(\)'
ArrayLists are initialized in onCreate, but since that's not known, everything fails
allow emulated methods to handle unknown values
two issues:
inner classes are not always resolved properly, should add tests for this, look at base64$coder
methods with arrays, like anything in 8748278, don't optimize correctly