unidbg 控制臺(tái)調(diào)試

最近在學(xué)習(xí)使用unidgb,調(diào)試模式學(xué)起來(lái)
unidgb 有3種調(diào)試模式:

public enum  DebuggerType {

    /**
     * console debugger
     */
    CONSOLE,

    /**
     * gdb server
     */
    GDB_SERVER,

    /**
     * ida android server v7.x
     */
    ANDROID_SERVER_V7

}

源碼寫(xiě)得很清楚了,分別是 CONSOLE、GDB_SERVER、ANDROID_SERVER_V7
暫時(shí)只懂CONSOLE模式,那就分享下吧

開(kāi)啟調(diào)試模式:

只需要增加下面得代碼,自己決定在哪個(gè)位置斷點(diǎn)

       Debugger MyDbg = emulator.attach(DebuggerType.CONSOLE);
       MyDbg.addBreakPoint(module.base + 0x2D180); //斷點(diǎn)地址

調(diào)試方法

運(yùn)行得時(shí)候,就會(huì)自動(dòng)斷點(diǎn)了,控制臺(tái)模式最重要得是知道命令:(unidbg會(huì)有提示的)

c: continue
n: step over
bt: back trace

st hex: search stack
shw hex: search writable heap
shr hex: search readable heap
shx hex: search executable heap

nb: break at next block
s|si: step into
s[decimal]: execute specified amount instruction
s(blx): execute util BLX mnemonic, low performance

m(op) [size]: show memory, default size is 0x70, size may hex or decimal
mr0-mr7, mfp, mip, msp [size]: show memory of specified register
m(address) [size]: show memory of specified address, address must start with 0x

wr0-wr7, wfp, wip, wsp <value>: write specified register
wb(address), ws(address), wi(address) <value>: write (byte, short, integer) memory of specified address, address must start with 0x
wx(address) <hex>: write bytes to memory at specified address, address must start with 0x

b(address): add temporarily breakpoint, address must start with 0x, can be module offset
b: add breakpoint of register PC
r: remove breakpoint of register PC
blr: add temporarily breakpoint of register LR

p (assembly): patch assembly at PC address
where: show java stack trace

trace [begin end]: Set trace instructions
traceRead [begin end]: Set trace memory read
traceWrite [begin end]: Set trace memory write
vm: view loaded modules
vbs: view breakpoints
d|dis: show disassemble
d(0x): show disassemble at specify address
stop: stop emulation
run [arg]: run test
cc size: convert asm from 0x4002d182 - 0x4002d182 + size bytes to c function

命令簡(jiǎn)單學(xué)習(xí)

暫時(shí)會(huì)的命令說(shuō)明類比(同idea類比)下(好記性不如爛筆頭):
c - F8
n - F9
d - Varibles 窗口
用法:
輸入:

d

輸出:

>>> r0=0x40252020 r1=0x6b23c r2=0x0 r3=0x4026c2e0 r4=0x40267014 r5=0x40093184 r6=0xbffff598 r7=0xbffff628 r8=0x40 sb=0x40267000 sl=0x4025b000 fp=0x40262000 ip=0x0
>>> SP=0xbffff598 LR=RX@0x4002d4e3[libshield.so]0x2d4e3 PC=RX@0x4002d182[libshield.so]0x2d182 cpsr: N=0, Z=1, C=0, V=0, T=1, mode=0b10000
>>> d0=0xbd3af23545081191(-9.573186805205375E-14) d1=0x450811a1c5537ed3(3.6371855057004556E24) d2=0x85845dd1f5ef2486(-4.3827848637617155E-282) d3=0xf99926e0850ccceb(-5.573219977953539E277) d4=0xe6dc88e5d9dcd039(-3.1039270277906248E187) d5=0x1fa27cf9048c1d05(2.693185673467624E-156) d6=0xc4ac56656d9d6122(-6.690999509074994E22) d7=0xf4292244fde5391c(-3.5990317572527574E251)
>>> d8=0x0(0.0) d9=0x0(0.0) d10=0x0(0.0) d11=0x0(0.0) d12=0x0(0.0) d13=0x0(0.0) d14=0x0(0.0) d15=0x0(0.0)

m - watch
用法:

  1. mr0-mr7, mfp, mip, msp [size]: show memory of specified register

輸入:

mr0

輸出:

>-----------------------------------------------------------------------------<
[14:52:49 656]r0=RW@0x40252020, md5=b3813ce3812ac6d7ae18234b34b78b89, hex=843109400000000080c1264051d10240000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
size: 112
0000: 84 31 09 40 00 00 00 00 80 C1 26 40 51 D1 02 40    .1.@......&@Q..@
0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
^-----------------------------------------------------------------------------^
  1. m(address) [size]: show memory of specified address, address must start with 0x
    輸入:
m0x40252020

輸出:

>-----------------------------------------------------------------------------<
[14:53:20 002]RW@0x40252020, md5=b3813ce3812ac6d7ae18234b34b78b89, hex=843109400000000080c1264051d10240000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
size: 112
0000: 84 31 09 40 00 00 00 00 80 C1 26 40 51 D1 02 40    .1.@......&@Q..@
0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
^-----------------------------------------------------------------------------^

網(wǎng)上看到的用法

image.png

暫時(shí)解鎖這些,之后其他命令有用到,繼續(xù)更新

最后編輯于
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成,瀏覽時(shí)請(qǐng)結(jié)合常識(shí)與多方信息審慎甄別。
平臺(tái)聲明:文章內(nèi)容(如有圖片或視頻亦包括在內(nèi))由作者上傳并發(fā)布,文章內(nèi)容僅代表作者本人觀點(diǎn),簡(jiǎn)書(shū)系信息發(fā)布平臺(tái),僅提供信息存儲(chǔ)服務(wù)。

相關(guān)閱讀更多精彩內(nèi)容

友情鏈接更多精彩內(nèi)容