0.前言

本文是对 https://bbs.kanxue.com/thread-277086.htm 帖子中去ollvm混淆的实践记录

1.实践

ida 看so是被混淆了
图片描述
然后用unidbg 模拟执行代码如下：

public wvvvuwwu() {
    emulator = AndroidEmulatorBuilder  .for64Bit()  .build();
    Memory memory = emulator.getMemory();
    memory.setLibraryResolver(new AndroidResolver(23));
    //创建DalvikVM，利用apk本身，可以为null
    //如果用apk文件加载so的话，会自动处理签名方面的jni，具体可看AbstractJni,这就是利用apk加载的好处
    vm = emulator.createDalvikVM(new File("unidbg-android/src/test/resources/example_binaries/mianshi.apk"));
    vm.setJni(this);
    vm.setVerbose(true);
    DalvikModule dm = vm.loadLibrary("shpssdk", true);
    module = dm.getModule();
 
    cWvvvuwwu = vm.resolveClass("com/shopee/shpssdk/wvvvuwwu");
    wvvvuvvv = vm.resolveClass("com/shopee/shpssdk/wvvvuvvv");
    processFlt(module.base + 0x22F694, module.base + 0x23001C);
   // processFlt(module.base + 0x230020, module.base + 0x231148);
    dm.callJNI_OnLoad(emulator);
    System.out.println("");
}