yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(huya): b87_ harness直调执行通过(ret=-1=初始化态缺失) (R21补)

Browse Source
This commit is contained in:
yml2213
2026-08-29 07:07:59 +08:00
parent dc109c5dba
commit 47bc38d638
2 changed files with 15 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/unidbg/hydev/src/hydev/TuringProbe.java
+9 -4
View File
@@ -123,11 +123,16 @@ public class TuringProbe {
DvmObject<?> sa = vm.resolveClass("android/util/SparseArray").newObject(null);
DvmObject<?> dba = vm.resolveClass("[B").newObject(blob);
DvmObject<?> map = vm.resolveClass("java/util/HashMap").newObject(null);
// 直调 impl: module.base + 0x25c98; 参数: env, null, sa, dba, map, 1
// 直调 impl: module.base + 0x25c98; 参数: env, null, 局部引用句柄(int), ..., 1
long fn = m.base + 0x25c98;
System.out.println("[TP] calling b87_ @ " + Long.toHexString(fn) + " blob=" + blob.length + "B");
Number ret = m.callFunction(emulator, fn, vm.getJavaVM(), null, sa, dba, map, 1);
System.out.println("[TP] b87_ ret=" + ret);
int hsa = vm.addLocalObject(sa);
int hba = vm.addLocalObject(dba);
int hmap = vm.addLocalObject(map);
System.out.println("[TP] calling b87_ @ " + Long.toHexString(fn) + " blob=" + blob.length
+ " refs hsa=" + hsa + " hba=" + hba + " hmap=" + hmap);
int iv = Integer.parseInt(System.getenv().getOrDefault("TP_INT", "1"));
Number ret = m.callFunction(emulator, fn, vm.getJavaVM(), null, hsa, hba, hmap, iv);
System.out.println("[TP] b87_ ret=" + ret + " int=" + iv + " blob=" + blobPath);
} catch (Throwable t) {
System.out.println("[TP] callEnc EXC " + t);
t.printStackTrace(System.out);