yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): harness onLoad迭代修复 - 全局槽补丁过引用计数关 (R22)

Browse Source 
- 0x48a90槽NULL崩溃 -> dummy对象补丁 -> 推进到vtable空跳
- 根因: turing类定义缺失(需ProxyClassFactory或C结构对象模型)
- TuringProbe.java: gap+类+槽三级补丁可复现
This commit is contained in:
yml2213
2026-08-29 07:13:22 +08:00
parent 47bc38d638
commit c85693e790
2 changed files with 77 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/unidbg/hydev/src/hydev/TuringProbe.java
+58 -6
View File
@@ -82,11 +82,22 @@ public class TuringProbe {
} catch (Throwable t2) {
System.out.println("[TP] gap map EXC " + t2);
}
// 全局槽基础补丁: base+0x48a90 读取为 NULL -> 塞一个 8B dummy 对象 (引用计数目标)
try {
long slot = m.base + 0x48a90;
com.github.unidbg.pointer.UnidbgPointer dummyPtr = emulator.getMemory().mmap(8, 7);
dummyPtr.setMemory(0, 8, (byte) 0);
com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, slot).setPointer(0, dummyPtr);
System.out.println("[TP] global slot 0x48a90 <- " + Long.toHexString(dummyPtr.peer));
} catch (Throwable t4) {
System.out.println("[TP] slot patch EXC " + t4);
}
try {
dm.callJNI_OnLoad(emulator);
System.out.println("[TP] libturingmfa JNI_OnLoad OK");
} catch (Throwable t3) {
System.out.println("[TP] onLoad EXC: " + t3);
regDump();
}
break;
}
@@ -98,12 +109,20 @@ public class TuringProbe {
} catch (Throwable t) {
System.out.println("[TP] load " + which + " EXC: " + t);
try {
com.github.unidbg.arm.ARM emu = (com.github.unidbg.arm.ARM) emulator;
java.lang.reflect.Field f = emulator.getClass().getSuperclass().getDeclaredField("backend");
f.setAccessible(true);
Object be = f.get(emulator);
java.lang.reflect.Method pc = be.getClass().getMethod("reg_read", int.class);
System.out.println("[TP] PC=" + Long.toHexString(((Number) pc.invoke(be, com.github.unidbg.arm.backend.Unicorn2Factory.class.getField("UC_ARM64_REG_PC").getLong(null))).longValue()));
com.github.unidbg.arm.backend.Backend be = emulator.getBackend();
int[] regs = {unicorn.Arm64Const.UC_ARM64_REG_PC,
unicorn.Arm64Const.UC_ARM64_REG_X0,
unicorn.Arm64Const.UC_ARM64_REG_X1,
unicorn.Arm64Const.UC_ARM64_REG_X8,
unicorn.Arm64Const.UC_ARM64_REG_X19,
unicorn.Arm64Const.UC_ARM64_REG_LR,
unicorn.Arm64Const.UC_ARM64_REG_SP};
String[] names = {"PC","X0","X1","X8","X19","LR","SP"};
for (int k=0;k<regs.length;k++) {
long v = be.reg_read(regs[k]).longValue();
System.out.println("[TP] " + names[k] + "=" + Long.toHexString(v)
+ (v>=0x12000000L ? " (mod-rel " + Long.toHexString(v - 0x12012000L) + ")" : ""));
}
} catch (Throwable t2) {
System.out.println("[TP] pc-dump fail " + t2);
}
@@ -111,6 +130,39 @@ public class TuringProbe {
}
}
void regDump() {
try {
com.github.unidbg.arm.backend.Backend be = emulator.getBackend();
// 反汇编调用者区域 (LR-0x40 .. LR+0x60)
try {
long lr = be.reg_read(unicorn.Arm64Const.UC_ARM64_REG_LR).longValue();
StringBuilder sb = new StringBuilder();
capstone.api.Instruction[] ins = emulator.disassemble(lr - 0x40, 0xa8, 0);
for (capstone.api.Instruction i : ins) sb.append(String.format(" 0x%x: %s %s%n", i.getAddress(), i.getMnemonic(), i.getOpStr() == null ? "" : i.getOpStr()));
String dasm = sb.toString();
System.out.println("[TP] dasm@caller:\n" + dasm);
} catch (Throwable t5) { System.out.println("[TP] dasm fail " + t5); }
int[] regs = {unicorn.Arm64Const.UC_ARM64_REG_PC, unicorn.Arm64Const.UC_ARM64_REG_X0,
unicorn.Arm64Const.UC_ARM64_REG_X1, unicorn.Arm64Const.UC_ARM64_REG_X2,
unicorn.Arm64Const.UC_ARM64_REG_X8, unicorn.Arm64Const.UC_ARM64_REG_X19,
unicorn.Arm64Const.UC_ARM64_REG_X20, unicorn.Arm64Const.UC_ARM64_REG_LR,
unicorn.Arm64Const.UC_ARM64_REG_SP};
String[] names = {"PC","X0","X1","X2","X8","X19","X20","LR","SP"};
for (int k=0;k<regs.length;k++) {
long v = be.reg_read(regs[k]).longValue();
String rel = (v>=0x12012000L && v<0x12018000L) ? " (rel 0x" + Long.toHexString(v - 0x12012000L) + ")" : "";
System.out.println("[TP] " + names[k] + "=0x" + Long.toHexString(v) + rel);
}
// 尝试读 x0 处内存
try {
long x0 = be.reg_read(unicorn.Arm64Const.UC_ARM64_REG_X0).longValue();
com.github.unidbg.pointer.UnidbgPointer pp = com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, x0);
byte[] b = pp.getByteArray(0, 32);
System.out.println("[TP] *X0 = " + java.util.HexFormat.of().formatHex(b));
} catch (Throwable t4) { System.out.println("[TP] *X0 unreadable " + t4); }
} catch (Throwable t2) { System.out.println("[TP] regDump fail " + t2); }
}
/** 直调 mfa 的 b87_ (impl@0x25c98) — JNI: (env, thiz, SparseArray, byte[], Map, int) -> SparseArray */
void callEnc(String blobPath) {
try {