将代码添加到 smali 源

Question

我有一个相关来源的 smali 代码：original_file.java:package com.android.commands.locksettings;import android.os.ResultReceiver;import android.os.ServiceManager;import android.os.ShellCallback;import com.android.internal.os.BaseCommand;import com.android.internal.widget.ILockSettings;import java.io.FileDescriptor;import java.io.PrintStream;public final class LockSettingsCmd extends BaseCommand {    private static final String USAGE =            "usage: locksettings set-pattern [--old OLD_CREDENTIAL] NEW_PATTERN\n" +            "       locksettings set-pin [--old OLD_CREDENTIAL] NEW_PIN\n" +            "       locksettings set-password [--old OLD_CREDENTIAL] NEW_PASSWORD\n" +            "       locksettings clear [--old OLD_CREDENTIAL]\n" +            "\n" +            "locksettings set-pattern: sets a pattern\n" +            "    A pattern is specified by a non-separated list of numbers that index the cell\n" +            "    on the pattern in a 1-based manner in left to right and top to bottom order,\n" +            "    i.e. the top-left cell is indexed with 1, whereas the bottom-right cell\n" +            "    is indexed with 9. Example: 1234\n" +            "\n" +            "locksettings set-pin: sets a PIN\n" +            "\n" +            "locksettings set-password: sets a password\n" +            "\n" +            "locksettings clear: clears the unlock credential\n";    public static void main(String[] args) {        (new LockSettingsCmd()).run(args);    }    @Override    public void onShowUsage(PrintStream out) {        out.println(USAGE);    }辑上面的 smali 文件并将代码添加到main函数中所以我在一个新的 java 文件中编写了相同的代码并将其编译为class文件，javac然后使用dx.jar将其转换为classes.dex并重新编译dex文件并获取 smali 代码注入但每次a 添加文件破解的代码并且永远不会工作。

Answer 1

当你编辑 smali 代码时，你应该小心处理寄存器。my_code的 main 方法有 5 个寄存器（即 4 个本地和 1 个参数），而original_file' 的 main 方法有 2 个寄存器（即 1 个本地和 1 个参数）。在添加my_codeto之前original_file，您应该决定需要多少寄存器。在这个例子中，5 个寄存器（即 4 个本地和 1 个参数）就足够了。

最终main方法（没有.line和.param指令）：

.method public static main([Ljava/lang/String;)V

    .registers 5

    .prologue

    array-length v1, p0

    const/4 v0, 0x0

    :goto_2

    if-ge v0, v1, :cond_e

    aget-object v2, p0, v0

    sget-object v3, Ljava/lang/System;->out:Ljava/io/PrintStream;

    invoke-virtual {v3, v2}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V

    add-int/lit8 v0, v0, 0x1

    goto :goto_2

    :cond_e

    new-instance v0, Lcom/android/commands/locksettings/LockSettingsCmd;

    invoke-direct {v0}, Lcom/android/commands/locksettings/LockSettingsCmd;-><init>()V

    invoke-virtual {v0, p0}, Lcom/android/commands/locksettings/LockSettingsCmd;->run([Ljava/lang/String;)V

    const/4 v0, 0x0

    invoke-virtual {v0, p0}, Ljava/io/PrintStream;->println(Ljava/lang/Object;)V

    return-void

.end method