Smali类型转换为原始类型

时间:2015-09-06 19:22:58

标签: android dalvik smali

我收到以下dalvikvm验证程序错误:

Line 1041: W/dalvikvm( 2610): VFY: register1 v5 type 13, wanted 5
Line 1042: W/dalvikvm( 2610): VFY:  rejecting opcode 0x70 at 0x0032
Line 1043: W/dalvikvm( 2610): VFY:  rejected Lcom/cleanmaster/notification/aj;.b 

Smali代码:

.method private b(Lcom/cleanmaster/notification/normal/NotificationSetting;Lcom/cleanmaster/notification/normal/o;Landroid/widget/RemoteViews;)V
.registers 11
.prologue
const/4 v5, 0x1
.line 126
iget-object v0, p2, Lcom/cleanmaster/notification/normal/o;->s:Landroid/content/Intent;
if-eqz v0, :cond_c
.line 127
iget-object v0, p2, Lcom/cleanmaster/notification/normal/o;->s:Landroid/content/Intent;
.line 128
const-string v1, "notify_style_type"
.line 129
invoke-static {v5}, Ljava/lang/Byte;->valueOf(B)Ljava/lang/Byte;
move-result-object v5
const-string v6, "putExtra(Ljava/lang/String;B)Landroid/content/Intent;"
invoke-static {v6, v0, v1, v5}, La;->c(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
invoke-virtual {v5}, Ljava/lang/Byte;->byteValue()B
move-result v5
:cond_c
.line 130
invoke-static {}, Lcom/keniu/security/c;->a()Landroid/content/Context;
move-result-object v1
.line 131
const-string v0, "notification"
.line 132
const-string v6, "getSystemService(Ljava/lang/String;)Ljava/lang/Object;"
invoke-static {v6, v1, v0}, Lb;->a(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
move-result-object v6
check-cast v6, Ljava/lang/Object;
move-object v0, v6
check-cast v0, Landroid/app/NotificationManager;
iget-boolean v2, p1, Lcom/cleanmaster/notification/normal/NotificationSetting;->i:Z
iget-boolean v3, p1, Lcom/cleanmaster/notification/normal/NotificationSetting;->o:Z
.line 133
invoke-direct {p0, v1, p2, v2, v3}, Lcom/cleanmaster/notification/aj;->a(Landroid/content/Context;Lcom/cleanmaster/notification/normal/o;ZZ)Landroid/app/Notification;
move-result-object v2
iget v3, p2, Lcom/cleanmaster/notification/normal/o;->d:I
const/4 v4, 0x0
.line 134
invoke-direct {p0, v3, v4, v5}, Lcom/cleanmaster/notification/aj;->a(IZZ)I

在我看来,最后一次调用直接参数v5是一个问题。不知何故,dalvik事物不是原始类型,因此无法转换为布尔值。尽管如此:

invoke-virtual {v5}, Ljava/lang/Byte;->byteValue()B
move-result v5

是否遗失了一张选票?

1 个答案:

答案 0 :(得分:3)

操作码0x70是invoke-direct。引用v5的唯一invoke-direct指令是最后一条:invoke-direct {p0, v3, v4, v5}, Lcom/cleanmaster/notification/aj;->a(IZZ)I。看来v5是从你提到的方法设置的,但它是一个字节(B),而这个方法需要一个布尔值(Z)

为了自己诊断这类问题,您可以使用-r选项在有问题的dex文件上运行baksmali,它会在任何给定点的反汇编相关的反汇编中添加注释。

另一个有用的选项是-f,它使用指令偏移量添加注释,因此您可以准确识别dalvik验证错误的指令。

e.g。 rejecting opcode 0x70 at 0x0032 - 所以你要在偏移0x32

处寻找指令
baksmali classes.dex -o out -f -r

最后,为了确定错误提到的实际类型,您可以查看https://android.googlesource.com/platform/dalvik/+/kitkat-mr2.2-release/vm/analysis/CodeVerify.h#59

处的枚举

e.g。对于W/dalvikvm( 2610): VFY: register1 v5 type 13, wanted 5:类型13是字节,而类型5是布尔值。