unidbg 控制台调试

最近在学习使用unidgb，调试模式学起来
unidgb 有3种调试模式：

public enum  DebuggerType {

    /**
     * console debugger
     */
    CONSOLE,

    /**
     * gdb server
     */
    GDB_SERVER,

    /**
     * ida android server v7.x
     */
    ANDROID_SERVER_V7

}

源码写得很清楚了，分别是 CONSOLE、GDB_SERVER、ANDROID_SERVER_V7
暂时只懂CONSOLE模式，那就分享下吧

开启调试模式：

只需要增加下面得代码，自己决定在哪个位置断点

       Debugger MyDbg = emulator.attach(DebuggerType.CONSOLE);
       MyDbg.addBreakPoint(module.base + 0x2D180); //断点地址

调试方法

运行得时候，就会自动断点了，控制台模式最重要得是知道命令：（unidbg会有提示的）

c: continue
n: step over
bt: back trace

st hex: search stack
shw hex: search writable heap
shr hex: search readable heap
shx hex: search executable heap

nb: break at next block
s|si: step into
s[decimal]: execute specified amount instruction
s(blx): execute util BLX mnemonic, low performance

m(op) [size]: show memory, default size is 0x70, size may hex or decimal
mr0-mr7, mfp, mip, msp [size]: show memory of specified register
m(address) [size]: show memory of specified address, address must start with 0x

wr0-wr7, wfp, wip, wsp <value>: write specified register
wb(address), ws(address), wi(address) <value>: write (byte, short, integer) memory of specified address, address must start with 0x
wx(address) <hex>: write bytes to memory at specified address, address must start with 0x

b(address): add temporarily breakpoint, address must start with 0x, can be module offset
b: add breakpoint of register PC
r: remove breakpoint of register PC
blr: add temporarily breakpoint of register LR

p (assembly): patch assembly at PC address
where: show java stack trace

trace [begin end]: Set trace instructions
traceRead [begin end]: Set trace memory read
traceWrite [begin end]: Set trace memory write
vm: view loaded modules
vbs: view breakpoints
d|dis: show disassemble
d(0x): show disassemble at specify address
stop: stop emulation
run [arg]: run test
cc size: convert asm from 0x4002d182 - 0x4002d182 + size bytes to c function

命令简单学习

暂时会的命令说明类比(同idea类比)下（好记性不如烂笔头）：
c - F8
n - F9
d - Varibles 窗口
用法：
输入：

d

输出：

>>> r0=0x40252020 r1=0x6b23c r2=0x0 r3=0x4026c2e0 r4=0x40267014 r5=0x40093184 r6=0xbffff598 r7=0xbffff628 r8=0x40 sb=0x40267000 sl=0x4025b000 fp=0x40262000 ip=0x0
>>> SP=0xbffff598 LR=RX@0x4002d4e3[libshield.so]0x2d4e3 PC=RX@0x4002d182[libshield.so]0x2d182 cpsr: N=0, Z=1, C=0, V=0, T=1, mode=0b10000
>>> d0=0xbd3af23545081191(-9.573186805205375E-14) d1=0x450811a1c5537ed3(3.6371855057004556E24) d2=0x85845dd1f5ef2486(-4.3827848637617155E-282) d3=0xf99926e0850ccceb(-5.573219977953539E277) d4=0xe6dc88e5d9dcd039(-3.1039270277906248E187) d5=0x1fa27cf9048c1d05(2.693185673467624E-156) d6=0xc4ac56656d9d6122(-6.690999509074994E22) d7=0xf4292244fde5391c(-3.5990317572527574E251)
>>> d8=0x0(0.0) d9=0x0(0.0) d10=0x0(0.0) d11=0x0(0.0) d12=0x0(0.0) d13=0x0(0.0) d14=0x0(0.0) d15=0x0(0.0)

m - watch
用法：

1. mr0-mr7, mfp, mip, msp [size]: show memory of specified register

输入：

mr0

输出：

>-----------------------------------------------------------------------------<
[14:52:49 656]r0=RW@0x40252020, md5=b3813ce3812ac6d7ae18234b34b78b89, hex=843109400000000080c1264051d10240000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
size: 112
0000: 84 31 09 40 00 00 00 00 80 C1 26 40 51 D1 02 40    .1.@......&@Q..@
0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
^-----------------------------------------------------------------------------^

2. m(address) [size]: show memory of specified address, address must start with 0x
   输入：

m0x40252020

输出：

>-----------------------------------------------------------------------------<
[14:53:20 002]RW@0x40252020, md5=b3813ce3812ac6d7ae18234b34b78b89, hex=843109400000000080c1264051d10240000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
size: 112
0000: 84 31 09 40 00 00 00 00 80 C1 26 40 51 D1 02 40    .1.@......&@Q..@
0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
^-----------------------------------------------------------------------------^

网上看到的用法

image.png

暂时解锁这些，之后其他命令有用到，继续更新