多读书多实践，勤思考善领悟

Java逆向基础之五.条件跳转位运算循环

破解 java 逆向 2018/09/04

本文于2142天之前发表，文中内容可能已经过时。

1. 条件跳转的例子，绝对值

1
2
3
4
5
6
7
8
9
public class abs
{
    public static int abs(int a)
    {
        if (a<0)
            return -a;
        return a;
    }
}

编译

1
javac abs.java

反编译

1
javap -c -verbose abs.class
1
2
3
4
5
6
7
8
9
10
11
12
public static int abs(int);
  descriptor: (I)I
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=1, locals=1, args_size=1
       0: iload_0
       1: ifge          7
       4: iload_0
       5: ineg
       6: ireturn
       7: iload_0
       8: ireturn

其中ifge 7 意思是，当栈顶的值大于等于0的时候跳转到偏移位7，任何的ifXX指令都会将栈中的值弹出用于进行比较

其中ineg 意思是将栈顶int型数值取负并将结果压入栈顶

2. 再看一个例子，取最小值

1
2
3
4
5
6
7
8
9
public class min
{
	public static int min (int a, int b)
	{
		if (a>b)
			return b;
		return a;
	}
}

反编译

1
2
3
4
5
6
7
8
9
10
11
12
public static int min(int, int);
  descriptor: (II)I
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=2, locals=2, args_size=2
       0: iload_0
       1: iload_1
       2: if_icmple     7
       5: iload_1
       6: ireturn
       7: iload_0
       8: ireturn

if_icmple会从栈中弹出两个值进行比较，如果第二个(a,iload_0)小于或者等于第一个(b,iload_1)，那么跳转到偏移位7

从上面例子可以看出在Java代码中if条件中的测试与在字节码中是完全相反的

3. max函数例子

1
2
3
4
5
6
7
8
9
public class max
{
	public static int max (int a, int b)
	{
		if (a>b)
			return a;
		return b;
	}
}

反编译

1
2
3
4
5
6
7
8
9
10
11
12
public static int max(int, int);
  descriptor: (II)I
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=2, locals=2, args_size=2
       0: iload_0
       1: iload_1
       2: if_icmple     7
       5: iload_0
       6: ireturn
       7: iload_1
       8: ireturn

代码和min的差不多，唯一的区别是最后两个iload指令（偏移位5和偏移位7）互换了

4. 更复杂的例子

1
2
3
4
5
6
7
8
9
10
11
12
13
14
public class cond
{
    public static void f(int i)
    {
        if (i<100)
            System.out.print("<100");
        if (i==100)
            System.out.print("==100");
        if (i>100)
            System.out.print(">100");
        if (i==0)
            System.out.print("==0");
    }
}

反编译

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
public static void f(int);
  descriptor: (I)V
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=2, locals=1, args_size=1
       0: iload_0
       1: bipush        100
       3: if_icmpge     14
       6: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
       9: ldc           #3                  // String <100
      11: invokevirtual #4                  // Method java/io/PrintStream.print:(Ljava/lang/String;)V
      14: iload_0
      15: bipush        100
      17: if_icmpne     28
      20: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      23: ldc           #5                  // String ==100
      25: invokevirtual #4                  // Method java/io/PrintStream.print:(Ljava/lang/String;)V
      28: iload_0
      29: bipush        100
      31: if_icmple     42
      34: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      37: ldc           #6                  // String >100
      39: invokevirtual #4                  // Method java/io/PrintStream.print:(Ljava/lang/String;)V
      42: iload_0
      43: ifne          54
      46: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      49: ldc           #7                  // String ==0
      51: invokevirtual #4                  // Method java/io/PrintStream.print:(Ljava/lang/String;)V
      54: return

if_icmpge 14 栈顶弹出两个值，并且比较两个数值，如果第的二个值大于或等于第一个，跳转到偏移位14

if_icmpne 28 栈顶弹出两个值，并且比较两个数值，如果第的二个值不等于第一个，跳转到偏移位28

ifne 54 当栈顶int型数值不等于0时跳转到偏移位54

5. 传参例子

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
public class minmax
{
    public static int min (int a, int b)
    {
        if (a>b)
            return b;
        return a;
    }
    public static int max (int a, int b)
    {
        if (a>b)
            return a;
        return b;
    }
    public static void main(String[] args)
    {
        int a=123, b=456;
        int max_value=max(a, b);
        int min_value=min(a, b);
        System.out.println(min_value);
        System.out.println(max_value);
    }
}

反编译

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
public static void main(java.lang.String[]);
  descriptor: ([Ljava/lang/String;)V
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=2, locals=5, args_size=1
       0: bipush        123
       2: istore_1
       3: sipush        456
       6: istore_2
       7: iload_1
       8: iload_2
       9: invokestatic  #2                  // Method max:(II)I
      12: istore_3
      13: iload_1
      14: iload_2
      15: invokestatic  #3                  // Method min:(II)I
      18: istore        4
      20: getstatic     #4                  // Field java/lang/System.out:Ljava/io/PrintStream;
      23: iload         4
      25: invokevirtual #5                  // Method java/io/PrintStream.println:(I)V
      28: getstatic     #4                  // Field java/lang/System.out:Ljava/io/PrintStream;
      31: iload_3
      32: invokevirtual #5                  // Method java/io/PrintStream.println:(I)V
      35: return

istore_1 将栈顶元素弹出并存到本地变量数组1号元素，因为0号给了this

6. 位操作

1
2
3
4
5
6
7
8
9
10
11
12
public class bitop
{
	public static int set (int a, int b)
	{
		return a | 1<<b;
	}

	public static int clear (int a, int b)
	{
		return a & (~(1<<b));
	}
}

反编译

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
public static int set(int, int);
  descriptor: (II)I
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=3, locals=2, args_size=2
       0: iload_0
       1: iconst_1
       2: iload_1
       3: ishl
       4: ior
       5: ireturn
    LineNumberTable:
      line 5: 0

public static int clear(int, int);
  descriptor: (II)I
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=3, locals=2, args_size=2
       0: iload_0
       1: iconst_1
       2: iload_1
       3: ishl
       4: iconst_m1
       5: ixor
       6: iand
       7: ireturn
    LineNumberTable:
      line 10: 0

set函数的指令解释

0: iload_0 //载入第0个参数即a，压入栈

1: iconst_1 //数字1压入栈

2: iload_1 ///载入第1个参数即b，压入栈

3: ishl //弹出栈顶两个元素，将int型数值左移位指定位数并将结果压入栈顶，第一个弹出值(b)为左移的位数，第二个弹出的值(1)为要对其进行左移的数，即对1左移b位

4: ior //将栈顶两int型数值作“按位或”并将结果压入栈顶

5: ireturn //返回栈顶值

clear函数中iconst_m1指令将-1压入栈，-1就是16进制的0xFFFFFFFF， ixor是进行异或操作，操作结果相当于取反

7. 将上面的例子扩展成long类型

1
2
3
4
5
6
7
8
9
10
11
public class longbitop
{
	public static long lset (long a, int b)
	{
		return a | 1<<b;
	}
	public static long lclear (long a, int b)
	{
		return a & (~(1<<b));
	}
}

反编译

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
public static long lset(long, int);
  descriptor: (JI)J
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=4, locals=3, args_size=2
       0: lload_0
       1: iconst_1
       2: iload_2
       3: ishl
       4: i2l
       5: lor
       6: lreturn
    LineNumberTable:
      line 5: 0

public static long lclear(long, int);
  descriptor: (JI)J
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=4, locals=3, args_size=2
       0: lload_0
       1: iconst_1
       2: iload_2
       3: ishl
       4: iconst_m1
       5: ixor
       6: i2l
       7: land
       8: lreturn
    LineNumberTable:
      line 9: 0

需要注意的指令

i2l 将栈顶int型数值强制转换成long型数值并将结果压入栈顶

32位需要升级为64位值时，会使用i21指令把整型扩展成64位长整型.

8. 循环，看个简单的例子

1
2
3
4
5
6
7
8
9
10
public class Loop
{
    public static void main(String[] args)
    {
        for (int i = 1; i <= 10; i++)
        {
            System.out.println(i);
        }
    }
}

反编译

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
public static void main(java.lang.String[]);
  descriptor: ([Ljava/lang/String;)V
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=2, locals=2, args_size=1
       0: iconst_1
       1: istore_1
       2: iload_1
       3: bipush        10
       5: if_icmpgt     21
       8: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      11: iload_1
      12: invokevirtual #3                  // Method java/io/PrintStream.println:(I)V
      15: iinc          1, 1
      18: goto          2
      21: return

指令解释

0: iconst_1 //常数1压入栈

1: istore_1 //栈顶弹出存入本地变量数组1号元素

2: iload_1 //本地变量1号元素压入栈顶

3: bipush 10 //常数10压入栈顶

5: if_icmpgt 21 // 比较栈顶两int型数值大小，当结果大于0时跳转到偏移位21，比较都是拿第二个弹出值与第一个比较即i与10比较

8: getstatic #2 // Field java/lang/System.out:Ljava/io/PrintStream;

11: iload_1

12: invokevirtual #3 // Method java/io/PrintStream.println:(I)V //8~12这里输出变量i

15: iinc 1, 1 //将指定int型变量增加指定值（常用于i++,i–,i+=2） ，这里指本地变量1号元素加1

18: goto 2 //跳转到偏移位2

21: return

多说一句，我们调用println打印数据类型是整型，我们看注释，“(I)V”，I的意思是整型，V的意思是返回void

9. 再看个复杂的，斐波那契数列

1
2
3
4
5
6
7
8
9
10
11
12
13
public class Fibonacci
{
    public static void main(String[] args)
    {
        int limit = 20, f = 0, g = 1;
        for (int i = 1; i <= limit; i++)
        {
            f = f + g;
            g = f - g;
            System.out.println(f);
        } 
    }
}

反编译

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
public static void main(java.lang.String[]);
  descriptor: ([Ljava/lang/String;)V
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=2, locals=5, args_size=1
       0: bipush        20
       2: istore_1
       3: iconst_0
       4: istore_2
       5: iconst_1
       6: istore_3
       7: iconst_1
       8: istore        4
      10: iload         4
      12: iload_1
      13: if_icmpgt     37
      16: iload_2
      17: iload_3
      18: iadd
      19: istore_2
      20: iload_2
      21: iload_3
      22: isub
      23: istore_3
      24: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      27: iload_2
      28: invokevirtual #3                  // Method java/io/PrintStream.println:(I)V
      31: iinc          4, 1
      34: goto          10
      37: return

拿几个指令说一下

if_icmpgt 37 比较栈顶两int型数值大小，当结果大于0时跳转到偏移位37，比较都是拿栈的第二个弹出值(本地变量4号)与第一个比较(本地变量1号)

isub 栈顶的两个元素相减并将结果压入栈顶，谁减谁，仍然是栈顶弹出的第二个减第一个

iinc 4, 1 表示是本地变量4号元素加1，结果存在本地变量4号

这里的英文作者又吐槽了一下

8: istore 4

10: iload 4

这两句中的iload 4，感觉多余。。

10. switch例子

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
public class tableswitch {
	public static void f(int a) {
		switch (a) {
		case 0:
			System.out.println("zero");
			break;
		case 1:
			System.out.println("one\n");
			break;
		case 2:
			System.out.println("two\n");
			break;
		case 3:
			System.out.println("three\n");
			break;
		case 4:
			System.out.println("four\n");
			break;
		default:
			System.out.println("something unknown\n");
			break;
		}
	}
}

反编译

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
public static void f(int);
  descriptor: (I)V
  flags: ACC_PUBLIC, ACC_STATIC
  Code:
    stack=2, locals=1, args_size=1
       0: iload_0
       1: tableswitch   { // 0 to 4
                     0: 36
                     1: 47
                     2: 58
                     3: 69
                     4: 80
               default: 91
          }
      36: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      39: ldc           #3                  // String zero
      41: invokevirtual #4                  // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      44: goto          99
      47: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      50: ldc           #5                  // String one\n
      52: invokevirtual #4                  // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      55: goto          99
      58: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      61: ldc           #6                  // String two\n
      63: invokevirtual #4                  // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      66: goto          99
      69: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      72: ldc           #7                  // String three\n
      74: invokevirtual #4                  // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      77: goto          99
      80: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      83: ldc           #8                  // String four\n
      85: invokevirtual #4                  // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      88: goto          99
      91: getstatic     #2                  // Field java/lang/System.out:Ljava/io/PrintStream;
      94: ldc           #9                  // String something unknown\n
      96: invokevirtual #4                  // Method java/io/PrintStream.println:(Ljava/lang/String;)V
      99: return

其中需要注意的是tableswitch是在JVM级别上直接支持switch 语句，非常有意思的是，编译器编译的时候，会根据case条件的不同翻译成tableswitch或者lookupswitch

1: tableswitch { // 0 to 4

​ 0: 36

​ 1: 47

​ 2: 58

​ 3: 69

​ 4: 80

​ default: 91

​ }

的意思，将栈顶元素与大括号内冒号前的元素逐个比较，若相等，则跳转到右边对应的偏移块号

break对应其中的goto 99，如果没有这句，栈顶元素会继续和后面的大括号内后续元素进行比较

参考资料
http://www.vuln.cn/7115

转载声明：商业转载请联系作者获得授权,非商业转载请注明出处 © Ljjyy.com
Copyright © 2019-2024 Ljjyy.com | 关于我们 | 网站地图 | 时间轴