TaintDroid深入剖析之啟動篇

a. interpreted → interpreted

同一個類方法之間直接通過GOTO_invoke系列巨集進行跳轉。不同類的話根據具體情況而定。一直在interpreted stack中執行。

b. interpreted → native

如果目標函式是jni呼叫那麼就判斷method的NATIVE標誌位，通過native呼叫橋dvmCallJniMethod進行跳轉。常見情況就是JNI呼叫。

如果目標函式是Internal VM Method，那麼就可以通過interpted程式碼直接呼叫，只是需要傳遞一個指向32位暫存器引數的指標以及一個指向返回值的指標即可。常見形式如下：

InternalVMfunc(const u4* args, JValue* rResult){……}

由interpreted stack轉到native stack。

c. native → native

這裡主要說明由Internal VM Method或反射呼叫跳轉到JNI Method的情況。在這種情況下最終會呼叫dvmPushJNIFrame為目標函式分配一個JNI幀。

d. native → interpreted

反射的話通過dvmInvokeMethod系列函式進行跳轉；非反射的JNI呼叫就通過Jni.cpp中定義的CALL_XXX系列巨集通過dvmCallMethodV/A進行跳轉，均走dvmPushInterpFrame分支；非反射的Internal VM Method直接返回。常見情況就是jni呼叫。由native stack轉到interpreted stack。

if (dvmIsNativeMethod(method)) {

/* native code calling native code the hard way */

if (!dvmPushJNIFrame(self, method)) {

……

}

} else {

/* native code calling interpreted code */

if (!dvmPushInterpFrame(self, method)) {

……

}

}

#ifdef WITH_TAINT_TRACKING

/* taint tags are interleaved, plus “native hack” spacer for args */

stackReq = method->registersSize * 8 + 4 // params + locals

+ sizeof(StackSaveArea) * 2 // break frame + regular frame

+ method->outsSize * 8 + 4; // args to other methods

# else

stackReq = method->registersSize * 4 // params + locals

+ sizeof(StackSaveArea) * 2 // break frame + regular frame

+ method->outsSize * 4; // args to other methods

#endif

…

#ifdef WITH_TAINT_TRACKING

/* interleaved taint tracking plus “native hack” spacer for args */

stackPtr -= method->registersSize * 8 + 4 + sizeof(StackSaveArea);

#else

stackPtr -= method->registersSize * 4 + sizeof(StackSaveArea);

…

/* debug — memset the new stack, unless we want valgrind`s help */

#ifdef WITH_TAINT_TRACKING

memset(stackPtr – (method->outsSize*8+4), 0xaf, stackReq);

#else

memset(stackPtr – (method->outsSize*4), 0xaf, stackReq);

#ifdef WITH_TAINT_TRACKING

int slot_cnt = 0;

bool nativeTarget = dvmIsNativeMethod(method);

#endif

/* “ins” for new frame start at frame pointer plus locals */

#ifdef WITH_TAINT_TRACKING

if (nativeTarget) {

/*對於native方法後面再單獨分析*/

}

#else

ins = ((u4*)self->interpSave.curFrame) +

(method->registersSize – method->insSize);

#endif

#ifdef WITH_TAINT_TRACKING

u4 rtaint; /* not used */

dvmInterpret(self, method, pResult, &rtaint);

#else

dvmInterpret(self, method, pResult);

#endif

#ifdef WITH_TAINT_TRACKING

void dvmInterpret(Thread* self, const Method* method, JValue* pResult, u4* rtaint) //TaintDroid新增了一個引數

#else

void dvmInterpret(Thread* self, const Method* method, JValue* pResult)

#endif

{

InterpSaveState interpSaveState;

ExecutionSubModes savedSubModes;

……

#ifdef WITH_TAINT_TRACKING

self->interpSave.rtaint.tag = TAINT_CLEAR;

#endif

self->interpSave.method = method;

self->interpSave.curFrame = (u4*) self->interpSave.curFrame;

self->interpSave.pc = method->insns;

……

typedef void (*Interpreter)(Thread*); //申明一個函式指標，引數為Thread*,函式名字為Interpreter

Interpreter stdInterp;

if (gDvm.executionMode == kExecutionModeInterpFast)

stdInterp = dvmMterpStd;

#if defined(WITH_JIT)

else if (gDvm.executionMode == kExecutionModeJit)

stdInterp = dvmMterpStd;

#endif

else

stdInterp = dvmInterpretPortable;

// Call the interpreter

(*stdInterp)(self); //這表示呼叫該函式

*pResult = self->interpSave.retval;

#ifdef WITH_TAINT_TRACKING

*rtaint = self->interpSave.rtaint.tag;

#endif

……

void dvmMterpStd(Thread* self)

{

/* configure mterp items */

self->interpSave.methodClassDex = self->interpSave.method->clazz->pDvmDex;

……

/*

* Handle any ongoing profiling and prep for debugging

*/

if (self->interpBreak.ctl.subMode != 0) {

TRACE_METHOD_ENTER(self, self->interpSave.method);

self->debugIsMethodEntry = true; // Always true on startup

}

dvmMterpStdRun(self);

#ifdef LOG_INSTR

ALOGD(“|– Leaving interpreter loop”);

#endif

}

reg nick purpose
r4 rPC interpreted program counter, used for fetching instructions
r5 rFP interpreted frame pointer, used for accessing locals and args
r6 rSELF self (Thread) pointer
r7 rINST first 16-bit code unit of current instruction
r8 rIBASE interpreted instruction base pointer, used for computed goto

%verify “executed”

%include “armv5te_taint/binop2addr.S” {“instr”:”add r0, r0, r1″}

/* binop/2addr vA, vB */

mov r9, rINST, lsr #8 @ r9<- A+ A,B表示dvm暫存器編號

mov r3, rINST, lsr #12 @ r3<- B

and r9, r9, #15

GET_VREG(r1, r3) @ r1<- vB vB,vA表示dvm暫存器的值

GET_VREG(r0, r9) @ r0<- vA

.if $chkzero

cmp r1, #0 @ is second operand zero?

beq common_errDivideByZero

.endif

// begin WITH_TAINT_TRACKING

bl .L${opcode}_taint_prop

// end WITH_TAINT_TRACKING

FETCH_ADVANCE_INST(1) @ advance rPC, load rINST

$preinstr @ optional op; may set condition codes

$instr @ $result<- op, r0-r3 changed

GET_INST_OPCODE(ip) @ extract opcode from rINST

SET_VREG($result, r9) @ vAA<- $result

GOTO_OPCODE(ip) @ jump to next instruction

/* 10-13 instructions */

%break

.L${opcode}_taint_prop:

SET_TAINT_FP(r10) @以r10為基本偏移值，後續的taint系列巨集都以這個r10為基準。

GET_VREG_TAINT(r3, r3, r10) @r3 <- vB的汙點

GET_VREG_TAINT(r2, r9, r10) @r2 <- vA的汙點

orr r2, r3, r2 @相或，r2 = r2 | r3

SET_VREG_TAINT(r2, r9, r10) @將最終的汙點儲存在vA的汙點中，因為vA是返回值。

bx lr

#ifdef WITH_TAINT_TRACKING

#define SET_TAINT_FP(_reg) add _reg, rFP, #4 //fFP+4

#define SET_TAINT_CLEAR(_reg) mov _reg, #0

#define GET_VREG(_reg, _vreg) ldr _reg, [rFP, _vreg, lsl #3] //表示乘以8

#define SET_VREG(_reg, _vreg) str _reg, [rFP, _vreg, lsl #3]

#define GET_VREG_TAINT(_reg, _vreg, _rFP) ldr _reg, [_rFP, _vreg, lsl #3]

#define SET_VREG_TAINT(_reg, _vreg, _rFP) str _reg, [_rFP, _vreg, lsl #3]

#else

#define GET_VREG(_reg, _vreg) ldr _reg, [rFP, _vreg, lsl #2] //表示乘以4

#define SET_VREG(_reg, _vreg) str _reg, [rFP, _vreg, lsl #2]

#endif /*WITH_TAINT_TRACKING*/