kings0527

Exception in thread "main" java.lang.IllegalStateException: Unsupported arg: [Ljava.lang.Object;@fbd1f6 直接模拟的打印好的参数 70102 最后一个参数 字符串 “r_14” 怀疑这里是寄存器 还在调试中

> 能调用成功，x-sign和x-mini-wua类的 是直接载入apk的吗 我只想调试sgmain调用docommand来着 不想去调那个noi类

> @xuejiandong @kings0527 模拟好环境就行，unidbg本身没问题，有问题是环境没模拟好。 emmm 已经working 只是结果一直null 最新版已经在补代码了 有点多。。

> > > @xuejiandong @kings0527 模拟好环境就行，unidbg本身没问题，有问题是环境没模拟好。 > > > emmm 已经working 只是结果一直null > > > 最新版已经在补代码了 有点多。。 > > 是的一直返回null 最新版本 这边frida hook 因为还有添加了mainload 再加上中间件 我的frida脚本没完全写好全时hook 参照老版本 是有init操作的 需要把load 到docommand的所有前置任务全部做完...

same error in ubuntu

0x1314 地址的读写倒是符合在ida里面看到的代码

``` Log.d("checkPermission", "before createPackageContext start "); int ret = VirtualCore.get().getContext().getPackageManager().checkPermission("android.permission.ACCESS_NETWORK_STATE", VirtualCore.get().getContext().getPackageName()); Log.d("checkPermission", "before createPackageContext ret " + ret); // ret 0 Context context = createPackageContext(data.appInfo.packageName); Log.d("checkPermission", "use core context, createPackageContext...

``` Log.d("checkPermission", "fixContext11111 start "); int ret = context.getPackageManager().checkPermission("android.permission.ACCESS_NETWORK_STATE", context.getPackageName()); Log.d("checkPermission", "fixContext111111 ret " + ret); ContextImpl.mPackageManager.set(context, null); Log.d("checkPermission", "fixContext222222 start "); ret = context.getPackageManager().checkPermission("android.permission.ACCESS_NETWORK_STATE", context.getPackageName()); Log.d("checkPermission", "fixContext2222222 ret "...

``` final IPackageManager pm = ActivityThread.getPackageManager(); final IPermissionManager permissionManager = ActivityThread.getPermissionManager(); ``` this is android 11 source code I think proxy method maybe not enough in the `PermissionManagerStub`?

``` @Override public void inject() throws Throwable { final IInterface hookedPM = getInvocationStub().getProxyInterface(); ActivityThread.sPermissionManager.set(hookedPM); BinderInvocationStub pmHookBinder = new BinderInvocationStub(getInvocationStub().getBaseInterface()); pmHookBinder.copyMethodProxies(getInvocationStub()); pmHookBinder.replaceService("permissionmgr"); } ``` set sPermissionManager fix it