IDA 免费软件 7.0 反汇编 ARM .so 文件

逆向工程 艾达 手臂 共享对象
2021-07-04 03:56:46

我有一个来自 android 应用程序的 .so 文件,我想用 IDA 反汇编它。但是我收到错误: The processor type 'arm' is not included in the installed version of IDA.

IDA 版本:免费软件 7.0
操作系统:Windows 10

免费软件7.0就不能反汇编arm文件吗?如果不是,那么实际工作正常并显示漂亮的功能表等的合适替代方案是什么?谢谢!

2个回答

Radare2 可以反汇编 .so

:\>file libogg_opus_encoder.so
libogg_opus_encoder.so; ELF 32-bit LSB shared object, ARM, version 1 (SYSV), dynamically linked, stripped

:\>radare2 libogg_opus_encoder.so
 -- Disable these messages with 'e cfg.fortunes = false' in your ~/.radare2rc
[0x00018d78]> aa
←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)
[0x00018d78]> pdf
            ;-- entry.fini1:
            ;-- section..text:
            ;-- pc:
            ;-- r15:
/ (fcn) entry0 12
|   entry0 ();
|           0x00018d78      04009fe5       ldr r0, [0x00018d84]        ; [0x18d84:4]=0x4835c ; [15] -r-x
|           0x00018d7c      00008fe0       add r0, pc, r0
\       ,=< 0x00018d80      3a0f01ea       b sym.imp.__cxa_atexit      ; sym.imp.__cxa_finalize+0xc

ghidra 也应该能够反汇编 .so

您在评论中发布的链接显示了一个功能列表和一个图形反汇编,两者都可以在radare2 中查找 fs,f,pdf,VV 命令

下面显示的是您发布的链接上的相同反汇编

:\>file libminecraftpe.so
libminecraftpe.so; ELF 32-bit LSB shared object, ARM, version 1 (SYSV), dynamically linked (uses shared libs), stripped

:\>radare2 -A libminecraftpe.so
[←[0m{ctrl+c} pressed.lags starting with sym. and entry0 (aa)
←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)
 -- git pull now
[0x002315d0]> f~Crafting~Held
0x003e2dd8 76 sym.CraftingInventoryScreenController::_handleHeldButton_int
0x003e2dd8 1 method.CraftingInventoryScreenController._handleHeldButton_int
[0x002315d0]> s 0x3e2dd8
[0x003e2dd8]> af
[0x003e2dd8]> pdf
            ;-- method.CraftingInventoryScreenController._handleHeldButton_int:
/ (fcn) sym.CraftingInventoryScreenController::_handleHeldButton_int 76
|   sym.CraftingInventoryScreenController::_handleHeldButton_int ();
|           0x003e2dd8      f8b5           push {r3, r4, r5, r6, r7, lr}
|           0x003e2dda      00f12c06       add.w r6, r0, 0x2c
|           0x003e2dde      0546           mov r5, r0
|           0x003e2de0      0f46           mov r7, r1
|           0x003e2de2      3046           mov r0, r6
|           0x003e2de4      5df01efb       bl sym.HeldButtonData::getCollectionIndex__const
|           0x003e2de8      b842           cmp r0, r7
|           0x003e2dea      0446           mov r4, r0
|       ,=< 0x003e2dec      01d0           beq 0x3e2df2
|       |   ; CODE XREF from sym.CraftingInventoryScreenController::_handleHeldButton_int (0x3e2e22)
|     ..--> 0x003e2dee      0120           movs r0, 1
|     ::|   0x003e2df0      f8bd           pop {r3, r4, r5, r6, r7, pc}
|     ::`-> 0x003e2df2      431c           adds r3, r0, 1
|     `===< 0x003e2df4      fbd0           beq 0x3e2dee
|      :    0x003e2df6      3046           mov r0, r6
|      :    0x003e2df8      5df0f6fa       bl sym.HeldButtonData::getButtonId__const
|      :    0x003e2dfc      b5f92630       ldrsh.w r3, [r5, 0x26]
|      :    0x003e2e00      8342           cmp r3, r0
|      :,=< 0x003e2e02      05d0           beq 0x3e2e10
|     .---> 0x003e2e04      2846           mov r0, r5
|     ::|   0x003e2e06      2146           mov r1, r4
|     ::|   0x003e2e08      5df012fb       bl sym.MinecraftScreenController::_handleHeldButton_int
|     ::|   0x003e2e0c      0120           movs r0, 1
|     ::|   0x003e2e0e      f8bd           pop {r3, r4, r5, r6, r7, pc}
|     ::`-> 0x003e2e10      3046           mov r0, r6
|     ::    0x003e2e12      5df0effa       bl sym.HeldButtonData::getItemLocation__const
|     ::    0x003e2e16      0328           cmp r0, 3
|     `===< 0x003e2e18      f4d1           bne 0x3e2e04
|      :    0x003e2e1a      2846           mov r0, r5
|      :    0x003e2e1c      2146           mov r1, r4
|      :    0x003e2e1e      fff7d7fe       bl sym.CraftingInventoryScreenController::_handleArmorTakePlace_int
\      `==< 0x003e2e22      e4e7           b 0x3e2dee
[0x003e2dd8]>

为 MainChunk 搜索的函数列表

[0x003e2dd8]> f~MainChunk
0x00000000 1 class.MainChunkSource
0x00298f1c 4 sym.MainChunkSource::getStoredChunks__const
0x00298f1c 1 method.MainChunkSource.getStoredChunks__const
0x00298f20 4 sym.MainChunkSource::getStoredChunks
0x00298f20 1 method.MainChunkSource.getStoredChunks
0x0029e558 1 method.MainChunkSource._MainChunkSource
0x0029e5a8 18 sym.MainChunkSource::_MainChunkSource
0x0029e5bc 320 sym.MainChunkSource::releaseChunk_LevelChunk
0x0029e5bc 1 method.MainChunkSource.releaseChunk_LevelChunk
0x002a0afc 102 sym.MainChunkSource::getExistingChunk_ChunkPosconst
0x002a0afc 1 method.MainChunkSource.getExistingChunk_ChunkPosconst
0x002be794 112 sym.MainChunkSource::MainChunkSource_std::unique_ptr_ChunkSource_std::default_delete_ChunkSource
0x002be794 1 method.MainChunkSource.MainChunkSource_std::unique_ptr_ChunkSource_std::default_delete_ChunkSource
0x002d60d0 174 sym.MainChunkSource::requestChunk_ChunkPosconst__ChunkSource::LoadMode
0x002d60d0 1 method.MainChunkSource.requestChunk_ChunkPosconst__ChunkSource::LoadMode
0x002d6180 168 sym.MainChunkSource::acquireDiscarded_std::unique_ptr_LevelChunk_std::default_delete_LevelChunk
0x002d6180 1 method.MainChunkSource.acquireDiscarded_std::unique_ptr_LevelChunk_std::default_delete_LevelChunk
0x005e3cb0 80 obj.vtableforMainChunkSource

图表视图

在此处输入图片说明

不,它不支持 ARM 文件。

描述

IDA v7.0 的免费版本有以下限制:

• 不允许用于商业用途

• 缺少 IDA > v7.0 中引入的所有功能

缺乏对许多处理器、文件格式等的支持……

• 没有技术支持