我有一个来自 android 应用程序的 .so 文件,我想用 IDA 反汇编它。但是我收到错误:
The processor type 'arm' is not included in the installed version of IDA.
IDA 版本:免费软件 7.0
操作系统:Windows 10
免费软件7.0就不能反汇编arm文件吗?如果不是,那么实际工作正常并显示漂亮的功能表等的合适替代方案是什么?谢谢!
我有一个来自 android 应用程序的 .so 文件,我想用 IDA 反汇编它。但是我收到错误:
The processor type 'arm' is not included in the installed version of IDA.
IDA 版本:免费软件 7.0
操作系统:Windows 10
免费软件7.0就不能反汇编arm文件吗?如果不是,那么实际工作正常并显示漂亮的功能表等的合适替代方案是什么?谢谢!
Radare2 可以反汇编 .so
:\>file libogg_opus_encoder.so
libogg_opus_encoder.so; ELF 32-bit LSB shared object, ARM, version 1 (SYSV), dynamically linked, stripped
:\>radare2 libogg_opus_encoder.so
-- Disable these messages with 'e cfg.fortunes = false' in your ~/.radare2rc
[0x00018d78]> aa
←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)
[0x00018d78]> pdf
;-- entry.fini1:
;-- section..text:
;-- pc:
;-- r15:
/ (fcn) entry0 12
| entry0 ();
| 0x00018d78 04009fe5 ldr r0, [0x00018d84] ; [0x18d84:4]=0x4835c ; [15] -r-x
| 0x00018d7c 00008fe0 add r0, pc, r0
\ ,=< 0x00018d80 3a0f01ea b sym.imp.__cxa_atexit ; sym.imp.__cxa_finalize+0xc
ghidra 也应该能够反汇编 .so
您在评论中发布的链接显示了一个功能列表和一个图形反汇编,两者都可以在radare2 中查找 fs,f,pdf,VV 命令
下面显示的是您发布的链接上的相同反汇编
:\>file libminecraftpe.so
libminecraftpe.so; ELF 32-bit LSB shared object, ARM, version 1 (SYSV), dynamically linked (uses shared libs), stripped
:\>radare2 -A libminecraftpe.so
[←[0m{ctrl+c} pressed.lags starting with sym. and entry0 (aa)
←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)
-- git pull now
[0x002315d0]> f~Crafting~Held
0x003e2dd8 76 sym.CraftingInventoryScreenController::_handleHeldButton_int
0x003e2dd8 1 method.CraftingInventoryScreenController._handleHeldButton_int
[0x002315d0]> s 0x3e2dd8
[0x003e2dd8]> af
[0x003e2dd8]> pdf
;-- method.CraftingInventoryScreenController._handleHeldButton_int:
/ (fcn) sym.CraftingInventoryScreenController::_handleHeldButton_int 76
| sym.CraftingInventoryScreenController::_handleHeldButton_int ();
| 0x003e2dd8 f8b5 push {r3, r4, r5, r6, r7, lr}
| 0x003e2dda 00f12c06 add.w r6, r0, 0x2c
| 0x003e2dde 0546 mov r5, r0
| 0x003e2de0 0f46 mov r7, r1
| 0x003e2de2 3046 mov r0, r6
| 0x003e2de4 5df01efb bl sym.HeldButtonData::getCollectionIndex__const
| 0x003e2de8 b842 cmp r0, r7
| 0x003e2dea 0446 mov r4, r0
| ,=< 0x003e2dec 01d0 beq 0x3e2df2
| | ; CODE XREF from sym.CraftingInventoryScreenController::_handleHeldButton_int (0x3e2e22)
| ..--> 0x003e2dee 0120 movs r0, 1
| ::| 0x003e2df0 f8bd pop {r3, r4, r5, r6, r7, pc}
| ::`-> 0x003e2df2 431c adds r3, r0, 1
| `===< 0x003e2df4 fbd0 beq 0x3e2dee
| : 0x003e2df6 3046 mov r0, r6
| : 0x003e2df8 5df0f6fa bl sym.HeldButtonData::getButtonId__const
| : 0x003e2dfc b5f92630 ldrsh.w r3, [r5, 0x26]
| : 0x003e2e00 8342 cmp r3, r0
| :,=< 0x003e2e02 05d0 beq 0x3e2e10
| .---> 0x003e2e04 2846 mov r0, r5
| ::| 0x003e2e06 2146 mov r1, r4
| ::| 0x003e2e08 5df012fb bl sym.MinecraftScreenController::_handleHeldButton_int
| ::| 0x003e2e0c 0120 movs r0, 1
| ::| 0x003e2e0e f8bd pop {r3, r4, r5, r6, r7, pc}
| ::`-> 0x003e2e10 3046 mov r0, r6
| :: 0x003e2e12 5df0effa bl sym.HeldButtonData::getItemLocation__const
| :: 0x003e2e16 0328 cmp r0, 3
| `===< 0x003e2e18 f4d1 bne 0x3e2e04
| : 0x003e2e1a 2846 mov r0, r5
| : 0x003e2e1c 2146 mov r1, r4
| : 0x003e2e1e fff7d7fe bl sym.CraftingInventoryScreenController::_handleArmorTakePlace_int
\ `==< 0x003e2e22 e4e7 b 0x3e2dee
[0x003e2dd8]>
为 MainChunk 搜索的函数列表
[0x003e2dd8]> f~MainChunk
0x00000000 1 class.MainChunkSource
0x00298f1c 4 sym.MainChunkSource::getStoredChunks__const
0x00298f1c 1 method.MainChunkSource.getStoredChunks__const
0x00298f20 4 sym.MainChunkSource::getStoredChunks
0x00298f20 1 method.MainChunkSource.getStoredChunks
0x0029e558 1 method.MainChunkSource._MainChunkSource
0x0029e5a8 18 sym.MainChunkSource::_MainChunkSource
0x0029e5bc 320 sym.MainChunkSource::releaseChunk_LevelChunk
0x0029e5bc 1 method.MainChunkSource.releaseChunk_LevelChunk
0x002a0afc 102 sym.MainChunkSource::getExistingChunk_ChunkPosconst
0x002a0afc 1 method.MainChunkSource.getExistingChunk_ChunkPosconst
0x002be794 112 sym.MainChunkSource::MainChunkSource_std::unique_ptr_ChunkSource_std::default_delete_ChunkSource
0x002be794 1 method.MainChunkSource.MainChunkSource_std::unique_ptr_ChunkSource_std::default_delete_ChunkSource
0x002d60d0 174 sym.MainChunkSource::requestChunk_ChunkPosconst__ChunkSource::LoadMode
0x002d60d0 1 method.MainChunkSource.requestChunk_ChunkPosconst__ChunkSource::LoadMode
0x002d6180 168 sym.MainChunkSource::acquireDiscarded_std::unique_ptr_LevelChunk_std::default_delete_LevelChunk
0x002d6180 1 method.MainChunkSource.acquireDiscarded_std::unique_ptr_LevelChunk_std::default_delete_LevelChunk
0x005e3cb0 80 obj.vtableforMainChunkSource
图表视图
不,它不支持 ARM 文件。
从描述:
IDA v7.0 的免费版本有以下限制:
• 不允许用于商业用途
• 缺少 IDA > v7.0 中引入的所有功能
• 缺乏对许多处理器、文件格式等的支持……
• 没有技术支持