ROM Log

The main advantage of ROM-level piling is that it prints logs at the system source code layer. As long as the application does not crash, you can see the log information output at a specific location during the startup process. The function of ROM-level piling may be continued to be extended based on other needs later. Let’s take a look at some of the existing pile driving methods

rom log

Encryption function print

This function is mainly to output common encryption algorithms in the Java layer. The output results will be saved in the logs directory and can also be viewed directly with logcat. After enabling this function below, the output log is as follows.

2024-03-09 12:56:13    d    mikrom_Cipher    Cipher.init 加密模式 key:31373039393838393731393431
2024-03-09 12:56:13    d    mikrom_Cipher    Cipher.update 323032342D30332D30395F32303A35363A31332E313338207069643D3136353634207469643D31363536342849292D546273496E7374616C6C65722D5442533A697350726570617265546273436F72652023312320636F72655F73686172655F6261636B75705F746D700A
2024-03-09 12:56:13    d    mikrom_Cipher    =============Cipher.getInstance start tid:2=============
Cipher.getInstance 填充模式:RC4
=============Cipher.getInstance end tid:2=============
2024-03-09 12:56:13    d    mikrom_SecretKeySpec    =============SecretKeySpec.SecretKeySpec start tid:2=============
SecretKeySpec.SecretKeySpec 算法名:RC4 密钥key:31373039393838393731393431
=============SecretKeySpec.SecretKeySpec end tid:2=============
2024-03-09 12:56:13    d    mikrom_Cipher    Cipher.init 加密模式 key:31373039393838393731393431
2024-03-09 12:56:13    d    mikrom_Cipher    Cipher.update 323032342D30332D30395F32303A35363A31332E313430207069643D3136353634207469643D31363536342849292D546273496E7374616C6C65722D5442533A697350726570617265546273436F72652023312320636F72655F636F70795F746D700A

Encryption function stack print

The same function as above, after turning it on, the call stack of the encryption and decryption functions will be output, which is convenient for troubleshooting. The log output is as follows.

=============MessageDigest.digest end tid:2=============
2024-03-10 03:34:48    d    mikrom_MessageDigest    =============MessageDigest.digest start tid:2=============
stack:  java.lang.RuntimeException: stack_info
        at cn.mik.kmodule.callback.MessageDigest.update(MessageDigest.java:44)
        at java.lang.reflect.Method.invoke(Native Method)
        at java.lang.krom.Reflect.on(Reflect.java:156)
        at java.lang.krom.Reflect.call(Reflect.java:407)
        at java.lang.krom.KCommon.CallInjectMethod(KCommon.java:115)
        at java.security.MessageDigest.update(MessageDigest.java:394)
        at com.android.org.bouncycastle.crypto.digests.OpenSSLDigest.update(OpenSSLDigest.java:65)
        at com.android.org.bouncycastle.crypto.macs.HMac.doFinal(HMac.java:194)
        at com.android.org.bouncycastle.crypto.generators.PKCS5S2ParametersGenerator.F(PKCS5S2ParametersGenerator.java:72)
        at com.android.org.bouncycastle.crypto.generators.PKCS5S2ParametersGenerator.generateDerivedKey(PKCS5S2ParametersGenerator.java:103)
        at com.android.org.bouncycastle.crypto.generators.PKCS5S2ParametersGenerator.generateDerivedParameters(PKCS5S2ParametersGenerator.java:122)
        at com.android.org.bouncycastle.crypto.generators.PKCS5S2ParametersGenerator.generateDerivedMacParameters(PKCS5S2ParametersGenerator.java:158)
        at com.android.org.bouncycastle.jcajce.provider.symmetric.util.PBE$Util.makePBEMacParameters(PBE.java:431)
        at com.android.org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2$BasePBKDF2.engineGenerateSecret(PBEPBKDF2.java:260)
        at javax.crypto.SecretKeyFactory.generateSecret(SecretKeyFactory.java:524)
        at com.huawei.agconnect.config.impl.i.a(Unknown Source:36)
        at com.huawei.agconnect.config.impl.f.<init>(Unknown Source:29)
        at com.huawei.agconnect.config.impl.k.<init>(Unknown Source:56)
        at com.huawei.agconnect.config.impl.c.a(Unknown Source:45)
        at com.huawei.agconnect.config.impl.c.getRoutePolicy(Unknown Source:18)
        at com.huawei.agconnect.core.a.b.a(Unknown Source:61)
        at com.huawei.agconnect.core.a.b.a(Unknown Source:24)
        at com.huawei.agconnect.AGConnectInstance.initialize(Unknown Source:10)
        at com.huawei.agconnect.core.provider.AGConnectInitializeProvider.onCreate(Native Method)
        at android.content.ContentProvider.attachInfo(ContentProvider.java:2451)
        at android.content.ContentProvider.attachInfo(ContentProvider.java:2421)
        at android.app.ActivityThread.installProvider(ActivityThread.java:7605)
        at android.app.ActivityThread.installContentProviders(ActivityThread.java:7121)
        at s.h.e.l.l.N.r(Native Method)
        at s.h.e.l.l.S.attachBaseContext(Unknown Source:39)
        at android.app.Application.attach(Application.java:346)
        at android.app.Instrumentation.newApplication(Instrumentation.java:1246)
        at android.app.LoadedApk.makeApplicationInner(LoadedApk.java:1462)
        at android.app.LoadedApk.makeApplicationInner(LoadedApk.java:1399)
        at android.app.ActivityThread.handleBindApplication(ActivityThread.java:6812)
        at android.app.ActivityThread.-$$Nest$mhandleBindApplication(Unknown Source:0)
        at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2138)
        at android.os.Handler.dispatchMessage(Handler.java:106)
        at android.os.Looper.loopOnce(Looper.java:201)
        at android.os.Looper.loop(Looper.java:288)
        at android.app.ActivityThread.main(ActivityThread.java:8015)
        at java.lang.reflect.Method.invoke(Native Method)
        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:942)

MessageDigest.update input hexstr:6A196A6D1D6D6A1D1A186D1D181F6D6A18641F6F1D1F181A1A6C186A1D656A645C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5CEDF43E1AAC2CA41215F8AD3B27023B84E6740739
=============MessageDigest.update end tid:2=============

RegisterNative method print

The native functions of static registration and dynamic registration of the target application will be output. The output log is as follows.

mikrom ClassLinker::RegisterNative void J.N.MP48r$4B(long, int) native_ptr:0x7016d43ed4 method_idx:0x220 offset:0x50d5ed4 module_name:/data/app/~~Zui0KYYtvHL5CVqIOm3VCQ==/com.google.android.webview-0TQXdjuHeYI14JIKsnB00A==/WebViewGoogle.apk!/lib/arm64-v8a/libmonochrome.so
mikrom ClassLinker::RegisterNative void J.N.Mdl6A1eo(boolean, boolean) native_ptr:0x7015a744e0 method_idx:0x356 offset:0x3e064e0 module_name:/data/app/~~Zui0KYYtvHL5CVqIOm3VCQ==/com.google.android.webview-0TQXdjuHeYI14JIKsnB00A==/WebViewGoogle.apk!/lib/arm64-v8a/libmonochrome.so
mikrom ClassLinker::RegisterNative void J.N.MGnQU$47(long, java.lang.Object, long, java.lang.String) native_ptr:0x70148bd5cc method_idx:0x164 offset:0x2c4f5cc module_name:/data/app/~~Zui0KYYtvHL5CVqIOm3VCQ==/com.google.android.webview-0TQXdjuHeYI14JIKsnB00A==/WebViewGoogle.apk!/lib/arm64-v8a/libmonochrome.so
mikrom ClassLinker::RegisterNative java.lang.String[] J.N.MdQEl6jg(java.lang.String, java.lang.String) native_ptr:0x7016edfe38 method_idx:0x349 offset:0x5271e38 module_name:/data/app/~~Zui0KYYtvHL5CVqIOm3VCQ==/com.google.android.webview-0TQXdjuHeYI14JIKsnB00A==/WebViewGoogle.apk!/lib/arm64-v8a/libmonochrome.so

Native method print

When the native function is executed and left, log output is performed. The output log is as follows.

mikrom leave jni byte[] libcore.util.CharsetUtils.toUtf8Bytes(java.lang.String, int, int) 0x71ede500f0
mikrom leave jni java.lang.Class java.lang.Class.classForName(java.lang.String, boolean, java.lang.ClassLoader) 0x71ede500f0
mikrom leave jni java.lang.reflect.Method java.lang.Class.getDeclaredMethodInternal(java.lang.String, java.lang.Class[]) 0x71ede500f0
mikrom leave jni java.lang.Class java.lang.reflect.Executable.getMethodReturnTypeInternal() 0x71ede500f0
mikrom leave jni java.lang.Object java.lang.reflect.Array.createObjectArray(java.lang.Class, int) 0x71ede500f0
mikrom leave jni java.lang.reflect.Constructor java.lang.Class.getDeclaredConstructorInternal(java.lang.Class[]) 0x71ede500f0
mikrom enter jni long com.android.org.conscrypt.NativeCrypto.EVP_CIPHER_CTX_new() 0x71ede500f0