《dalvik dex文件格式分析》由会员分享，可在线阅读，更多相关《dalvik dex文件格式分析（17页珍藏版）》请在金锄头文库上搜索。
1、Comment U1: ubyte8 DEX_FILE_MAGIC = dexn0350Comment U2: checksumComment U3: uint 文件字节数 Comment U4: uint header字节数0x70Comment U5: uint = ENDIAN_CONSTANT 0x12345678Comment U6: size of the link sectionComment U7: offset from the start of the file to the link sectionComment U8: offset from the start of
2、the file to the map itemComment U9: count of strings in the string identifiers listComment U10: offset from the start of the file to the string identifiers listComment U11: count of elements in the type identifiers listComment U12: offset from the start of the file to the type identifiers listCommen
3、t U13: count of elements in the prototype identifiers listComment U14: offset from the start of the file to the prototype identifiers listComment U15: count of elements in the field identifiers listComment U16: offset from the start of the file to the field identifiers listComment U17: count of elem
4、ents in the method identifiers listComment U18: offset from the start of the file to the method identifiers listComment U19: count of elements in the class definitions listComment U20: offset from the start of the file to the class definitions listComment U21: Size of data section in bytesComment U2
5、2: offset from the start of the file to the start of the data section.Comment U23: String id 列表，总共有 14（0xe）个 string_id_itemComment U24: Type id列表， 7个type_id_itemComment U25: prototype id列表，3个 proto_id_itemComment U26: field id列表，1 个field_id_itemComment U27: method id列表，4个 method_id_itemComment U28:
6、class def列表，1 个DEX文件格式0. 实验$ vi test.javaclass testpublic static void main(String argc)System.out.println(test!);$ javac test.java$ dx -dex -output=test.dex test.class$ hexdump test.dex0000000 6564 0a78 3330 0035 5eb4 4f7a 94e6 65f00000010 fb3e d5f3 e185 dd62 fce7 c887 a7ec 53290000020 02d8 0000 007
7、0 0000 5678 1234 0000 00000000030 0000 0000 0238 0000 000e 0000 0070 00000000040 0007 0000 00a8 0000 0003 0000 00c4 00000000050 0001 0000 00e8 0000 0004 0000 00f0 00000000060 0001 0000 0110 0000 01a8 0000 0130 00000000070 0176 0000 017e 0000 0195 0000 01a9 00000000080 01bd 0000 01d1 0000 01d9 0000 0
8、1dc 00000000090 01e0 0000 01f5 0000 01fb 0000 0200 000000000a0 0209 0000 0210 0000 0001 0000 0002 000000000b0 0003 0000 0004 0000 0005 0000 0006 000000000c0 0008 0000 0006 0000 0005 0000 0000 000000000d0 0007 0000 0005 0000 0168 0000 0007 000000000e0 0005 0000 0170 0000 0003 0000 000a 000000000f0 00
9、00 0001 000b 0000 0001 0000 0000 00000000100 0004 0000 0000 0000 0004 0002 0009 00000000110 0004 0000 0000 0000 0001 0000 0000 00000000120 000d 0000 0000 0000 0227 0000 0000 00000000130 0001 0001 0001 0000 021b 0000 0004 00000000140 1070 0001 0000 000e 0003 0001 0002 00000000150 0220 0000 0008 0000
10、0062 0000 011a 000c0000160 206e 0000 0010 000e 0001 0000 0002 00000000170 0001 0000 0006 3c06 6e69 7469 003e 4c150000180 616a 6176 692f 2f6f 7250 6e69 5374 72740000190 6165 3b6d 1200 6a4c 7661 2f61 616c 676e00001a0 4f2f 6a62 6365 3b74 1200 6a4c 7661 2f6100001b0 616c 676e 532f 7274 6e69 3b67 1200 6a4
11、c00001c0 7661 2f61 616c 676e 532f 7379 6574 3b6d00001d0 0600 744c 7365 3b74 0100 0056 5602 004c00001e0 5b13 6a4c 7661 2f61 616c 676e 532f 727400001f0 6e69 3b67 0400 616d 6e69 0300 756f 00740000200 7007 6972 746e 6e6c 0500 6574 7473 0021Comment U29: 批注 8所的值为0x238，指向一个 map_list类型，map_list第一个值为 0xd，所以这
12、个map_list有 13个 map_item，见下面。0000210 7409 7365 2e74 616a 6176 0100 0700 000e0000220 0103 0700 780e 0000 0200 0200 8080 b0040000230 0102 c809 0002 0000 000d 0000 0000 00000000240 0001 0000 0000 0000 0001 0000 000e 00000000250 0070 0000 0002 0000 0007 0000 00a8 00000000260 0003 0000 0003 0000 00c4 0000
13、 0004 00000000270 0001 0000 00e8 0000 0005 0000 0004 00000000280 00f0 0000 0006 0000 0001 0000 0110 00000000290 2001 0000 0002 0000 0130 0000 1001 000000002a0 0002 0000 0168 0000 2002 0000 000e 000000002b0 0176 0000 2003 0000 0002 0000 021b 000000002c0 2000 0000 0001 0000 0227 0000 1000 000000002d0
14、0001 0000 0238 000000002d81. map_listmap_list数据结构为：Name Format Descriptionsize uint size of the list, in entrieslist map_itemsize elements of the list第一项为 map_list的大小，其中 map_item的结构为：Name Format Descriptiontype ushort type of the items; see table belowunused ushort (unused)size uint count of the num
15、ber of items to be found at the indicated offsetoffset uint offset from the start of the file to the items in questiontype的值如下表：Item Type Constant Value Item Size In Bytesheader_item TYPE_HEADER_ITEM 0x0000 0x70string_id_item TYPE_STRING_ID_ITEM 0x0001 0x04type_id_item TYPE_TYPE_ID_ITEM 0x0002 0x04p
16、roto_id_item TYPE_PROTO_ID_ITEM 0x0003 0x0cfield_id_item TYPE_FIELD_ID_ITEM 0x0004 0x08method_id_item TYPE_METHOD_ID_ITEM 0x0005 0x08class_def_item TYPE_CLASS_DEF_ITEM 0x0006 0x20map_list TYPE_MAP_LIST 0x1000 4 + (item.size * 12)type_list TYPE_TYPE_LIST 0x1001 4 + (item.size * 2)annotation_set_ref_list TYPE_ANNOTATION_SET_REF_LIST 0x1002 4 + (item.size * 4)annotation_set_item TYPE_ANNOTATI
