AndroidEmulator emulator = AndroidEmulatorBuilder.for32Bit()
        .setProcessName("com.example.test")
        .build();

Memory memory = emulator.getMemory();
memory.setLibraryResolver(new AndroidResolver(23)); // 23 代表 Android 版本

VM vm = emulator.createDalvikVM();
vm.setJni(new AbstractJni() {});
vm.setVerbose(true); // 打开日志输出

DalvikModule dm = vm.loadLibrary(new File("path\\libxyz.so"), false);
Module module = dm.getModule();

package com.bigsing.unidbgdemo;

import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Module;
import com.github.unidbg.arm.backend.Unicorn2Factory;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.AbstractJni;
import com.github.unidbg.linux.android.dvm.DalvikModule;
import com.github.unidbg.linux.android.dvm.DvmClass;
import com.github.unidbg.linux.android.dvm.DvmObject;
import com.github.unidbg.linux.android.dvm.VM;
import com.github.unidbg.linux.android.dvm.array.ByteArray;
import com.github.unidbg.memory.Memory;
import com.github.unidbg.virtualmodule.android.AndroidModule;
import com.sun.jna.Pointer;

import java.io.File;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;

public class MyClass extends AbstractJni {
    final AndroidEmulator emulator;
    final VM vm;
    final Module module;
    final DalvikModule dalvikModule;

    MyClass() {
        // 创建 Android ARM 32位模拟器
        emulator = AndroidEmulatorBuilder.for32Bit()
                .setProcessName("com.example.test")
                .addBackendFactory(new Unicorn2Factory(true))
                .build();

        // 获取模拟内存并设置 Android 版本解析器
        Memory memory = emulator.getMemory();
        memory.setLibraryResolver(new AndroidResolver(23)); // 23 代表 Android 版本

        // 创建 Android 虚拟机
        vm = emulator.createDalvikVM();
        vm.setJni(this);
        vm.setVerbose(true);

        // 注册 Android 模块，确保 Unidbg 能正确解析系统库
        new AndroidModule(emulator, vm).register(memory);

        // 加载目标 so 文件
        dalvikModule = vm.loadLibrary(new File("E:\\APPs\\libxyz.so"), false);
        module = dalvikModule.getModule(); // 获取加载后的模块对象
    }

    public static void main(String[] args) {
        String input = "这里是加密字符串..."; 
        MyClass test = new MyClass();
        test.callFuncByOffset(input);
        test.callFuncByRegister(input);
    }

    // 通过 JNI 注册的方法调用
    public void callFuncByRegister(String input) {
        byte[] inData = input.getBytes(StandardCharsets.UTF_8);
        final byte[] outData = new byte[4096];
        ByteArray inByteArray = new ByteArray(vm, inData);
        ByteArray outByteArray = new ByteArray(vm, outData);

        // 执行 JNI_OnLoad 以初始化 JNI 相关的符号
        dalvikModule.callJNI_OnLoad(emulator);
        DvmClass nativeClass = vm.resolveClass("com/xyz/app/abcd");

        try {
            // 调用 targetFunc 方法
            int len = nativeClass.callStaticJniMethodInt(emulator,
                    "targetFunc(Landroid/content/Context;I[B[B)I",
                    null,
                    1,
                    vm.addLocalObject(inByteArray),
                    vm.addLocalObject(outByteArray));

            if (len > 0) {
                byte[] out = outByteArray.getValue();
                System.out.println("[Register Call] Decoded Text: " + new String(out, StandardCharsets.UTF_8));
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    // 通过 native 层函数偏移调用
    public void callFuncByOffset(String input) {
        Pointer env = vm.getJNIEnv(); // 获取 JNI 环境指针

        byte[] inData = input.getBytes(StandardCharsets.UTF_8);
        final byte[] outData = new byte[4096];
        ByteArray inByteArray = new ByteArray(vm, inData);
        ByteArray outByteArray = new ByteArray(vm, outData);

        // 获取目标 Java 类对象的引用
        DvmClass nativeClass = vm.resolveClass("com/xyz/app/abcd");
        DvmObject<?> nativeClassObject = nativeClass.newObject(null);
        int jclassRef = vm.addLocalObject(nativeClassObject);  // 获取 Java 层的 jclass 句柄，也可以填 0

        // 构造参数列表
        ArrayList<Object> list_arg = new ArrayList<>();
        list_arg.add(env);          // JNIEnv*
        list_arg.add(jclassRef);    // jclass (静态方法调用)
        list_arg.add(null);         // Context (可选参数)
        list_arg.add(1);            // int 参数
        list_arg.add(vm.addLocalObject(inByteArray));  // byte[] 输入数据
        list_arg.add(vm.addLocalObject(outByteArray)); // byte[] 输出数据

        // 调用目标 native 层函数，偏移地址 0x6A60
        Number result = module.callFunction(emulator, 0x6A60, list_arg.toArray());
        int len = result.intValue();

        if (len > 0) {
            byte[] out = outByteArray.getValue();
            System.out.println("[Offset Call] Decoded Text: " + new String(out, StandardCharsets.UTF_8));
        }
    }
}

JNIEnv->FindClass(com/xyz/app/abcd) was called from RX@0x40004e60[libxyz.so]0x4e60
JNIEnv->NewGlobalRef(class com/xyz/app/abcd) was called from RX@0x40004e80[libxyz.so]0x4e80
JNIEnv->FindClass(java/lang/String) was called from RX@0x40004ec0[libxyz.so]0x4ec0
JNIEnv->NewGlobalRef(class java/lang/String) was called from RX@0x40004ee0[libxyz.so]0x4ee0
JNIEnv->RegisterNatives(com/xyz/app/abcd, RW@0x4001a6a0[libxyz.so]0x1a6a0, 3) was called from RX@0x40004f2c[libxyz.so]0x4f2c
RegisterNative(com/xyz/app/abcd, targetFunc1(Landroid/content/Context;II)I, RX@0x40005cbc[libxyz.so]0x5cbc)
RegisterNative(com/xyz/app/abcd, targetFunc2(Landroid/content/Context;ILjava/lang/String;Ljava/lang/String;[BII)J, RX@0x4000646c[libxyz.so]0x646c)
RegisterNative(com/xyz/app/abcd, targetFunc(Landroid/content/Context;I[B[B)I, RX@0x40006a60[libxyz.so]0x6a60)
Find native function Java_com_xyz_app_abcd_targetFunc => RX@0x40006a60[libxyz.so]0x6a60
JNIEnv->GetArrayLength([B@496bc455 => 231) was called from RX@0x40006aa0[libxyz.so]0x6aa0

public static void main(String[] args) {
    try {
        // 创建日志文件
        File logFile = new File("trace_log.txt");
        PrintStream fileOut = new PrintStream(logFile);
        System.out.println(logFile.getAbsolutePath());

        // 重定向 System.out 到文件
        System.setOut(fileOut);
        
        // 根据情况选择要不要把错误输出也重定向到文件
        System.setErr(fileOut);
    } catch (Exception e) {
    }
    
    // ...
}

// 函数调用记录
private final Map<Long, CallRecord> callRecords = new LinkedHashMap<>();


private void traceCode() {
    // 获取 SO 模块的基地址
    long base = module.base;
    long size = module.size;

    // 开启代码跟踪
    emulator.traceCode(base, base + size, new TraceCodeListener() {
        @Override
        public void onInstruction(Emulator<?> emulator, long address, Instruction insn) {
            if (insn.getMnemonic().equals("blx") || insn.getMnemonic().equals("bl")) {
                RegisterContext context = emulator.getContext();
                long timestamp = System.nanoTime(); // 记录当前时间
                long targetAddress;

                Capstone.OpInfo operands = insn.getOperands();
                Arm.Operand operand = ((Arm.OpInfo) operands).operands[0];

                if (operand.type == Arm_const.ARM_OP_REG) {
                    targetAddress = Integer.toUnsignedLong(context.getIntByReg(operand.value.reg));
                } else {
                    targetAddress = operand.value.imm;
                }

                // 记录调用地址
                callRecords.compute(targetAddress, (key, record) -> {
                    if (record == null) {
                        return new CallRecord(targetAddress, timestamp);
                    } else {
                        record.increment();
                        return record;
                    }
                });

                System.out.printf("%08X %s // %08X\n", address, insn.toString(), targetAddress);
            }
        }
    });
}


public class CallRecord {
    long address;
    long firstTimestamp;
    int count;

    CallRecord(long address, long timestamp) {
        this.address = address;
        this.firstTimestamp = timestamp;
        this.count = 1;
    }

    void increment() {
        this.count++;
    }
}


public void printCallRecords() {
    System.out.println("\n==== Call Records ====");
    // 按 firstTimestamp 进行排序
    List<CallRecord> sortedRecords = new ArrayList<>(callRecords.values());
    sortedRecords.sort(Comparator.comparingLong(record -> record.firstTimestamp));

    // 输出排序后的调用记录
    for (CallRecord record : sortedRecords) {
        System.out.printf("First Call Time: %d, 0x%08X, Call Count: %d\n",
                          record.firstTimestamp, record.address, record.count);
    }
}

private static final int PARAM_COUNT = 8;       // 假设所有函数都有 8 个参数
private static final int HEXDUMP_SIZE = 200;    // HexDump 大小

// 定义一个成员变量来缓存每个函数调用的参数
private final Map<Long, Map<Integer, Object>> funcParamCache = new HashMap<>();


private void hook_funcs(long[] offsets) {
    for (long offset : offsets) {
        long targetAddress = module.base + offset;
        emulator.attach().addBreakPoint(targetAddress, new BreakPointCallback() {
            @Override
            public boolean onHit(Emulator<?> emulator, long address) {
                RegisterContext context = emulator.getContext();
                boolean is64Bit = emulator.is64Bit();

                System.out.println("\n===>>> Entering function at offset: 0x" + Long.toHexString(offset));

                // 创建一个新的 paramCache，与当前函数调用关联
                Map<Integer, Object> paramCache = new HashMap<>();
                funcParamCache.put(address, paramCache);

                for (int i = 0; i < PARAM_COUNT; i++) {
                    Pointer ptr = context.getPointerArg(i);
                    long value = is64Bit ? context.getLongArg(i) : context.getIntArg(i);

                    boolean isMemoryReadable = isReadableMemory(ptr);
                    ArgItem argItem = new ArgItem(ptr, value, isMemoryReadable);
                    paramCache.put(i, argItem); // 存入缓存
                    printParamInfo("Arg" + i, argItem);
                }

                // **监听返回地址**
                long returnAddress = context.getLRPointer().peer;
                emulator.attach().addBreakPoint(returnAddress, new BreakPointCallback() {
                    @Override
                    public boolean onHit(Emulator<?> emulator, long address) {
                        RegisterContext context = emulator.getContext();
                        boolean is64Bit = emulator.is64Bit();

                        System.out.println("\n<<<=== Returning from function at offset: 0x" + Long.toHexString(offset));

                        // 获取当前函数的 paramCache
                        Map<Integer, Object> paramCache = funcParamCache.remove(targetAddress);
                        if (paramCache == null) {
                            System.err.println("No param cache found for function at offset: 0x" + Long.toHexString(offset));
                            return true;
                        }

                        // 解析参数
                        for (int j = 0; j < PARAM_COUNT; j++) {
                            System.out.println("Cached Arg " + j);
                            ArgItem argItem = (ArgItem) paramCache.getOrDefault(j, null);
                            printParamInfo("Cached Arg" + j, argItem);
                        }

                        // **解析返回值**
                        Pointer retPtr = context.getLRPointer();
                        long retValue = context.getLR();

                        boolean isMemoryReadable = isReadableMemory(retPtr);
                        ArgItem argItem = new ArgItem(retPtr, retValue, isMemoryReadable);
                        printParamInfo("Return Value", argItem );

                        return true;
                    }
                });

                return true;
            }
        });
    }
}


public class ArgItem {
    public Pointer ptr;
    long value;
    boolean isMemoryReadable;

    ArgItem(Pointer ptr, long value, boolean isMemoryReadable) {
        this.ptr = ptr;
        this.value = value;
        this.isMemoryReadable = isMemoryReadable;
    }
}


// **📌 输出参数/返回值信息**
private void printParamInfo(String label, ArgItem argItem) {
    System.out.printf("%s: Decimal=%d, Hex=0x%x\n", label, argItem.value, argItem.value);

    // **如果是指针，并且可读**
    if (argItem.isMemoryReadable) {
        System.out.printf("%s (HexDump):\n%s\n", label, hexdump(argItem.ptr, HEXDUMP_SIZE));
    }
}

// **📌 判断是否是可读内存**
private boolean isReadableMemory(Pointer ptr) {
    if (ptr == null) {
        return false;
    }
    try {
        byte[] data = ptr.getByteArray(0, 1);   // 尝试读取 1 字节，判断是否可访问
        return true;
    } catch (Exception e) {
        return false;
    }
}

// **📌 HexDump 实现**
private String hexdump(Pointer ptr, int length) {
    byte[] data = ptr.getByteArray(0, length);
    StringBuilder hexDump = new StringBuilder();

    for (int i = 0; i < data.length; i += 16) {
        StringBuilder hexPart = new StringBuilder();
        StringBuilder asciiPart = new StringBuilder();

        for (int j = 0; j < 16 && i + j < data.length; j++) {
            byte b = data[i + j];
            hexPart.append(String.format("%02X ", b));
            asciiPart.append((b >= 32 && b <= 126) ? (char) b : '.');
        }

        hexDump.append(String.format("%08X  %-48s  %s%n", i, hexPart, asciiPart));
    }
    return hexDump.toString();
}

hook_funcs(new long[]{0xBD84, 0x13EA00, x12190, 0x12634, 0x17298});

public void printCallRecords() {
    System.out.println("\n==== Call Records ====");
    // 按 firstTimestamp 进行排序
    List<CallRecord> sortedRecords = new ArrayList<>(callRecords.values());
    sortedRecords.sort(Comparator.comparingLong(record -> record.firstTimestamp));

    // 输出排序后的调用记录
    for (CallRecord record : sortedRecords) {
        System.out.printf("First Call Time: %d, 0x%08X, Call Count: %d\n",
                          record.firstTimestamp, record.address, record.count);
    }

    // 获取列表中count为1的元素
    List<CallRecord> countOneRecords = sortedRecords.stream()
        .filter(record -> record.count == 1)
        .collect(Collectors.toList());

    // 格式化生成一个字符串：对元素的地址address进行join
    StringBuilder sb = new StringBuilder();
    for (CallRecord record : countOneRecords) {
        sb.append(String.format("0x%X", record.address - module.base)).append(", ");
    }

    // 去掉最后多余的 ", "
    if (sb.length() > 0) {
        sb.setLength(sb.length() - 2);
    }

    String addressString = sb.toString();
    System.out.println("\nAddresses with count 1: " + addressString);
}