Introduction to Dalvik VM. Kim Seongjin Sangji Univ.

Size: px

Start display at page:

Download "Introduction to Dalvik VM. Kim Seongjin Sangji Univ."

Phyllis O’Connor’
6 years ago
Views:

1 Introduction to Dalvik VM Kim Seongjin Sangji Univ.

2 Android Architecture Dalvik VM ú Dex file format ú The Register-based VM ú Zygote 2

3 Android Architecture 3

4 Android Architecture 4

5 Android Architecture 5

6 Target Platform Feature Chipset Memory Storage Primary Display Navigation Keys Camera USB Minimum Requirement ARM-based 128MB RAM; 256 MB Flash External Mini or Micro SD QVGA TFT LCD or larger, 16-bit color or better 5-way navigation with 5 application keys, power, camera and volume controls 2MP CMOS Standard mini-b USB interface Bluetooth 1.2 or 2.0 6

7 Target Platform Feature Chipset Memory Storage Primary Display Navigation Keys Camera USB Minimum Requirement ARM-based 128MB RAM; 256 MB Flash External Mini or Micro SD QVGA TFT LCD or larger, 16-bit color or better 5-way navigation with 5 application keys, power, camera and volume controls 2MP CMOS Standard mini-b USB interface Bluetooth 1.2 or 2.0 7

8 Target Platform Feature Chipset Memory Storage Primary Display Navigation Keys Camera USB Minimum Requirement ARM-based 128MB RAM; 256 MB Flash External Mini or Micro SD QVGA TFT LCD or larger, 16-bit color or better 5-way navigation with 5 application keys, power, camera and volume controls 2MP CMOS Standard mini-b USB interface Bluetooth 1.2 or 2.0 8

9 Target Platform Feature Chipset Memory Storage Primary Display Navigation Keys Camera USB Minimum Requirement ARM-based 128MB RAM; 256 MB Flash External Mini or Micro SD QVGA TFT LCD or larger, 16-bit color or better 5-way navigation with 5 application keys, power, camera and volume controls 2MP CMOS Standard mini-b USB interface Bluetooth 1.2 or 2.0 9

10 Android Runtime Android Runtime must support the following, ú Limited processor speed ú Limited and a little RAM size ú No swap space ú Use battery power ú Diverse set of devices ú Sandboxed application runtime 10

11 Android Runtime Android Runtime must support the following, ú Limited processor speed ú Limited and a little RAM size ú No swap space ú Use battery power ú Diverse set of devices ú Sandboxed application at runtime 11

12 Android Runtime Every Android Application runs in its own process, with its own instance virtual machine. 12

13 Android Runtime Every Android Application runs in its own process, with its own instance virtual machine. è Efficiency of Multiple VMs è Fast speed of creation of new VMs 13

14 Dalvik VM Process Virtual Machine Dalvik Executable file format (.dex) Register-based VM 14

15 Process Virtual Machine The execution of a single process is supported. The execution of multiple applications associated with multiple process can be created. Platform independency 15

Dex file format Dalvik VM executes a.dex file which converts *.class compiled by java complier into a *.dex (Dalvik Executable) using dx tool. Whereas a.

16 Dex file format Dalvik VM executes a.dex file which converts *.class compiled by java complier into a *.dex (Dalvik Executable) using dx tool. Whereas a.class file contains only one class, a.dex file contains multiple classes. javac *.java *.class *.dex dx *.java javac *.class *.class *.class dx *.dex 16

17 17

18 18

19 HelloWorld.java public class HelloWorld { public static void main(string[] args) { System.out.println("Hello world!!"); } } 19

access_flags this_flags super_flags interfaces_count cp[14]:name &type cp[15]: class cp[16]:name &type cp[17]: Utf8 cp[18]: class cp[19]:name

20 .class file format magic number minor version major version constant pool [28] cp[0]: method_ref cp[1]: field_ref cp[2]: string _ref cp[3]: method_ref cp[4]: class cp[5]: class cp[6]: Utf8 cp[7]: Utf8 cp[8]: Utf8 cp[9]: Utf8 cp[10]: Utf8 cp[11]: Utf8 cp[12]: Utf8 cp[13]: Utf8 access_flags this_flags super_flags interfaces_count cp[14]:name &type cp[15]: class cp[16]:name &type cp[17]: Utf8 cp[18]: class cp[19]:name &type cp[20]: Utf8 cp[21]: Utf8 cp[22]: Utf8 cp[23]: Utf8 cp[24]: Utf8 cp[25]: Utf8 cp[26]: Utf8 cp[27]: Utf8 fields_count methods_count method_info & attribute_info 20

string_ids_off type_ids_off proto_ids_off field_ids_off method_ids_off class_ids_off data_ids_off 0xA8:type_ids(4) 0xe8:field_ids(8) 0x110:class_ids(32)

21 .dex file format magic number checksum signature file_size header_size endian_tag link_size string_ids_size (14) type_ids_size (7) proto_ids_size (3) field_ids_size (1) method_ids_size (4) class_ids_size (1) data_ids_size (444) 0x70:string_ids (4) 0xc4:proto_ids(12) 0xf0:method_ids(8) link_off map_off string_ids_off type_ids_off proto_ids_off field_ids_off method_ids_off class_ids_off data_ids_off 0xA8:type_ids(4) 0xe8:field_ids(8) 0x110:class_ids(32) 0x130:data_ids string #1 string #2 string #3 string #4 string #5 string #6 string #7 string #8 string #9 string #10 string #11 string #12 string #13 string #14 map_size(13) map #1 ~ map #13 21

22 Calculator.java class Plus { Plus(int a, int b) { m_addval = a+b; } public int getvalue() {return m_addval;}; private int m_addval; } public class Calculator{ public static void main(string[] args) { Plus pl = new Plus(10, 11); Minus mi = new Minus(10, 11); class Minus { Minus(int a, int b) { m_subval = a-b; } } } System.out.println("10+11=" + pl.getvalue()); System.out.println("10-11=" + mi.getvalue()); System.out.println("End Cal."); public int getvalue() {return m_subval;}; private int m_subval; } 22

23 Dex file format The repetition of constant values of constants pools is kept to a minimum. è It can be resulted in significant memory saving and decreasing file size. Code Common System Libraries Uncompressed JAR File (bytes) Compressed JAR File (bytes) Uncompressed dex File (bytes) 21,445,320 (100%) 10,662,048 (50%) 10,311,972 (48%) Web Browser App 470,312 (100%) 232,065 (49%) 209,248 (44%) Alarm Clock App 119,200 (100%) 61,658 (52%) 53,020 (44%) 23

24 Register-based VM c = a + b 24

25 Register-based VM c = a + b Stack-based VM push a push b add store c # LS # LS # LLS # LS 25

26 Register-based VM c = a + b Stack-based VM Register-based VM push a # LS add a, b, c # LLS push b # LS add # LLS store c # LS 26

27 Register-based VM Avoid instruction dispatch Avoid unnecessary memory access Consume instruction stream efficiently higher semantic density per instruction è The performance of interpreter is improved. 27

28 Sum.java public class Sum{ public static void main(string[] args) { int sum = 0; } } for(int i=1; i<=10; i++) sum += i; 28

29 Zygote It is a VM process that starts at system boot time. 1. Boot-loader load kernel and start init process. 2. Starts Zygote process 3. Initializes a Dalvik VM which preloads and preinitializes core library classes. 4. Keep in an idle state by system and wait for socket requests. 5. Once an application execution request occur, Zygote forks itself and create new process with pre-loaded Dalvik VM. 29

30 Zygote Application Dalvik VM Application Dalvik VM Application Dalvik VM Daemons Runtime Zygote libc libc libc fork() Init Kernel 30

31 reference [1] [2] VM.pdf [3] [4] [7] [5] [6] 31

Reverse Engineering of Managed Languages

Reverse Engineering of Managed Languages IT Security Bootcamp 2017 Dorottya Papp Agenda Reverse engineering Managed languages Introduction: what makes a programming language managed? Intermediate language