JEB 显示反编译字符串的16进制编码

像上图中这种包含不可见字符的, 我们可以用下面的脚本来显示他的16进制编码, 结果是Unicode编码, 如果是单字节的, 要移除多余的0

from com.pnfsoftware.jeb.client.api import IScript
from com.pnfsoftware.jeb.core.events import JebEvent, J
from com.pnfsoftware.jeb.core.units.code import ICodeUnit, ICodeItem
from com.pnfsoftware.jeb.core.units.code.android import IDexUnit
from com.pnfsoftware.jeb.core.units.code.android.dex import IDexString
from com.pnfsoftware.jeb.core.output import ItemClassIdentifiers
import binascii

"""
Sample client script for PNF Software' JEB.
Demo of the DEX manipulation methods exposed in the specialized IDexUnit interface.
Will replace the DEX code string 'text/html' by 'foobar'.
"""
class ShowStringHex(IScript):
  def run(self, ctx):
    prj = ctx.getMainProject()
    dex = prj.findUnit(IDexUnit)
    if not dex:
      print('DEX unit not found')
      return

    f = ctx.getFocusedFragment()
    curItem = f.getActiveItem()
    if (curItem.getClassId() == ItemClassIdentifiers.STRING_GENERATED):
        s = curItem.getText()
        s = s.decode('unicode_escape')
        s = binascii.b2a_hex(s.encode('unicode'))
        asc_s = s[8:-4].upper()
        print(asc_s)
        i = 0
        new_s = ""
        while i < len(asc_s):
            new_s = new_s + asc_s[i+2:i+4] + ' '
            i = i + 4
        print(new_s)