
像上图中这种包含不可见字符的, 我们可以用下面的脚本来显示他的16进制编码, 结果是Unicode编码, 如果是单字节的, 要移除多余的0
from com.pnfsoftware.jeb.client.api import IScript from com.pnfsoftware.jeb.core.events import JebEvent, J from com.pnfsoftware.jeb.core.units.code import ICodeUnit, ICodeItem from com.pnfsoftware.jeb.core.units.code.android import IDexUnit from com.pnfsoftware.jeb.core.units.code.android.dex import IDexString from com.pnfsoftware.jeb.core.output import ItemClassIdentifiers import binascii """ Sample client script for PNF Software' JEB. Demo of the DEX manipulation methods exposed in the specialized IDexUnit interface. Will replace the DEX code string 'text/html' by 'foobar'. """ class DexManipulation(IScript): def run(self, ctx): prj = ctx.getMainProject() dex = prj.findUnit(IDexUnit) if not dex: print('DEX unit not found') return f = ctx.getFocusedFragment() curItem = f.getActiveItem() if (curItem.getClassId() == ItemClassIdentifiers.STRING_GENERATED): s = curItem.getText() s = s.decode('unicode_escape') s = binascii.b2a_hex(s.encode('unicode')) print(s[8:-4])