Smali¶

#instance fields
.field <訪問權限修飾符> [非權限修飾符] <字段名>:<字段類型>

# instance fields
.field private str1:Ljava/lang/String;

private java.lang.String str1;

#static fields
.field <訪問權限> static [修飾詞] <字段名>:<字段類型>

# static fields
.field public static str2:Ljava/lang/String;

public static java.lang.String str2;

# 描述方法類型
.method <訪問權限修飾符> [修飾符] <方法原型>
      <.locals>
      [.parameter]
      [.prologue]
      [.line]
      <代碼邏輯>
      [.line]
      <代碼邏輯>
.end

.class <訪問權限修飾符> [非權限修飾符] <類名>
.super <父類名>
.source <源文件名稱>

.class public final Lcom/a/b/c;
.super Ljava/lang/Object;
.source "Demo.java"

#interfaces
.implements <接口名稱>

# interfaces
.implements Landroid/view/View$OnClickListener;

public class MainActivity extends Activity {   //this$0
   public class firstinner  //this$1
   {
      public class secondinner //this$2
      {
         public class thirdinner //this$3
         {

         }
      }
   }
}

MainActivity.smali
MainActivity$firstinner.smali
MainActivity$firstinner$secondinner.smali
MainActivity$firstinner$thirdinner.smali

#annotations
.annotation [註解的屬性] <註解範圍>
    [註解字段=值]
    ...
.end

boolean z = true;
z = false;
byte b = 1;
short s = 2;
int i = 3;
long l = 4;
float f = 0.1f;
double d = 0.2;
String str = "test";
Class c = Object.class;

const/4 v10, 0x1
const/4 v10, 0x0
const/4 v0, 0x1
const/4 v8, 0x2
const/4 v5, 0x3
const-wide/16 v6, 0x4
const v4, 0x3dcccccd    # 0.1f
const-wide v2, 0x3fc999999999999aL    # 0.2
const-string v9, "test"
const-class v1, Ljava/lang/Object;

int a = 5, b = 2;
a += b;
a -= b;
a *= b;
a /= b;
a %= b;
a &= b;
a |= b;
a ^= b;
a <<= b;
a >>= b;
a >>>= b;

const/4 v0, 0x5
const/4 v1, 0x2
add-int/2addr v0, v1
sub-int/2addr v0, v1
mul-int/2addr v0, v1
div-int/2addr v0, v1
rem-int/2addr v0, v1
and-int/2addr v0, v1
or-int/2addr v0, v1
xor-int/2addr v0, v1
shl-int/2addr v0, v1
shr-int/2addr v0, v1
ushr-int/2addr v0, v1

int[] arr = new int[10];

const/4 v1, 0xa
new-array v0, v1, I

int[] arr = {1, 2, 3, 4, 5};

const/4 v1, 0x1
const/4 v2, 0x2
const/4 v3, 0x3
const/4 v4, 0x4
const/4 v5, 0x5
filled-new-array {v1, v2, v3, v4, v5}, I
move-result v0

const/4 v1, 0x1
const/4 v2, 0x2
const/4 v3, 0x3
const/4 v4, 0x4
const/4 v5, 0x5
filled-new-array-range {v1..v5}, I
move-result v0

Object obj = new Object();

new-instance v0, Ljava/lang/Object;
invoke-direct-empty {v0}, Ljava/lang/Object;-><init>()V

String s = "test";
boolean b = s instanceof String;

const-string v0, "test"
instance-of v1, v0, Ljava/lang/String;

String s = "test";
Object o = (Object)s;

const-string v0, "test"
check-cast v0, Ljava/lang/Object;
move-object v1, v0

int[] arr = new int[2];
int b = arr[0];
arr[1] = b;

const/4 v0, 0x2
new-array v1, v0, I
const/4 v0, 0x0
aget-int v2, v1, v0
const/4 v0, 0x1
aput-int v2, v1, v0

sget v0, Lcom/example/Test;->staticField:I

int a = 10
if(a > 0)
    a = 1;
else
    a = 0;

const/4 v0, 0xa
if-lez v0, :cond_0 # if 塊開始
const/4 v0, 0x1
goto :cond_1       # if 塊結束
:cond_0            # else 塊開始
const/4 v0, 0x0
:cond_1            # else 塊結束

int a = 10;
if(a > 0)
    a = 1;

const/4 v0, 0xa
if-lez v0, :cond_0 # if 塊開始
const/4 v0, 0x1
:cond_0            # if 塊結束

int a = 10;
switch (a){
    case 0:
        a = 1;
        break;
    case 1:
        a = 5;
        break;
    case 2:
        a = 10;
        break;
    case 3:
        a = 20;
        break;
}

const/16 v0, 0xa

packed-switch v0, :pswitch_data_0 # switch 開始

:pswitch_0                        # case 0
const/4 v0, 0x1
goto :goto_0

:pswitch_1                        # case 1
const/4 v0, 0x5
goto :goto_0

:pswitch_2                        # case 2
const/16 v0, 0xa
goto :goto_0

:pswitch_3                        # case 3
const/16 v0, 0x14
goto :goto_0

:goto_0                           # switch 結束
return-void

:pswitch_data_0                   # 跳轉表開始
.packed-switch 0x0                # 從 0 開始
    :pswitch_0
    :pswitch_1
    :pswitch_2
    :pswitch_3
.end packed-switch                # 跳轉表結束

int a = 10;
switch (a){
    case 0:
        a = 1;
        break;
    case 10:
        a = 5;
        break;
    case 20:
        a = 10;
        break;
    case 30:
        a = 20;
        break;
}

const/16 v0, 0xa

sparse-switch v0, :sswitch_data_0 # switch 開始

:sswitch_0                        # case 0
const/4 v0, 0x1
goto :goto_0

:sswitch_1                        # case 10
const/4 v0, 0x5

goto :goto_0

:sswitch_2                        # case 20
const/16 v0, 0xa
goto :goto_0

:sswitch_3                        # case 15
const/16 v0, 0x14
goto :goto_0

:goto_0                           # switch 結束
return-void

.line 55
:sswitch_data_0                   # 跳轉表開始
.sparse-switch
    0x0 -> :sswitch_0
    0xa -> :sswitch_1
    0x14 -> :sswitch_2
    0x1e -> :sswitch_3
.end sparse-switch                # 跳轉表結束

int a = 10;
try {
    callSomeMethod();
} catch (Exception e) {
    a = 0;
}
callAnotherMethod();

const/16 v0, 0xa

:try_start_0            # try 塊開始
invoke-direct {p0}, Lnet/flygon/myapplication/SubActivity;->callSomeMethod()V
:try_end_0              # try 塊結束

.catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0

:goto_0
invoke-direct {p0}, Lnet/flygon/myapplication/SubActivity;->callAnotherMethod()V
return-void

:catch_0                # catch 塊開始
move-exception v1
const/4 v0, 0x0
goto :goto_0            # catch 塊結束

int a = 10;
try {
    callSomeMethod();
} finally {
    a = 0;
}
callAnotherMethod();

const/16 v0, 0xa

:try_start_0            # try 塊開始
invoke-direct {p0}, Lnet/flygon/myapplication/SubActivity;->callSomeMethod()V
:try_end_0              # try 塊結束

.catchall {:try_start_0 .. :try_end_0} :catchall_0

const/4 v0, 0x0         # 複製一份到外面
invoke-direct {p0}, Lnet/flygon/myapplication/SubActivity;->callAnotherMethod()V
return-void

:catchall_0             # finally 塊開始
move-exception v1
const/4 v0, 0x0
throw v1                # finally 塊結束

int a = 10;
try {
    callSomeMethod();
} catch (Exception e) {
    a = 1;
}
finally {
    a = 0;
}
callAnotherMethod();

const/16 v0, 0xa

:try_start_0            # try 塊開始
invoke-direct {p0}, Lnet/flygon/myapplication/SubActivity;->callSomeMethod()V
:try_end_0              # try 塊結束

.catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0
.catchall {:try_start_0 .. :try_end_0} :catchall_0

const/4 v0, 0x0         # 複製一份到外面

:goto_0
invoke-direct {p0}, Lnet/flygon/myapplication/SubActivity;->callAnotherMethod()V
return-void

:catch_0                # catch 塊開始
move-exception v1
const/4 v0, 0x1
const/4 v0, 0x0         # 複製一份到 catch 塊裏面
goto :goto_0            # catch 塊結束

:catchall_0             # finally 塊開始
move-exception v2
const/4 v0, 0x0
throw v2                # finally 塊結束

public class MainActivity extends Activity implements View.OnClickListener {

    private String TAG = "MainActivity";
    private static final float pi = (float) 3.14;

    public volatile boolean running = false;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
    }

    @Override
    public void onClick(View view) {
        int result = add(4, 5);
        System.out.println(result);

        result = sub(9, 3);

        if (result > 4) {
            log(result);
        }
    }

    public int add(int x, int y) {
        return x + y;
    }

    public synchronized int sub(int x, int y) {
        return x + y;
    }

    public static void log(int result) {
        Log.d("MainActivity", "the result:" + result);
    }


}

#文件頭描述
.class public Lcom/social_touch/demo/MainActivity;
.super Landroid/app/Activity;#指定MainActivity的父類
.source "MainActivity.java"#源文件名稱

#表明實現了View.OnClickListener接口
# interfaces
.implements Landroid/view/View$OnClickListener;

#定義float靜態字段pi
# static fields
.field private static final pi:F = 3.14f

#定義了String類型字段TAG
# instance fields
.field private TAG:Ljava/lang/String;

#定義了boolean類型的字段running
.field public volatile running:Z

#構造方法,如果你還納悶這個方法是怎麼出來的化,就去看看jvm的基礎知識吧
# direct methods
.method public constructor <init>()V
    .locals 1#表示函數中使用了一個局部變量

    .prologue#表示方法中代碼正式開始
    .line 8#表示對應與java源文件的低8行
    #調用Activity中的init()方法
    invoke-direct {p0}, Landroid/app/Activity;-><init>()V

    .line 10
    const-string v0, "MainActivity"

    iput-object v0, p0, Lcom/social_touch/demo/MainActivity;->TAG:Ljava/lang/String;

    .line 13
    const/4 v0, 0x0

    iput-boolean v0, p0, Lcom/social_touch/demo/MainActivity;->running:Z

    return-void
.end method

#靜態方法log()
.method public static log(I)V
    .locals 3
    .parameter "result"#表示result參數

    .prologue
    .line 42
    #v0寄存器中賦值爲"MainActivity"
    const-string v0, "MainActivity"
    #創建StringBuilder對象,並將其引用賦值給v1寄存器
    new-instance v1, Ljava/lang/StringBuilder;

    #調用StringBuilder中的構造方法
    invoke-direct {v1}, Ljava/lang/StringBuilder;-><init>()V

    #v2寄存器中賦值爲ther result:
    const-string v2, "the result:"

    #{v1,v2}大括號中v1寄存器中存儲的是StringBuilder對象的引用.
    #調用StringBuilder中的append(String str)方法,v2寄存器則是參數寄存器.
    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    #獲取上一個方法的執行結果,此時v1中存儲的是append()方法執行後的結果,此處之所以仍然返回v1的    #原因在與append()方法返回的就是自身的引用
    move-result-object v1

    #繼續調用append方法(),p0表示第一個參數寄存器,即上面提到的result參數
    invoke-virtual {v1, p0}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    #同上
    move-result-object v1

    #調用StringBuilder對象的toString()方法
    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    #獲取上一個方法執行結果,toString()方法返回了一個新的String對象,因此v1中此時存儲了String對象的引用
    move-result-object v1

    #調用Log類中的靜態方法e().因爲e()是靜態方法,因此{v0,v1}中的成了參數寄存器
    invoke-static {v0, v1}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

    .line 43
    #調用返回指令,此處沒有返回任何值
    return-void
.end method


# virtual methods
.method public add(II)I
    .locals 1
    .parameter "x"#第一個參數
    .parameter "y"#第二個參數

    .prologue
    .line 34

    #調用add-int指令求和之後將結果賦值給v0寄存器
    add-int v0, p1, p2

    #返回v0寄存器中的值
    return v0
.end method


.method public onClick(Landroid/view/View;)V
    .locals 4
    .parameter "view" #參數view

    .prologue
    const/4 v3, 0x4 #v3寄存器中賦值爲4

    .line 23#java源文件中的第23行
    const/4 v1, 0x5#v1寄存器中賦值爲5

    #調用add()方法
    invoke-virtual {p0, v3, v1}, Lcom/social_touch/demo/MainActivity;->add(II)I

    #從v0寄存器中獲取add方法的執行結果
    move-result v0

    .line 24#java源文件中的24行
    .local v0, result:I

    #v1寄存器中賦值爲PrintStream對象的引用out
    sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;

    #執行out對象的println()方法
    invoke-virtual {v1, v0}, Ljava/io/PrintStream;->println(I)V

    .line 26

    const/16 v1, 0x9#v1寄存器中賦值爲9
    const/4 v2, 0x3#v2寄存器中賦值爲3

    #調用sub()方法,{p0,v1,v2},p0指的是this,即當前對象,v1,v2則是參數
    invoke-virtual {p0, v1, v2}, Lcom/social_touch/demo/MainActivity;->sub(II)I
    #從v0寄存器中獲取sub()方法的執行結果
    move-result v0

    .line 28
    if-le v0, v3, :cond_0#如果v0寄存器的值小於v3寄存器中的值,則跳轉到cond_0處繼續執行

    .line 29

    #調用靜態方法log()
    invoke-static {v0}, Lcom/social_touch/demo/MainActivity;->log(I)V

    .line 31
    :cond_0
    return-void
.end method

.method protected onCreate(Landroid/os/Bundle;)V
    .locals 1
    .parameter "savedInstanceState" #參數savedInstancestate

    .prologue
    .line 17

    #調用父類方法onCreate()
    invoke-super {p0, p1}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V

    .line 18

    const v0, 0x7f04001a#v0寄存器賦值爲0x7f04001a

    #調用方法setContentView()
    invoke-virtual {p0, v0}, Lcom/social_touch/demo/MainActivity;->setContentView(I)V

    .line 19
    return-void
.end method

#declared-synchronized表示該方法是同步方法
.method public declared-synchronized sub(II)I
    .locals 1
    .parameter "x"
    .parameter "y"

    .prologue
    .line 38

    monitor-enter p0#爲該方法添加鎖對象p0
     add-int v0, p1, p2
    #釋放鎖對象
    monitor-exit p0

    return v0
.end method

java -jar smali.jar assemble  src.smali -o src.dex

adb push main.dex /sdcard/

adb shell dalvikvm -cp /sdcard/main.dex main