运用smali自己主动注入技术分析android应用程序行为

Posted 2020-09-20 wzjhoutai

       如今android开发人员社区里，除了app开发外，还有非常多周边的工具类产品，比方安全、性能等，app产品

已经出现了巨无霸，可是工具类的产品。眼下还没有出现规模比較大的公司，大部分还处于创业阶段，这可能

是创业者的下一个机会。工具类的产品相对app开发有比較高的技术门槛，从事这方面开发的技术人员须要掌

握的基本功例如以下：

1、熟悉android app的编译过程，了解jvm的bytecode与dalvik bytecode的差别；

2、熟悉android framework，读过部分代码。比方系统启动过程，zygote进程相关逻辑，熟练使用ndk，

      掌握inline hook的基本原理；

3、熟练使用脚本语言，比方python，脚本语言在一些分析工具的开发中还是有非常大优势的，并且一些著名的

      开源工具也是用python写的，比方androguard。

4、熟悉apk文件的结构，熟悉dex文件的结构，比方dex文件头的结构；

5、熟悉smali语法，熟练使用apktool等工具。能解析smali文件，并读入内存自己定义数据结构中；

      有了上述功底，能够做的事情有非常多，比方能够通过smali注入的方式插入自己定义代码来监控app的行为数据。

包含性能数据以及部分逻辑数据，能够通过inline hook的方式在执行时监控应用的行为，笔者做了一个工具能够

自己主动往apk中插入smali代码。详细的过程例如以下：

1、通过androguard解析apk文件，并获得dex文件；

2、通过baksmali将dex文件反编译为smali文件；

3、開始解析smali文件。将smali文件映射为内存数据结构；

4、分析smali文件，找出须要替换的方法keyword。并通过改写smali文件的方法注入代码；

      当然这里面有非常多细节问题须要解决，比方插入代码后会对原有的smali代码逻辑产生影响。如寄存器数量

添加，寄存器的的使用，跳转逻辑的影响。这些都须要你自己分析须要插入或者替换的代码上下文逻辑，使插入逻辑正确。

     我以下以json为例，来具体描写叙述怎样替换smali代码：

json对象初始化的smali代码：

    new-instance v3, Lorg/json/JSONObject;

    invoke-direct {v3, p0}, Lorg/json/JSONObject;-><init>(Ljava/lang/String;)V

      第一行代码用来生成一个JSONObject对象，并放到v3寄存器中。第二行代码

调用v3中JSONObject对象的init方法。參数为存在p0寄存器（第一个參数）中的String对象调用json对象

格式化字符串jsonObject.toString。相应的smali代码例如以下：

    invoke-virtual {v3}, Lorg/json/JSONObject;->toString()Ljava/lang/String;

    move-result-object v8

      第一行代码调用v3中存放的json对象的toString方法，第二行代码将该返回值存放到v8寄存器中。

     以下定义一个静态的方法，覆盖jsonobject相应的方法：

	public static String toString(JSONObject jsonObject) {
		String jsonString = jsonObject.toString();
		Log.i("json toString:" + jsonString);
		return jsonString;
	}

     ok，剩下的就是将smali代码里的逻辑改为调用上面的静态方法。替换后的内容例如以下：

    invoke-static {v3}, Lcom/test/JsonReplace;->toString(Lorg/json/JSONObject;)Ljava/lang/String;

    move-result-object v7

     init方法做相同的处理。这样就能够截获json对象的内容，从而能够监控使用json来上传数据的app内容，

假设在上面的方法開始和结束的地方获取系统时间。还能够用来获取json toString方法耗费的时间。

    json方法仅仅是众多能够捕获的方法之中的一个，依照类似的逻辑还能够捕获很多其它您感兴趣的方法。

   为了測试一下smali自己主动注入的成果，笔者下载了一个360安全卫士，进行了自己主动注入，此处须要注意的是，

改动完smali后须要又一次打包签名。而360安全卫士在启动时做了签名校验。假设发现签名不一致会弹出一个

对话框让你去下载应用并退出，只是这也能够通过改动smali代码的方式来解决，能够找到签名校验的地方将

返回值改为1就可以。因为这部分的内容涉及app的安全策略，且和本文的主题没有多大关系，所以笔者就不写

出来了，有兴趣的能够私下交流。

注入smali后能够抓取到360安全卫士上传的全部json字符串内容。我摘取了当中的部分内容：

json init:{"ads":[{"des":"1mob","ris":0,"name":"1mob","fbs":[{"t":1,"s":1,"c":"ff#*#1a#/BR;#1a#/PIA;#1a#/Main;#1a#/PManager;#1a#Ljava/lang/reflect/Method;.getParameterTypes:()[Ljava/lang/Class;#1a#Ljava/lang/Class;.getDeclaredMethods:()[Ljava/lang/reflect/Method;","n":"ad.push.1mob","st":2},{"t":1,"s":0,"c":"ff#*#1a#/BR;#1a#/US;#1a#/Main;#1a#/UNManager;#1a#Ljava/lang/reflect/Method;.getParameterTypes:()[Ljava/lang/Class;#1a#Ljava/lang/Class;.getDeclaredMethods:()[Ljava/lang/reflect/Method;#1a#setGapTime","n":"ad.spot.1mob","st":8}]},{"des":"360dianjing","ris":0,"name":"360dianjing","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#http://mob.tf.360.cn/#1a1#360dianjing#1a1#ibstates.php","n":"ad.banner.360dianjing.a","st":1},{"t":1,"s":0,"c":"ff#*#1a1#http://ads.lianmeng.360.cn/#1a1#360dianjing#1a1#ibstates.php","n":"ad.banner.360dianjing.b","st":1}]},{"des":"3gyu","ris":0,"name":"3gyu","fbs":[]},{"des":"7xpush","ris":0,"name":"7xpush","fbs":[{"t":1,"s":1,"c":"ff#*#1a1#http://www.qixiazi.com/ads.xml#1a1#com.kding.ads.service.DownService#1a1#/kding/ads#1a1#notification","n":"ad.push.7xpush","st":2}]},{"des":"91zan","ris":0,"name":"91zan","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#com.skpresent.shell.ShellServiceKit#1a1#zpresent.jar#1a1#zpresent.dex","n":"ad.banner.91zan.a","st":1},{"t":1,"s":0,"c":"ff#*#1a1#com.skpop.shell.ShellServiceKit#1a1#zpop.jar#1a1#zpop.dex","n":"ad.banner.91zan.b","st":1},{"t":1,"s":0,"c":"ff#*#1a1#com.skfloat.shell.ShellServiceKit#1a1#zfloat.jar#1a1#zfloat.dex","n":"ad.banner.91zan.c","st":1},{"t":1,"s":1,"c":"ff#*#1a1#com.skpush.shell.ShellServiceKit#1a1#zan_dev_appconfig_push#1a1#zpush.dex","n":"ad.push.91zan","st":2}]},{"des":"98mid","ris":0,"name":"98mid","fbs":[{"t":1,"s":1,"c":"ff#*#1a1#img=D:/images#1a1#myAppMarket98mid#1a1#times.bat#1a1#http://www.98mid.com/","n":"ad.push.98mid","st":2}]},{"des":"A立方广告","ris":33,"name":"a3ad","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#Lcom/allyes/a3/sdk/widget/AdView;","n":"ad.banner.a3ad","st":1}]},{"des":"adchina","ris":33,"name":"adchina","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#Lcom/adchina/android/ads/AdManager;","n":"ad.banner.adchina.b","st":1},{"t":1,"s":0,"c":"ff#*#1a1#Lcom/adchina/android/ads/views/AdView;","n":"ad.banner.adchina.c","st":1}]},{"des":"adcocoa","ris":0,"name":"adcocoa","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#adcocoa_icon_default.png#1a1#adcocoa_id#1a1#adcocoa/cache","n":"ad.spot.adcocoa","st":8}]},{"des":"ader","ris":0,"name":"ader","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#AdBigWebView#1a1#com.rrgame.sdk#1a1#banner","n":"ad.banner.ader","st":1}]},{"des":"adfonic","ris":0,"name":"adfonic","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#http://adfonic.net/ad/","n":"ad.banner.adfonic","st":1}]},{"des":"adlantis","ris":0,"name":"adlantis","fbs":[{"t":1,"s":0,"c":"ff#*#1a#Ljp/adlantis/android/","n":"ad.banner.adlantis.a","st":1},{"t":1,"s":0,"c":"ff#*#1a1#sp.ad.adlantis.jp","n":"ad.banner.adlantis.b","st":1}]},{"des":"adlayout","ris":32,"name":"adlayout","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#Lnet/adlayout/ad/AdLayout;","n":"ad.gather.adlayout","st":11}]},{"des":"admarket","ris":0,"name":"admarket","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#showmyappdialog#1a1#huituixiazai","n":"ad.banner.admarket","st":1}]},{"des":"admob","ris":0,"name":"admob","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#http://a.admob.com/f0?
#1a1#AdMobSDK",

/catchjson( 7454): json toString:{"pkg":"org.orangenose.games","ti":{"v":0,"m":2},"si":{"v":22907852054,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"cn.ishuidi.shuidi","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"net.ot24.et.sqt","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"cc.freecall.ipcall","ti":{"v":0,"m":2},"si":{"v":22906542357,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"cn.btcall.ipcall","ti":{"v":0,"m":2},"si":{"v":22906542613,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"cn.pyt365.ipcall","ti":{"v":0,"m":2},"si":{"v":22906541333,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.lanshan.weimi","ti":{"v":0,"m":2},"si":{"v":22907853334,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.liulishuo.engzo","ti":{"v":0,"m":2},"si":{"v":22907591190,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.wandoujia.phoenix2.usbproxy","ti":{"v":0,"m":2},"si":{"v":22906541333,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.dnurse","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.sec.android.app.myfiles","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.qihoo360.smartkey","ti":{"v":10,"m":2},"si":{"v":22906475797,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.qihoo.wifi","ti":{"v":10,"m":2},"si":{"v":22906475797,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.qihoo.antivirus","ti":{"v":10,"m":2},"si":{"v":22906475797,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.android.fileexplorer","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.meizu.filemanager","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}
I/catchjson( 7454): json toString:{"pkg":"com.android.browser","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}

I/catchjson( 7454): json toString:{"s":"11146d3626e64dab800a6a0ae57e4ec0","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"12332c1955435e036a5a94df4e188bd7","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"15db4f6a2b422f536cd3ce8230120e35","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"1d4dcf3a79293e05fa9744444263d048","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"328f0b456d41a3f19464241ab327b6c5","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"3bd87d5c8d98f7d711eff0d82d8fe7b9","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"517badabd9c40f1fca00d0b74d514a31","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"58f2fe7e4a67c1ba29c2a5c58c66739b","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"5b252a142a450b34bd3253acb51882bd","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"6d1fc48aeafe7286cfc9b05d815fd9f9","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"72fa45c1f82c02200c2bb769f641759e","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"829e5b4f1e9725ee6a3900009521d6df","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"8609665349f3431def232651c7785b86","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"8823a09ee4baaf6c63d767e56e5a295d","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"ca45263bc938da16ef1b069c95e61ba2","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"d488edaf562233024a034073f7d2bd93","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"dc6dbd6e49682a57a8b82889043b93a8","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"fec53268a38f029357056d46098c9384","a":1119509,"t":10}
I/catchjson( 7454): json toString:{"s":"bb5cf8250d16d684a7b1e28b12780636","a":1119509,"t":10}

     至于字符串里内容的用处，因为笔者没有分析其代码逻辑，且和我的写作主题无关，所以不做解释，这里仅此

技术角度来分析通过自己主动注入smali代码的方式来获得应用行为的可能性，而且检測一下笔者开发的自己主动化注入

工具，无他意。

     这里是通过smali注入的技术来获取应用的数据，还能够通过inline hook的方式，动态抓取应用的行为数据，

这个笔者也做了个工具。兴许写文章具体介绍。