Android开发学习之路-脱壳反编译

Posted 2022-11-10 东月之神

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Android开发学习之路-脱壳反编译相关的知识，希望对你有一定的参考价值。

前言

想研究下某app里面的实现技术，使用常规的反编译发现竟然是加固的，所谓Apk加固，就是对dex文件进行加密，防止App被反编译，保证apk的安全。市面上有很多的加固平台，有360加固，腾讯乐固，爱加密等等。
上一篇文章我们了解了加固，也有了加固后的apk，这里我们利用工具脱壳查看源码。

1. 脱壳工具FDex2

道高一尺魔高一丈嘛，有加固平台，也有脱壳工具，常见的脱壳工具有FDex2，dumpdex，drizzleDumper等。这里我们使用FDex2来实现脱壳。

FDex2通过Hook ClassLoader的loadClass方法，反射调用getDex方法取得Dex(com.android.dex.Dex类对象)，在将里面的dex写出。

下载地址:

链接:https://pan.baidu.com/s/1smxtinr 密码:dk4v

我们看下主要的源码：

public class MainHook implements IXposedHookLoadPackage 
  Class Dex;
  
  Method Dex_getBytes;
  
  Method getDex = (Method)null;
  
  XSharedPreferences shared;
  
  @Override
  public void handleLoadPackage(XC_LoadPackage.LoadPackageParam paramLoadPackageParam) 
    this.shared = new XSharedPreferences("formatfa.xposed.Fdex2", "package");
    this.shared.reload();
    initRefect();
    String str = this.shared.getString("packagename", (String)null);
    if (str == null) 
      return;
     
    if (!paramLoadPackageParam.packageName.equals(str))
      return; 
    XposedBridge.log(str + " has hook");
    ClassLoader classLoader = paramLoadPackageParam.classLoader;
    try 
      Class clazz = Class.forName("java.lang.String");
      XposedHelpers.findAndHookMethod("java.lang.ClassLoader", classLoader, "loadClass", new Object[]  clazz, boolean.class, new XC_MethodHook(this, str, paramLoadPackageParam) 
              private final MainHook this$0;
              
              private final String val$aim;
              
              private final XC_LoadPackage.LoadPackageParam val$p1;
              
              @Override
              protected void afterHookedMethod(MethodHookParam param1MethodHookParam) 
                XposedBridge.log(" after hook : ");
                boolean bool = true;
                clazz = (Class)param1MethodHookParam.getResult();
                if (clazz == null)
                  return; 
                try 
                  str = clazz.getName();
                  try 
                    Class clazz1;
                    (clazz1 = Class.forName("formatfa.xposed.Fdex2.MainHook")).forName(str, false, clazz1.getClassLoader().getSystemClassLoader());
                   catch (ClassNotFoundException str) 
                    throw new NoClassDefFoundError(str.getMessage());
                   
                 catch (ClassNotFoundException classNotFoundException) 
                  bool = false;
                 
                if (bool)
                  return; 
                try 
                  Object object = this.this$0.getDex.invoke(clazz, new Object[0]);
                  byte[] arrayOfByte = (byte[])this.this$0.Dex_getBytes.invoke(object, new Object[0]);
                  if (arrayOfByte != null) 
                    "/data/data/" + this.val$aim + "/" + this.val$aim + arrayOfByte.length + ".dex";
                    File file = new File(this.this$0.shared.getString("dir", "/sdcard"), this.val$p1.packageName + arrayOfByte.length + ".dex");
                    if (!file.exists())
                      FIO.writeByte(arrayOfByte, file.getAbsolutePath()); 
                   
                  return;
                 catch (Exception clazz) 
                  XposedBridge.log(clazz.toString());
                  return;
                 
              
              
              @Override
              protected void beforeHookedMethod(MethodHookParam param1MethodHookParam) 
             );
      return;
     catch (ClassNotFoundException paramLoadPackageParam) 
      throw new NoClassDefFoundError(paramLoadPackageParam.getMessage());
     
  
  
  public void initRefect() 
    try 
      this.Dex = Class.forName("com.android.dex.Dex");
      this.Dex_getBytes = this.Dex.getDeclaredMethod("getBytes", new Class[0]);
      if (!MainActivity.h.endsWith("0"))
        return; 
      int i = MainActivity.s.length();
      if (i != 91)
        return; 
      try 
        Class clazz = Class.forName("java.lang.Class");
        this.getDex = clazz.getDeclaredMethod("getDex", new Class[0]);
       catch (ClassNotFoundException classNotFoundException) 
        throw new NoClassDefFoundError(classNotFoundException.getMessage());
       
     catch (Exception exception) 
      XposedBridge.log(exception.toString());
     
  
  
  void writeDex(String paramString, Object paramObject) 
    try 
      paramObject = this.getDex.invoke(paramObject.getClass(), new Object[0]);
      byte[] arrayOfByte = (byte[])this.Dex_getBytes.invoke(paramObject, new Object[0]);
      if (arrayOfByte != null) 
        File file = new File(this.shared.getString("dir", "/sdcard"), paramString + arrayOfByte.length + ".dex");
        if (!file.exists())
          FIO.writeByte(arrayOfByte, file.getAbsolutePath()); 
       
      return;
     catch (InvocationTargetException paramString) 
      return;
     catch (IllegalAccessException paramString) 
      return;
     catch (IllegalArgumentException paramString) 
      return;