开启Android Apk调试与备份选项的Xposed模块的编写

Posted Fly20141201

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了开启Android Apk调试与备份选项的Xposed模块的编写相关的知识,希望对你有一定的参考价值。

本文博客地址:https://blog.csdn.net/QQ1084283172/article/details/80963610

在进行android应用程序逆向分析的时候,经常需要进行Android应用程序的动态调试,一般情况下基于Android应用程序的安全性考虑,发布版的Android应用程序都会关闭它的调试选项,因此只有开启该Android应用程序的调试选项,才能在Android应用程序的Activity界面显示之前(即Application类的attach函数和onCreate函数执行之前)使Android应用程序处于暂停等待调试的状态,并且没有开启调试选项的Android应用程序通过DDMS工具是看不到进程的。

Android应用程序支持dex代码调试的条件


上面提到的两种开启Android应用程序调试选项的方法都不是最佳的,作者泉哥编写了一个基于Xposed框架实现的开启APK调试与备份选项的Xposed模块,只要在Android系统上成功安装了Xposed框架,再安装和激活泉哥编写的 BDOpener插件 重启Android系统就可以开启Android应用的dex代码调试模式。之前我曾尝试过修改Android系统源码的方法开启Android应用的dex代码调试模式,但是效果不好,影响到Android系统app的启动,需要过滤Android系统应用。

BDOpener插件的下载地址:https://security.tencent.com/index.php/opensource/down/17

BDOpener插件的Xposed Hook代码编写原理如下:


java Hook处理类"com.android.server.pm.PackageManagerService"中所有名称为"getPackageInfo"的类方法,修改该类方法的函数返回值PackageInfo,为返回值PackageInfo对象中的实例成员变量applicationInfo的flags增加调试模式选项和备份模式选项,这用每次调用类PackageManagerService的类方法"getPackageInfo"获取到的Android应用程序的包信息中都带有调试模式选项和备份模式选项的信息。

源码路径:/frameworks/base/services/java/com/android/server/pm/PackageManagerService.java

源码路径:/frameworks/base/core/java/android/content/pm/ApplicationInfo.java

Android调试模式选项的flags定义:


Android备份模式选项的flags定义:

源码路径:/frameworks/base/core/java/android/app/ActivityThread.java

Android应用的调试模式运行判断是在类ActivityThread的函数handleBindApplication中进行的。


Android应用的调试模式运行判断是在Android应用的dex文件加载完成以后,类Application的attach函数和onCreate函数执行之前,因此在进行Android应用程序的dex代码调试时,Apk程序会暂停等待调试于类Application的代码执行之前,此时Android应用程序的Activity界面还没有开始显示。

    // 在apk程序的Activity显示之前执行的代码
    private void handleBindApplication(AppBindData data) 
    	
        mBoundApplication = data;
        mConfiguration = new Configuration(data.config);
        mCompatConfiguration = new Configuration(data.config);

        mProfiler = new Profiler();
        mProfiler.profileFile = data.initProfileFile;
        mProfiler.profileFd = data.initProfileFd;
        mProfiler.autoStopProfiler = data.initAutoStopProfiler;

        // send up app name; do this *before* waiting for debugger
        Process.setArgV0(data.processName);
        android.ddm.DdmHandleAppName.setAppName(data.processName,
                                                UserHandle.myUserId());

        if (data.persistent) 
            // Persistent processes on low-memory devices do not get to
            // use hardware accelerated drawing, since this can add too much
            // overhead to the process.
            if (!ActivityManager.isHighEndGfx()) 
                HardwareRenderer.disable(false);
            
        

        if (mProfiler.profileFd != null) 
            mProfiler.startProfiling();
        

        // If the app is Honeycomb MR1 or earlier, switch its AsyncTask
        // implementation to use the pool executor.  Normally, we use the
        // serialized executor as the default. This has to happen in the
        // main thread so the main looper is set right.
        if (data.appInfo.targetSdkVersion <= android.os.Build.VERSION_CODES.HONEYCOMB_MR1) 
            AsyncTask.setDefaultExecutor(AsyncTask.THREAD_POOL_EXECUTOR);
        

        /*
         * Before spawning a new process, reset the time zone to be the system time zone.
         * This needs to be done because the system time zone could have changed after the
         * the spawning of this process. Without doing this this process would have the incorrect
         * system time zone.
         */
        TimeZone.setDefault(null);

        /*
         * Initialize the default locale in this process for the reasons we set the time zone.
         */
        Locale.setDefault(data.config.locale);

        /*
         * Update the system configuration since its preloaded and might not
         * reflect configuration changes. The configuration object passed
         * in AppBindData can be safely assumed to be up to date
         */
        mResourcesManager.applyConfigurationToResourcesLocked(data.config, data.compatInfo);
        mCurDefaultDisplayDpi = data.config.densityDpi;
        applyCompatConfiguration(mCurDefaultDisplayDpi);

        ///
        // LoadedApk info;	
        // 对Android应用的dex文件进行加载返回LoadedApk实例对象
        data.info = getPackageInfoNoCheck(data.appInfo, data.compatInfo);
        ///

        /**
         * Switch this process to density compatibility mode if needed.
         */
        if ((data.appInfo.flags&ApplicationInfo.FLAG_SUPPORTS_SCREEN_DENSITIES)
                == 0) 
            mDensityCompatMode = true;
            Bitmap.setDefaultDensity(DisplayMetrics.DENSITY_DEFAULT);
        
        updateDefaultDensity();

        // 创建并初始化Android应用程序的Context
        final ContextImpl appContext = new ContextImpl();
        appContext.init(data.info, null, this);
        if (!Process.isIsolated()) 
            final File cacheDir = appContext.getCacheDir();

            if (cacheDir != null) 
                // Provide a usable directory for temporary files
                System.setProperty("java.io.tmpdir", cacheDir.getAbsolutePath());

                setupGraphicsSupport(data.info, cacheDir);
             else 
                Log.e(TAG, "Unable to setupGraphicsSupport due to missing cache directory");
            
        
        /**
         * For system applications on userdebug/eng builds, log stack
         * traces of disk and network access to dropbox for analysis.
         */
        if ((data.appInfo.flags &
             (ApplicationInfo.FLAG_SYSTEM |
              ApplicationInfo.FLAG_UPDATED_SYSTEM_APP)) != 0) 
            StrictMode.conditionallyEnableDebugLogging();
        

        /**
         * For apps targetting SDK Honeycomb or later, we don't allow
         * network usage on the main event loop / UI thread.
         *
         * Note to those grepping:  this is what ultimately throws
         * NetworkOnMainThreadException ...
         */
        if (data.appInfo.targetSdkVersion > 9) 
            StrictMode.enableDeathOnNetwork();
        

        // 判断Android应用是否打开调试模式
        if (data.debugMode != IApplicationThread.DEBUG_OFF) 
            // XXX should have option to change the port.
            Debug.changeDebugPort(8100);
            if (data.debugMode == IApplicationThread.DEBUG_WAIT) 
                Slog.w(TAG, "Application " + data.info.getPackageName()
                      + " is waiting for the debugger on port 8100...");

                IActivityManager mgr = ActivityManagerNative.getDefault();
                try 
                    mgr.showWaitingForDebugger(mAppThread, true);
                 catch (RemoteException ex) 
                
                // 调试模式运行app并调试等待
                Debug.waitForDebugger();

                try 
                	// Android程序调试模式启动的提示
                    mgr.showWaitingForDebugger(mAppThread, false);
                 catch (RemoteException ex) 
                

             else 
                Slog.w(TAG, "Application " + data.info.getPackageName()
                      + " can be debugged on port 8100...");
            
        

        // Enable OpenGL tracing if required
        if (data.enableOpenGlTrace) 
            GLUtils.setTracingLevel(1);
        

        // Allow application-generated systrace messages if we're debuggable.
        boolean appTracingAllowed = (data.appInfo.flags&ApplicationInfo.FLAG_DEBUGGABLE) != 0;
        Trace.setAppTracingAllowed(appTracingAllowed);

        /**
         ** Initialize the default http proxy in this process for the reasons we set the time zone.
         **/
        IBinder b = ServiceManager.getService(Context.CONNECTIVITY_SERVICE);
        if (b != null) 
            // In pre-boot mode (doing initial launch to collect password), not
            // all system is up.  This includes the connectivity service, so don't
            // crash if we can't get it.
            IConnectivityManager service = IConnectivityManager.Stub.asInterface(b);
            try 
                ProxyProperties proxyProperties = service.getProxy();
                Proxy.setHttpProxySystemProperty(proxyProperties);
             catch (RemoteException e) 
        

        if (data.instrumentationName != null) 
            InstrumentationInfo ii = null;
            try 
                ii = appContext.getPackageManager().
                    getInstrumentationInfo(data.instrumentationName, 0);
             catch (PackageManager.NameNotFoundException e) 
            
            if (ii == null) 
                throw new RuntimeException(
                    "Unable to find instrumentation info for: "
                    + data.instrumentationName);
            

            mInstrumentationAppDir = ii.sourceDir;
            mInstrumentationAppLibraryDir = ii.nativeLibraryDir;
            mInstrumentationAppPackage = ii.packageName;
            mInstrumentedAppDir = data.info.getAppDir();
            mInstrumentedAppLibraryDir = data.info.getLibDir();

            ApplicationInfo instrApp = new ApplicationInfo();
            instrApp.packageName = ii.packageName;
            instrApp.sourceDir = ii.sourceDir;
            instrApp.publicSourceDir = ii.publicSourceDir;
            instrApp.dataDir = ii.dataDir;
            instrApp.nativeLibraryDir = ii.nativeLibraryDir;
            
            // 得到Android应用dex文件加载后的LoadedApk实例
            LoadedApk pi = getPackageInfo(instrApp, data.compatInfo,
                    appContext.getClassLoader(), false, true);
            
            ContextImpl instrContext = new ContextImpl();
            instrContext.init(pi, null, this);

            try 
                java.lang.ClassLoader cl = instrContext.getClassLoader();
                mInstrumentation = (Instrumentation)
                    cl.loadClass(data.instrumentationName.getClassName()).newInstance();
             catch (Exception e) 
                throw new RuntimeException(
                    "Unable to instantiate instrumentation "
                    + data.instrumentationName + ": " + e.toString(), e);
            

            mInstrumentation.init(this, instrContext, appContext,
                   new ComponentName(ii.packageName, ii.name), data.instrumentationWatcher,
                   data.instrumentationUiAutomationConnection);

            if (mProfiler.profileFile != null && !ii.handleProfiling
                    && mProfiler.profileFd == null) 
                mProfiler.handlingProfiling = true;
                File file = new File(mProfiler.profileFile);
                file.getParentFile().mkdirs();
                Debug.startMethodTracing(file.toString(), 8 * 1024 * 1024);
            

         else 
        	// 构建Instrumentation对象实例
            mInstrumentation = new Instrumentation();
        

        if ((data.appInfo.flags&ApplicationInfo.FLAG_LARGE_HEAP) != 0) 
            dalvik.system.VMRuntime.getRuntime().clearGrowthLimit();
        

        // Allow disk access during application and provider setup. This could
        // block processing ordered broadcasts, but later processing would
        // probably end up doing the same disk access.
        final StrictMode.ThreadPolicy savedPolicy = StrictMode.allowThreadDiskWrites();
        try 
            // If the app is being launched for full backup or restore, bring it up in
            // a restricted environment with the base application class.
        	
        	
            // 创建Android应用的Application类对象的实例并调用其attach方法
            // 间接通过调用attach方法调用Android应用的attachBaseContext方法
            Application app = data.info.makeApplication(data.restrictedBackupMode, null);
            // 在类ActivityThread的成员变量mInitialApplication中保存创建的Application类对象实例(3)
            // 将第1个Application视为进程的初始化Application
            mInitialApplication = app;
            

            // don't bring up providers in restricted mode; they may depend on the
            // app's custom Application class
            if (!data.restrictedBackupMode) 
            	// 获取当前Android应用的ContentProvider
                List<ProviderInfo> providers = data.providers;
                if (providers != null) 
                    // 安装该Android应用程序的ContentProvider
                    installContentProviders(app, providers);
                    // For process that contains content providers, we want to
                    // ensure that the JIT is enabled "at some point".
                    mH.sendEmptyMessageDelayed(H.ENABLE_JIT, 10*1000);
                
            

            // Do this after providers, since instrumentation tests generally start their
            // test thread at this point, and we don't want that racing.
            try 
            	// 调用Instrumentationde的OnCreate方法
                mInstrumentation.onCreate(data.instrumentationArgs);
             catch (Exception e) 
                throw new RuntimeException(
                    "Exception thrown in onCreate() of "
                    + data.instrumentationName + ": " + e.toString(), e);
            

            try 
            	// 调用Application的OnCreate方法
                mInstrumentation.callApplicationOnCreate(app);
             catch (Exception e) 
                if (!mInstrumentation.onException(app, e)) 
                    throw new RuntimeException(
                        "Unable to create application " + app.getClass().getName()
                        + ": " + e.toString(), e);
                
            
         finally 
            StrictMode.setThreadPolicy(savedPolicy);
        
    

整理一下BDOpener插件的逆向代码,Xposed Hook的插件代码编写如下所示:

import android.content.pm.ApplicationInfo;
import android.content.pm.PackageInfo;
import android.util.Log;

......

	@Override
	public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable 
		
		// 打开Android应用的调试模式和备份选项
		openDB(lpparam);
		
......


	boolean isDebugable(ApplicationInfo applicationInfo) 
		
        if((applicationInfo.flags & 2) != 0) 
            
        	Log.i("BDOpener", "Open Debugable");
        	return true;
        
        
        Log.i("BDOpener", "Close Debugable");
        return false;
    
	
    public boolean isBackup(ApplicationInfo applicationInfo) 
    	
        if((applicationInfo.flags & 32768) != 0) 
        	
            Log.i("BDOpener", "Open Backup");
            return true;
        

        Log.i("BDOpener", "Close Backup");
        return false;
    
	
	// 开启Android应用的调试和备份选项
	void openDB(LoadPackageParam lpparam) 
		
	    /**
	     * Value for @link #flags: set to <code>false</code> if the application does not wish
	     * to permit any OS-driven backups of its data; <code>true</code> otherwise.
	     * 
	     * <p>Comes from the
	     * @link android.R.styleable#AndroidManifestApplication_allowBackup android:allowBackup
	     * attribute of the <application> tag.
	     */
	    final int FLAG_ALLOW_BACKUP = 1<<15;
	    
	    /**
	     * Value for @link #flags: set to true if this application would like to
	     * allow debugging of its
	     * code, even when installed on a non-development system.  Comes
	     * from @link android.R.styleable#AndroidManifestApplication_debuggable
	     * android:debuggable of the <application> tag.
	     */
	    final int FLAG_DEBUGGABLE = 1<<1;
		
		Class<?> packageManagerService = 
		    XposedHelpers.findClass("com.android.server.pm.PackageManagerService", lpparam.classLoader);
		XC_MethodHook callback = new XC_MethodHook() 

			@Override
			protected void beforeHookedMethod(MethodHookParam param)
					throws Throwable 
			

			@Override
			protected void afterHookedMethod(MethodHookParam param)
					throws Throwable 
				
				PackageInfo packageInfo = (PackageInfo) param.getResult();
				if (packageInfo != null) 
					
					ApplicationInfo applicationInfo = packageInfo.applicationInfo;
					int nFlags = applicationInfo.flags;
					
                                        Log.i("BDOpener", "Load App : " + applicationInfo.packageName);
                                        Log.i("BDOpener", "==== After Hook ====");
					
    					// 判断当前Android应用是否开启调试模式选项
					if ((nFlags & FLAG_DEBUGGABLE) == 0) 
						
						nFlags |= FLAG_DEBUGGABLE;
					
					// 判断当前Android应用是否开启备份选项
					if ((nFlags & FLAG_ALLOW_BACKUP) == 0) 
						
						nFlags |= FLAG_ALLOW_BACKUP;
					
					
					applicationInfo.flags = nFlags;
					// 修改函数的返回值
					param.setResult(packageInfo);
					
					Log.i("BDOpener", "flags = " + nFlags);
                                        isDebugable(applicationInfo);
                                        isBackup(applicationInfo);
				
			
			
		;
		// 执行java Hook操作
		XposedBridge.hookAllMethods(packageManagerService, "getPackageInfo", callback);
	

效果截图:

开启了Android应用的调试模式选项以后,通过DDMS能够看到很多Android应用的进程名称和列表,如下图所示:

开启了调试模式选项的Android应用,可以使用下面的命令进行调试模式的启动,让Android应用程序等待调试:

adb shell am start -W -D -n 包名/主Activity类名称字符串

以上是关于开启Android Apk调试与备份选项的Xposed模块的编写的主要内容,如果未能解决你的问题,请参考以下文章

Android 10开启调试模式

吴裕雄--天生自然Android开发学习:魅蓝3开启USB调试

开启Android应用调试选项的工具XDebug的介绍

开启Android应用调试选项的工具XDebug的介绍

怎样开启Android Wear的USB Debugging调试模式

Android系统备忘1