开启Android应用调试选项的工具XDebug的介绍

Posted Fly20141201

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了开启Android应用调试选项的工具XDebug的介绍相关的知识,希望对你有一定的参考价值。

                                     本文博客地址:https://blog.csdn.net/QQ1084283172/article/details/81187769

最近这段时间比较郁闷,就不分享和学习比较复杂的android逆向技巧和工具了,每天进步一点就好。这里介绍一下,作者deskid编写的开启Android应用调试选项的工具XDebug,该工具也是基于Xposed框架实现的,也就是在Android应用的启动之前,设置Android应用的调试选项标志为开启,这样Android应用启动的时候,就可以调试模式进行启动。

作者的github地址:https://github.com/deskid/XDebug

XDebug工具就是在Android应用启动之前,开启Android应用的调试选项,这样在DDMS中就可以看到原来不显示的Android进程都显示出来了,Android应用也可以使用 adb shell am -D 命令进行调试启动了。当我们点击Android系统的Home界面上Android应用的图标,然后该Android应用就会被Launcher所启动,在Android应用的Activity界面显示之前,会经过一系列的复杂流程处理,这些流程的过程可以参考老罗的博文进行学习,这里只谈论涉及到XDebug工具部分,先看下XDebug工具的编写Xposed代码:

package com.github.debugxposed;

import android.os.Process;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.IXposedHookZygoteInit;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

/**
 * Created by deskidz on 12/5/16.
 */

public class XDebugable implements IXposedHookLoadPackage, IXposedHookZygoteInit 

    private static final int DEBUG_ENABLE_DEBUGGER = 0x1;

    private XC_MethodHook debugAppsHook = new XC_MethodHook() 
        @Override
        protected void beforeHookedMethod(MethodHookParam param)
                throws Throwable 

            XposedBridge.log("-- beforeHookedMethod :" + param.args[1]);

            int id = 5;
            int flags = (Integer) param.args[id];
            // 修改类android.os.Process的start函数的第6个传入参数
            if ((flags & DEBUG_ENABLE_DEBUGGER) == 0) 
                // 增加开启Android调试选项的标志
                flags |= DEBUG_ENABLE_DEBUGGER;
            
            param.args[id] = flags;

            if (BuildConfig.DEBUG) 
                XposedBridge.log("-- app debugable flags to 1 :" + param.args[1]);
            
        
    ;

    @Override
    public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable 
        
    

    // 实现的接口IXposedHookZygoteInit的函数
    @Override
    public void initZygote(final IXposedHookZygoteInit.StartupParam startupParam) throws Throwable 

        // /frameworks/base/core/java/android/os/Process.java
        // Hook类android.os.Process的start函数
        XposedBridge.hookAllMethods(Process.class, "start", debugAppsHook);
    

作者deskid选择在Android应用启动调用类android.os.Processstart函数之前,修改该函数的第6个传入参数,增加开启Android应用的调试选项的调试选项标记。类android.os.Process的start函数是在Android应用启动时调用类com.android.server.am.ActivityManagerService的函数startProcessLocked被调用的。

源码路径:

http://androidxref.com/5.1.0_r1/xref/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java#2893

在类android.os.Process中start函数的实现代码如下:

    /**
     * Start a new process.
     * 
     * <p>If processes are enabled, a new process is created and the
     * static main() function of a <var>processClass</var> is executed there.
     * The process will continue running after this function returns.
     * 
     * <p>If processes are not enabled, a new thread in the caller's
     * process is created and main() of <var>processClass</var> called there.
     * 
     * <p>The niceName parameter, if not an empty string, is a custom name to
     * give to the process instead of using processClass.  This allows you to
     * make easily identifyable processes even if you are using the same base
     * <var>processClass</var> to start them.
     * 
     * @param processClass The class to use as the process's main entry
     *                     point.
     * @param niceName A more readable name to use for the process.
     * @param uid The user-id under which the process will run.
     * @param gid The group-id under which the process will run.
     * @param gids Additional group-ids associated with the process.
     * @param debugFlags Additional flags.
     * @param targetSdkVersion The target SDK version for the app.
     * @param seInfo null-ok SE Android information for the new process.
     * @param zygoteArgs Additional arguments to supply to the zygote process.
     * 
     * @return An object that describes the result of the attempt to start the process.
     * @throws RuntimeException on fatal start failure
     * 
     * @hide
     */
    public static final ProcessStartResult start(final String processClass,
                                  final String niceName,
                                  int uid, int gid, int[] gids,
                                  int debugFlags, int mountExternal,
                                  int targetSdkVersion,
                                  String seInfo,
                                  String[] zygoteArgs) 
        try 
            return startViaZygote(processClass, niceName, uid, gid, gids,
                    debugFlags, mountExternal, targetSdkVersion, seInfo, zygoteArgs);
         catch (ZygoteStartFailedEx ex) 
            Log.e(LOG_TAG,
                    "Starting VM process through Zygote failed");
            throw new RuntimeException(
                    "Starting VM process through Zygote failed", ex);
        
    

类android.os.Process中start函数最终调用的类android.os.Process的startViaZygote函数,代码如下;如果Android应用开启了调试模式选项的标志,那么在创建Android应用的进程时,会增加"--enable-debugger"选项,这样Android应用就可以以调试模式进行启动了。

    /**
     * Starts a new process via the zygote mechanism.
     *
     * @param processClass Class name whose static main() to run
     * @param niceName 'nice' process name to appear in ps
     * @param uid a POSIX uid that the new process should setuid() to
     * @param gid a POSIX gid that the new process shuold setgid() to
     * @param gids null-ok; a list of supplementary group IDs that the
     * new process should setgroup() to.
     * @param debugFlags Additional flags.
     * @param targetSdkVersion The target SDK version for the app.
     * @param seInfo null-ok SE Android information for the new process.
     * @param extraArgs Additional arguments to supply to the zygote process.
     * @return An object that describes the result of the attempt to start the process.
     * @throws ZygoteStartFailedEx if process start failed for any reason
     */
    private static ProcessStartResult startViaZygote(final String processClass,
                                  final String niceName,
                                  final int uid, final int gid,
                                  final int[] gids,
                                  int debugFlags, int mountExternal,
                                  int targetSdkVersion,
                                  String seInfo,
                                  String[] extraArgs)
                                  throws ZygoteStartFailedEx 
        synchronized(Process.class) 
            ArrayList<String> argsForZygote = new ArrayList<String>();

            // --runtime-init, --setuid=, --setgid=,
            // and --setgroups= must go first
            argsForZygote.add("--runtime-init");
            argsForZygote.add("--setuid=" + uid);
            argsForZygote.add("--setgid=" + gid);
            if ((debugFlags & Zygote.DEBUG_ENABLE_JNI_LOGGING) != 0) 
                argsForZygote.add("--enable-jni-logging");
            
            if ((debugFlags & Zygote.DEBUG_ENABLE_SAFEMODE) != 0) 
                argsForZygote.add("--enable-safemode");
            
            if ((debugFlags & Zygote.DEBUG_ENABLE_DEBUGGER) != 0) 
                argsForZygote.add("--enable-debugger");
            
            if ((debugFlags & Zygote.DEBUG_ENABLE_CHECKJNI) != 0) 
                argsForZygote.add("--enable-checkjni");
            
            if ((debugFlags & Zygote.DEBUG_ENABLE_ASSERT) != 0) 
                argsForZygote.add("--enable-assert");
            
            if (mountExternal == Zygote.MOUNT_EXTERNAL_MULTIUSER) 
                argsForZygote.add("--mount-external-multiuser");
             else if (mountExternal == Zygote.MOUNT_EXTERNAL_MULTIUSER_ALL) 
                argsForZygote.add("--mount-external-multiuser-all");
            
            argsForZygote.add("--target-sdk-version=" + targetSdkVersion);

            //TODO optionally enable debuger
            //argsForZygote.add("--enable-debugger");

            // --setgroups is a comma-separated list
            if (gids != null && gids.length > 0) 
                StringBuilder sb = new StringBuilder();
                sb.append("--setgroups=");

                int sz = gids.length;
                for (int i = 0; i < sz; i++) 
                    if (i != 0) 
                        sb.append(',');
                    
                    sb.append(gids[i]);
                

                argsForZygote.add(sb.toString());
            

            if (niceName != null) 
                argsForZygote.add("--nice-name=" + niceName);
            

            if (seInfo != null) 
                argsForZygote.add("--seinfo=" + seInfo);
            

            argsForZygote.add(processClass);

            if (extraArgs != null) 
                for (String arg : extraArgs) 
                    argsForZygote.add(arg);
                
            

            return zygoteSendArgsAndGetResult(argsForZygote);
        
    

到这里,XDebug工具的原理已经很清楚了,基于作者的思路,也可以Hook类android.os.Process的startViaZygote函数,在该函数执行之前修改其第6个参数,增加Android开启调试选项的标志,谢谢原作者的思路。

为什么XDebug工具的作者deskid在选择实现Hook类android.os.Process的start函数时,实现的是Xposed框架的de.robv.android.xposed.IXposedHookZygoteInit接口而不是de.robv.android.xposed.IXposedHookLoadPackage接口呢?

如果是选择实现de.robv.android.xposed.IXposedHookLoadPackage接口则Hook类android.os.Process的start函数已经晚了,因为该函数已经执行过了,IXposedHookLoadPackage接口是Hook的Android应用启动时的ActivityThread.handleBindApplication函数,而类android.os.Process的start函数在handleBindApplication函数执行之前,因此这里选择实现IXposedHookZygoteInit接口,并且实现IXposedHookZygoteInit接口的修改对所有启动的App都有影响,下面是Xposed框架的api的说明。

Xposed框架的Api说明文档:https://api.xposed.info/reference/packages.html

有关Xposed源码的学习,后面再研究~

以上是关于开启Android应用调试选项的工具XDebug的介绍的主要内容,如果未能解决你的问题,请参考以下文章

Mac 使用自带php和Apache 安装配置Xdebug 开启本地调试模式

netbeans工具使用xdebug断点调试php源码

开启Android Apk调试与备份选项的Xposed模块的编写

ADB调试工具的使用

zend用xdebug调试

PhpStrom调试,由XDebug提供支持