[TOC]

# java层

apk包内的dex文件是dalvik虚拟机可识别的可执行文件，我们主要也是对dex文件进行逆向，分析其代码逻辑、更改其逻辑做一些分析、破解之类的行为

## 工具

• apktool

• androidkiller

• jeb
• GDA
• smali/baksmali
• ....

## 破解流程

1. 反编译apk
2. 定位关键代码
3. 功能分析
4. smali修改
5. 重打包、签名、安装

### 例子1，广告破解

• 反编译
``java -jar apktool.jar d xxx.apk -o out``
• 定位关键代码的方法很多，这里我用的是一个开源的小工具，原理是`注入+栈追踪`，我们可以先用字符串大法先随意拼接以下ad字符串大致定位一下，可能会在哪个文件夹中，挑选出下面包含类所在文件夹批量注入日志打印方法 `python3 inject_log.py -r .\out\smali\com\youdo`

• 由于我们的目的是去广告，所以我们需要打开一个视频，查看日志中，广告开始播放时调用了哪些方法，这里我们就这样不断的去缩小我们过滤的范围，这里不做太多的赘述，最终确定到parsead方法，我们在返回的地方加一条指令`const/4 v0, 0x0`,让返回始终为null

``````const/4 v0, 0x0
return-object v0``````

## CTF-CrakeMe流程

1.反编译

2.定位关键代码

3.逆向算法

### 例子2

```<activity android:label="@h/a" android:name="ctf.bobbydylan.M">
<intent-filter>
<action android:name="android.intent.action.MAIN"/>
<category android:name="android.intent.category.LAUNCHER"/>
</intent-filter>
```

```public void onCreate(Bundle bundle) {
super.onCreate(bundle);
setContentView(R.layout.main);
startService(new Intent(this, P.class));
((Button) findViewById(R.id.button)).setOnClickListener(new a(this, (TextView) findViewById(R.id.et)));
}
```
```public int onStartCommand(Intent intent, int i, int i2) {
try {
if (this.a == null) {
this.a = MediaPlayer.create(this, R.raw.bobdylan);
this.a.start();
this.a.setLooping(true);
}
} catch (Exception e) {
}
return super.onStartCommand(intent, i, i2);
}
```

```a(M m, TextView textView) {
this.b = m;
this.a = textView;
}

public void onClick(View view) {
try {
this.b.check(this.a.getText().toString());
new Builder(this.b).setMessage("正确").setNeutralButton("OK", null).create().show();
} catch (Exception e) {
new Builder(this.b).setMessage("错误").setNeutralButton("OK", null).create().show();
}
}
```

#### check

```public void check(String str) {
int i = 0;
//条件1：输入字符串长度必须等于16
if (str.length() != 16) {
throw new RuntimeException();
}
String str2 = "";
try {
str2 = getKey();
} catch (Exception e) {
str2 = getKey();
System.arraycopy(str2, 0, str, 5, 5);
}
int[] iArr = new int;
iArr = 0;
iArr = 14;
iArr = 7;
iArr = 15;
iArr = 42;
try {
iArr = 3;
iArr = 5;
System.out.println();
} catch (Exception e2) {
iArr = 37;
iArr = 85;
}
iArr = 15;
iArr = 13;
iArr = 19;
iArr = 68;
iArr = 85;
iArr = 5;
iArr = 7;
iArr = 78;
iArr = 22;
//条件2：iArr数组&255必须和后面这串计算相等
while (i < str.length()) {
if ((iArr[i] & 255) != ((str.charAt(i) ^ str2.charAt(i % str2.length())) & 255)) {
throw new RuntimeException();
}
i++;
}
}

public String getKey() {
return "bobbydylan";
}
```

```iArr = [0, 3, 13, 19, 85, 5, 15, 78, 22, 7, 7, 68, 14, 5, 15, 42]
chArr = ['b', 'o', 'b', 'b', 'y', 'd', 'y', 'l', 'a', 'n']
for i in iArr:
number = 0
while(True):
if iArr[i] == number ^ ord(chArr[i%len('bobbydylan')]):
print(chr(number))
if i == len(iArr):
print("end")
exit(0)
break
number += 1
``` ```iArr = [0, 3, 13, 19, 85, 5, 15, 78, 22, 7, 7, 68, 14, 5, 15, 42]
chArr = ['b', 'o', 'b', 'd', 'y', 'l', 'a', 'n']
for i in range(len(iArr)):
number = 0
while(True):
if iArr[i] == number ^ ord(chArr[i%len('bobdylan')]):
print(chr(number))
if i == len(iArr):
print("end")
exit(0)
break
number += 1
```

### 小结

【1】当java层代码不能给我们正确答案是，可以阅读smali代码

## 病毒分析

### 分析流程

1. 大致阅览安装包内有哪些文件。资源目录raw、lib等
3. 从入口类触发看逻辑
4. 汇总

【1】批量注入栈跟踪小工具
{"ft_lang_label":"__label__zh","ft_lang_prob":0.50680184,"math_prob":0.91616535,"size":4239,"snap":"2020-45-2020-50","text_gpt3_token_len":2256,"char_repetition_ratio":0.08453365,"word_repetition_ratio":0.17201835,"special_character_ratio":0.3210663,"punctuation_ratio":0.25094578,"nsfw_num_words":0,"has_unicode_error":false,"math_prob_llama3":0.9790472,"pos_list":[0,1,2,3,4],"im_url_duplicate_count":[null,4,null,4,null],"WARC_HEADER":"{\"WARC-Type\":\"response\",\"WARC-Date\":\"2020-10-23T03:12:36Z\",\"WARC-Record-ID\":\"<urn:uuid:16edd7a1-cc2e-4a69-8c5a-b77a3c1aef53>\",\"Content-Length\":\"39181\",\"Content-Type\":\"application/http; msgtype=response\",\"WARC-Warcinfo-ID\":\"<urn:uuid:3ea79631-9c98-470a-8d7a-bf25267c1607>\",\"WARC-Concurrent-To\":\"<urn:uuid:73b7ca2e-a7bf-4772-8248-bd7fe7667245>\",\"WARC-IP-Address\":\"203.119.207.242\",\"WARC-Target-URI\":\"https://xz.aliyun.com/t/5504\",\"WARC-Payload-Digest\":\"sha1:3DJNP6BQTDK4BPPAYCIQMUX5PMSYBWVM\",\"WARC-Block-Digest\":\"sha1:KCOC2V2DGCNOE6QR3HGRPFLNKYSF345T\",\"WARC-Identified-Payload-Type\":\"text/html\",\"warc_filename\":\"/cc_download/warc_2020/CC-MAIN-2020-45/CC-MAIN-2020-45_segments_1603107880519.12_warc_CC-MAIN-20201023014545-20201023044545-00699.warc.gz\"}"}