Mais conteúdo relacionado Semelhante a Android 逆向工程心得分享 (20) 4. The Easy way.
• ⽤用APP抓APK
https://play.google.com/store/apps/details?id=com.ext.ui&hl=zh_TW
• 貼網址
https://apps.evozi.com/apk-downloader/
6. The Classic way.
• #adb shell pm list package
顯⽰示所有安裝的應⽤用程式之packageName
• #adb shell pm path package.name.here
顯⽰示應⽤用程式之APK路路徑
• #adb pull /path/to/apk/location/base.apk
取出應⽤用程式之APK
26. Apktool
• #java -jar apktool d target.apk -o target
反組譯APK並產⽣生smali與xml
*Smali是⼀一種很接近dex的組合語⾔言
• #java -jar apktool b target -o output.apk
將smali與xml重新組譯成APK
28. Signed
• #jarsigner -verbose -keystore ~/.android/
debug.keystore -storepass android -keypass
android target.apk androiddebugkey
使⽤用debug keystore 去簽重新包裝的apk
33. Quick Demo
.method public static d(Ljava/lang/String;Ljava/lang/String;)V
.locals 3
.param p0, "username" # Ljava/lang/String;
.param p1, "password" # Ljava/lang/String;
.prologue
...
invoke-virtual {v1, v0}, Landroid/content/Context;->startService(Landroid/content/Intent;)Land
return-void
.end method
invoke-virtual {v0}, Landroid/content/Intent;->toString()Ljava/lang/String;
move-result-object v0
const-string v3, "LOG"
invoke-static {v3, v0}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I
調⽤用intent.toString()將輸出存到v0
增加區域暫存器
設定v3
調⽤用Log.d(String,String)
.locals 4
35. Smali is good, but still
hard to analyze.
We need dex2jar and JDGui
42. 分析經驗談
• AndroidManifest.xml is a good start point. Adding
android:debuggable=“true” helps you ALWAYS.
• 耐⼼心、運氣和經驗。
• Use UIAutomator to analyze UI and xml.
• Use shell to view persistence data, such as db.
#adb shell run-as package.name
45. 逆向經驗談
• Static is better. NO constructor required.
• 建立同樣PackageName的Utility Project，編譯成
APK後再轉Smali並放入要改寫的⽬目錄。
• 少寫少錯，多寫多錯。
• Don’t forget use git.
47. Appendix
• Smali Syntax Highlight Plugin
https://github.com/ShaneWilton/sublime-smali
• Jadx
https://github.com/skylot/jadx
• 如果有align問題請記得
#zipalign -f -v 4 unalign.apk align.apk
