Android逆向之旅

爱被打了一巴掌 2022-05-20 03:57 269阅读 0赞

> 本文开始记录我学习android 逆向的全部过程 和参考文献.您需要有一定android开发经验在做逆向也不迟.我觉得如果一个不会android的学逆向 他只是一个略懂的人.

# apk打包流程 #

> 我觉得很有必要了解,因为掌握这部分知识其实你可以自己做一些逆向工具,而不是有求于人.比如说你可以做java2smali或者smali2java

基本apk打包流程：  
[https://www.jianshu.com/p/7c288a17cda8][https_www.jianshu.com_p_7c288a17cda8]

--------------------

关于apk中META-INF：  
[https://blog.csdn.net/lewif/article/details/49154847][https_blog.csdn.net_lewif_article_details_49154847]

--------------------

\[可选，强烈建议\]手动开始打包一次apk

[https://juejin.im/entry/58c0ca14128fe100601dfc0e][https_juejin.im_entry_58c0ca14128fe100601dfc0e]

# smali语法 #

我们在学习javase的时候用的虚拟机(jvm)是hotpot(当然你不知道也没关系,可以顺带了解,想具体学习可以参考周志明老师的书籍).  
hotpot它是Sun JDK和OpenJDK中所带的虚拟机，也是目前使用范围最广的Java虚拟机。  
然而Android用的是自己研发的虚拟机Dalvik.所以运行字节码也有所不同现在我们来对比查看下.

**先来看下java源文件**

//Hello.java
    public class Hello {
        
    
    
        public static void main(String[] argc){
    
            int i = 0;
            System.out.println("hello "+i);
    
    
        }
    }

**上面源码对应的Hotpot虚拟机字节码:**

可以用*`javap -c XXX.class`* 查看对应字节码  
![这里写图片描述][70]

**上面源码对应的Android虚拟机字节码:**

.class public LHello;
    .super Ljava/lang/Object;
    .source "Hello.java"
    
    
    # direct methods
    .method public constructor <init>()V
        .registers 1
    
        .prologue
        .line 1
        invoke-direct {p0}, Ljava/lang/Object;-><init>()V
    
        return-void
    .end method
    
    .method public static main([Ljava/lang/String;)V
        .registers 5
    
        .prologue
        .line 6
        const/4 v0, 0x0
    
        .line 7
        sget-object v1, Ljava/lang/System;->out:Ljava/io/PrintStream;
    
        new-instance v2, Ljava/lang/StringBuilder;
    
        invoke-direct {v2}, Ljava/lang/StringBuilder;-><init>()V
    
        const-string v3, "hello "
    
        invoke-virtual {v2, v3}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
    
        move-result-object v2
    
        invoke-virtual {v2, v0}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
    
        move-result-object v0
    
        invoke-virtual {v0}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
    
        move-result-object v0
    
        invoke-virtual {v1, v0}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V
    
        .line 10
        return-void
    .end method

> java直接翻译成smali工具大家可以自己利用qt或者MFC做一个(原理教程:[java2smali原理][java2smali]),这里我直接推荐一个工具链接: [https://pan.baidu.com/s/1EjbjMShxAGi5B5S-LZO49A][https_pan.baidu.com_s_1EjbjMShxAGi5B5S-LZO49A] 密码: 8w14

语法学习:  
[https://blog.csdn.net/lpohvbe/article/details/7981386][https_blog.csdn.net_lpohvbe_article_details_7981386]  
[https://blog.csdn.net/woblog/article/details/52106571][https_blog.csdn.net_woblog_article_details_52106571]  
语法手册  
[https://blog.csdn.net/qq373432361/article/details/49557579][https_blog.csdn.net_qq373432361_article_details_49557579]  
看以上两篇其实也足够平常使用了

# 动态调试 #

旧版调试:  
缺点速度慢,配置罗嗦了点.但是可以动态修改  
[https://blog.csdn.net/qfanmingyiq/article/details/81044013][https_blog.csdn.net_qfanmingyiq_article_details_81044013]  
新版调试:  
[https://blog.csdn.net/hanchaohao2012/article/details/63253725][https_blog.csdn.net_hanchaohao2012_article_details_63253725]

# 调试技巧 #

可以用Traceview来进行查看哪个方法调用频率高

> [https://blog.csdn.net/innost/article/details/9008691][https_blog.csdn.net_innost_article_details_9008691]

查看线程的调用栈

Thread.dumpStack();

# IDA PRO 调试 #

So格式  
[https://www.jianshu.com/p/ef462437b999][https_www.jianshu.com_p_ef462437b999]  
[https://bbs.pediy.com/thread-221821.htm][https_bbs.pediy.com_thread-221821.htm]

[https_www.jianshu.com_p_7c288a17cda8]: https://www.jianshu.com/p/7c288a17cda8
[https_blog.csdn.net_lewif_article_details_49154847]: https://blog.csdn.net/lewif/article/details/49154847
[https_juejin.im_entry_58c0ca14128fe100601dfc0e]: https://juejin.im/entry/58c0ca14128fe100601dfc0e
[70]: /images/20220520/cb1639fb4f814e41abf8ee00f0ec120a.png
[java2smali]: https://www.cnblogs.com/gordon0918/p/5466514.html
[https_pan.baidu.com_s_1EjbjMShxAGi5B5S-LZO49A]: https://pan.baidu.com/s/1EjbjMShxAGi5B5S-LZO49A
[https_blog.csdn.net_lpohvbe_article_details_7981386]: https://blog.csdn.net/lpohvbe/article/details/7981386
[https_blog.csdn.net_woblog_article_details_52106571]: https://blog.csdn.net/woblog/article/details/52106571
[https_blog.csdn.net_qq373432361_article_details_49557579]: https://blog.csdn.net/qq373432361/article/details/49557579
[https_blog.csdn.net_qfanmingyiq_article_details_81044013]: https://blog.csdn.net/qfanmingyiq/article/details/81044013
[https_blog.csdn.net_hanchaohao2012_article_details_63253725]: https://blog.csdn.net/hanchaohao2012/article/details/63253725
[https_blog.csdn.net_innost_article_details_9008691]: https://blog.csdn.net/innost/article/details/9008691
[https_www.jianshu.com_p_ef462437b999]: https://www.jianshu.com/p/ef462437b999
[https_bbs.pediy.com_thread-221821.htm]: https://bbs.pediy.com/thread-221821.htm