android逆向总结

首先项目里的java文件，以及项目引用到的第三方jar或aar包里面的class，统统都编译成classes.dex放在apk包的根目录，项目的资源目录和AndroidManifest.xml被处理生成资源目录和resource.arsc以及AndroidManifest.xml文件放到apk包根目录。

apk包安装到android后，apk包被复制到/data/app目录，应用程序每次启动后就会加载这个apk，访问里面的资源。而为了加快执行，apk包根目录的classes.dex会已经arch优化成odex，放在/data/dalvik_cache目录。应用程序加载的执行代码就是这个odex。apk包的lib目录下的所有文件（主要是so第三方c库）都会从apk包复制到/data/lib。

当我们对一个普通的apk包分析时，res目录下的xml和根目录下的AndroidManifest.xml都在打包时被处理过，不能直接阅读。这些xml文件都是可执行的脚本描述。而执行文件classes.dex则是我们希望反编译汇编代码进行分析的。apktool这个工具的主要逆向功能就是，将res目录下的xml和AndroidManifest.xml文件还原释放出来，以及将classes.dex反汇编成smali。

android系统自带有反汇编工具，/usr/xbin/dexdump。这个工具可以直接从odex反汇编出smali描述出来。

下面常用的反编译工具和各种文件之间的转换。

这里有4种工具，

oat2dex，将odex或oat转换出dex。

d2j工具套，虚拟机机器指令和可执行包之间的assemble和disassemble，以及Davlik虚拟机可执行文件dex和java虚拟机执行包之间的转换。dex可以反汇编出smali，而class可以反汇编出j。

代码逆向工具，smali2java就是将smali翻译出java文件，DJ JavaDecomplier就是将class或java虚拟机指令反向出java文件。这两个工具都不能很好地对控制逻辑（条件控制，循环控制，跳转）进行翻译。smali2java面对稍复杂一点的控制逻辑就不工作，它的翻译函数异常没有结果。而DJ JavaDecomplier面对稍复杂一点的控制逻辑，它的逆向代码与其它语言的逆向工具的逆向代码一样，天书一样多的跳标签，不是人类阅读的。

注，这里说Java有跳转，是指catch，熟悉c++，oc反汇编都明白，在异常处理代码就是在做跳转。而在java机器指令或smali指令中，异常也是有专门的跳转指令和标签。

下面是我对百度加固baiduprotect的StubApplication.smali进行人工逆向的java代码

  1 .method private static loadX86Library()V
  2     .locals 33
  3 
  4     .prologue
  5     .line 128
  6     const/16 v24, 0x0
  7 
  8     .line 129
  9     .local v24, "packageName":Ljava/lang/String;
 10     const/4 v4, 0x0
 11 
 12     .line 131
 13     .local v4, "apkPath":Ljava/lang/String;
 14     invoke-static {}, Lcom/baidu/protect/StubApplication;->is64BitEnv()Z
 15 
 16     move-result v15
 17 
 18     .line 134
 19     .local v15, "is_x86_64":Z
 20     :try_start_0
 21     new-instance v5, Ljava/io/BufferedReader;
 22 
 23     new-instance v30, Ljava/io/InputStreamReader;
 24 
 25     .line 135
 26     new-instance v31, Ljava/io/FileInputStream;
 27 
 28     const-string v32, "/proc/self/maps"
 29 
 30     invoke-direct/range {v31 .. v32}, Ljava/io/FileInputStream;-><init>(Ljava/lang/String;)V
 31 
 32     invoke-direct/range {v30 .. v31}, Ljava/io/InputStreamReader;-><init>(Ljava/io/InputStream;)V
 33 
 34     .line 134
 35     move-object/from16 v0, v30
 36 
 37     invoke-direct {v5, v0}, Ljava/io/BufferedReader;-><init>(Ljava/io/Reader;)V
 38 
 39     .line 136
 40     .local v5, "br":Ljava/io/BufferedReader;
 41     invoke-virtual {v5}, Ljava/io/BufferedReader;->readLine()Ljava/lang/String;
 42 
 43     move-result-object v19
 44 
 45     .local v19, "line":Ljava/lang/String;
 46     :goto_0
 47     if-nez v19, :cond_3
 48 
 49     .line 186
 50     :goto_1
 51     invoke-virtual {v5}, Ljava/io/BufferedReader;->close()V
 52     :try_end_0
 53     .catch Ljava/io/IOException; {:try_start_0 .. :try_end_0} :catch_0
 54 
 55     .line 192
 56     .end local v5    # "br":Ljava/io/BufferedReader;
 57     .end local v19    # "line":Ljava/lang/String;
 58     :goto_2
 59     if-eqz v15, :cond_a
 60 
 61     .line 193
 62     const-string v28, "libbaiduprotect_x86_64.so"
 63 
 64     .line 200
 65     .local v28, "soname":Ljava/lang/String;
 66     :goto_3
 67     if-eqz v4, :cond_2
 68 
 69     if-eqz v24, :cond_2
 70 
 71     .line 201
 72     const-wide/16 v12, 0x0
 73 
 74     .line 202
 75     .local v12, "fileModified":J
 76     const-wide/16 v22, 0x0
 77 
 78     .line 203
 79     .local v22, "newFileModified":J
 80     invoke-static/range {v24 .. v24}, Lcom/baidu/protect/StubApplication;->getDataFolder(Ljava/lang/String;)Ljava/lang/String;
 81 
 82     move-result-object v7
 83 
 84     .line 205
 85     .local v7, "dataFolder":Ljava/lang/String;
 86     new-instance v30, Ljava/lang/StringBuilder;
 87 
 88     invoke-static {v7}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;
 89 
 90     move-result-object v31
 91 
 92     invoke-direct/range {v30 .. v31}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
 93 
 94     move-object/from16 v0, v30
 95 
 96     move-object/from16 v1, v24
 97 
 98     invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
 99 
100     move-result-object v30
101 
102     const-string v31, "/.x86lib/"
103 
104     invoke-virtual/range {v30 .. v31}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
105 
106     move-result-object v30
107 
108     invoke-virtual/range {v30 .. v30}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
109 
110     move-result-object v18
111 
112     .line 206
113     .local v18, "libTargetFolder":Ljava/lang/String;
114     new-instance v30, Ljava/lang/StringBuilder;
115 
116     invoke-static/range {v18 .. v18}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;
117 
118     move-result-object v31
119 
120     invoke-direct/range {v30 .. v31}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
121 
122     move-object/from16 v0, v30
123 
124     move-object/from16 v1, v28
125 
126     invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
127 
128     move-result-object v30
129 
130     invoke-virtual/range {v30 .. v30}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
131 
132     move-result-object v17
133 
134     .line 207
135     .local v17, "libPath":Ljava/lang/String;
136     new-instance v9, Ljava/io/File;
137 
138     move-object/from16 v0, v18
139 
140     invoke-direct {v9, v0}, Ljava/io/File;-><init>(Ljava/lang/String;)V
141 
142     .line 208
143     .local v9, "f":Ljava/io/File;
144     invoke-virtual {v9}, Ljava/io/File;->exists()Z
145 
146     move-result v30
147 
148     if-nez v30, :cond_0
149 
150     .line 209
151     invoke-virtual {v9}, Ljava/io/File;->mkdir()Z
152 
153     .line 212
154     :cond_0
155     :try_start_1
156     new-instance v30, Ljava/lang/StringBuilder;
157 
158     const-string v31, "assets/"
159 
160     invoke-direct/range {v30 .. v31}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
161 
162     move-object/from16 v0, v30
163 
164     move-object/from16 v1, v28
165 
166     invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
167 
168     move-result-object v30
169 
170     invoke-virtual/range {v30 .. v30}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
171 
172     move-result-object v27
173 
174     .line 213
175     .local v27, "soEntryName":Ljava/lang/String;
176     new-instance v21, Ljava/util/zip/ZipInputStream;
177 
178     new-instance v30, Ljava/io/FileInputStream;
179 
180     move-object/from16 v0, v30
181 
182     invoke-direct {v0, v4}, Ljava/io/FileInputStream;-><init>(Ljava/lang/String;)V
183 
184     move-object/from16 v0, v21
185 
186     move-object/from16 v1, v30
187 
188     invoke-direct {v0, v1}, Ljava/util/zip/ZipInputStream;-><init>(Ljava/io/InputStream;)V
189 
190     .line 215
191     .local v21, "localZipInputStream":Ljava/util/zip/ZipInputStream;
192     :goto_4
193     invoke-virtual/range {v21 .. v21}, Ljava/util/zip/ZipInputStream;->getNextEntry()Ljava/util/zip/ZipEntry;
194 
195     move-result-object v20
196 
197     .line 216
198     .local v20, "localZipEntry":Ljava/util/zip/ZipEntry;
199     if-nez v20, :cond_b
200 
201     .line 258
202     :cond_1
203     :goto_5
204     invoke-virtual/range {v21 .. v21}, Ljava/util/zip/ZipInputStream;->close()V
205     :try_end_1
206     .catch Ljava/io/IOException; {:try_start_1 .. :try_end_1} :catch_1
207 
208     .line 264
209     .end local v20    # "localZipEntry":Ljava/util/zip/ZipEntry;
210     .end local v21    # "localZipInputStream":Ljava/util/zip/ZipInputStream;
211     .end local v27    # "soEntryName":Ljava/lang/String;
212     :goto_6
213     invoke-static/range {v17 .. v17}, Ljava/lang/System;->load(Ljava/lang/String;)V
214 
215     .line 266
216     .end local v7    # "dataFolder":Ljava/lang/String;
217     .end local v9    # "f":Ljava/io/File;
218     .end local v12    # "fileModified":J
219     .end local v17    # "libPath":Ljava/lang/String;
220     .end local v18    # "libTargetFolder":Ljava/lang/String;
221     .end local v22    # "newFileModified":J
222     :cond_2
223     return-void
224 
225     .line 138
226     .end local v28    # "soname":Ljava/lang/String;
227     .restart local v5    # "br":Ljava/io/BufferedReader;
228     .restart local v19    # "line":Ljava/lang/String;
229     :cond_3
230     :try_start_2
231     const-string v30, ".apk"
232 
233     move-object/from16 v0, v19
234 
235     move-object/from16 v1, v30
236 
237     invoke-virtual {v0, v1}, Ljava/lang/String;->endsWith(Ljava/lang/String;)Z
238 
239     move-result v30
240 
241     if-eqz v30, :cond_5
242 
243     .line 139
244     sget-object v30, Ljava/lang/System;->out:Ljava/io/PrintStream;
245 
246     new-instance v31, Ljava/lang/StringBuilder;
247 
248     const-string v32, "Wigan:line="
249 
250     invoke-direct/range {v31 .. v32}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
251 
252     move-object/from16 v0, v31
253 
254     move-object/from16 v1, v19
255 
256     invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
257 
258     move-result-object v31
259 
260     invoke-virtual/range {v31 .. v31}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
261 
262     move-result-object v31
263 
264     invoke-virtual/range {v30 .. v31}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V
265 
266     .line 140
267     const-string v30, " "
268 
269     move-object/from16 v0, v19
270 
271     move-object/from16 v1, v30
272 
273     invoke-virtual {v0, v1}, Ljava/lang/String;->split(Ljava/lang/String;)[Ljava/lang/String;
274 
275     move-result-object v26
276 
277     .line 141
278     .local v26, "s":[Ljava/lang/String;
279     move-object/from16 v0, v26
280 
281     array-length v0, v0
282 
283     move/from16 v30, v0
284 
285     add-int/lit8 v30, v30, -0x1
286 
287     aget-object v25, v26, v30
288 
289     .line 144
290     .local v25, "path":Ljava/lang/String;
291     const-string v30, "/mnt/asec/"
292 
293     move-object/from16 v0, v25
294 
295     move-object/from16 v1, v30
296 
297     invoke-virtual {v0, v1}, Ljava/lang/String;->startsWith(Ljava/lang/String;)Z
298 
299     move-result v30
300 
301     if-nez v30, :cond_4
302 
303     const-string v30, "/data/app/"
304 
305     move-object/from16 v0, v25
306 
307     move-object/from16 v1, v30
308 
309     invoke-virtual {v0, v1}, Ljava/lang/String;->startsWith(Ljava/lang/String;)Z
310 
311     move-result v30
312 
313     if-eqz v30, :cond_6
314 
315     .line 145
316     :cond_4
317     const/16 v30, 0xa
318 
319     move-object/from16 v0, v25
320 
321     move/from16 v1, v30
322 
323     invoke-virtual {v0, v1}, Ljava/lang/String;->substring(I)Ljava/lang/String;
324 
325     move-result-object v3
326 
327     .line 156
328     .local v3, "apkName":Ljava/lang/String;
329     :goto_7
330     const/16 v30, 0x2d
331 
332     move/from16 v0, v30
333 
334     invoke-virtual {v3, v0}, Ljava/lang/String;->lastIndexOf(I)I
335 
336     move-result v16
337 
338     .line 157
339     .local v16, "lastIndex":I
340     const/16 v30, -0x1
341 
342     move/from16 v0, v16
343 
344     move/from16 v1, v30
345 
346     if-ne v0, v1, :cond_8
347 
348     .line 136
349     .end local v3    # "apkName":Ljava/lang/String;
350     .end local v16    # "lastIndex":I
351     .end local v25    # "path":Ljava/lang/String;
352     .end local v26    # "s":[Ljava/lang/String;
353     :cond_5
354     invoke-virtual {v5}, Ljava/io/BufferedReader;->readLine()Ljava/lang/String;
355 
356     move-result-object v19
357 
358     goto/16 :goto_0
359 
360     .line 147
361     .restart local v25    # "path":Ljava/lang/String;
362     .restart local v26    # "s":[Ljava/lang/String;
363     :cond_6
364     const-string v30, "/app/"
365 
366     move-object/from16 v0, v25
367 
368     move-object/from16 v1, v30
369 
370     invoke-virtual {v0, v1}, Ljava/lang/String;->startsWith(Ljava/lang/String;)Z
371 
372     move-result v30
373 
374     if-eqz v30, :cond_7
375 
376     .line 148
377     const/16 v30, 0x5
378 
379     move-object/from16 v0, v25
380 
381     move/from16 v1, v30
382 
383     invoke-virtual {v0, v1}, Ljava/lang/String;->substring(I)Ljava/lang/String;
384 
385     move-result-object v3
386 
387     .line 149
388     .restart local v3    # "apkName":Ljava/lang/String;
389     goto :goto_7
390 
391     .line 150
392     .end local v3    # "apkName":Ljava/lang/String;
393     :cond_7
394     const-string v30, "/mnt/asec2/[2]"
395 
396     move-object/from16 v0, v25
397 
398     move-object/from16 v1, v30
399 
400     invoke-virtual {v0, v1}, Ljava/lang/String;->startsWith(Ljava/lang/String;)Z
401 
402     move-result v30
403 
404     if-eqz v30, :cond_5
405 
406     .line 151
407     const/16 v30, 0xe
408 
409     move-object/from16 v0, v25
410 
411     move/from16 v1, v30
412 
413     invoke-virtual {v0, v1}, Ljava/lang/String;->substring(I)Ljava/lang/String;
414 
415     move-result-object v3
416 
417     .restart local v3    # "apkName":Ljava/lang/String;
418     goto :goto_7
419 
420     .line 160
421     .restart local v16    # "lastIndex":I
422     :cond_8
423     const/16 v30, 0x0
424 
425     move/from16 v0, v30
426 
427     move/from16 v1, v16
428 
429     invoke-virtual {v3, v0, v1}, Ljava/lang/String;->substring(II)Ljava/lang/String;
430 
431     move-result-object v29
432 
433     .line 161
434     .local v29, "tmpPackageName":Ljava/lang/String;
435     move-object/from16 v24, v29
436 
437     .line 162
438     if-eqz v15, :cond_9
439 
440     .line 163
441     const/16 v30, 0x2f
442 
443     move/from16 v0, v30
444 
445     invoke-virtual {v3, v0}, Ljava/lang/String;->lastIndexOf(I)I
446 
447     move-result v16
448 
449     .line 164
450     const/16 v30, -0x1
451 
452     move/from16 v0, v16
453 
454     move/from16 v1, v30
455 
456     if-eq v0, v1, :cond_5
457 
458     .line 167
459     const/16 v30, 0x0
460 
461     move/from16 v0, v30
462 
463     move/from16 v1, v16
464 
465     invoke-virtual {v3, v0, v1}, Ljava/lang/String;->substring(II)Ljava/lang/String;
466 
467     move-result-object v2
468 
469     .line 169
470     .local v2, "apkInstallName":Ljava/lang/String;
471     new-instance v9, Ljava/io/File;
472 
473     new-instance v30, Ljava/lang/StringBuilder;
474 
475     const-string v31, "/data/app/"
476 
477     invoke-direct/range {v30 .. v31}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
478 
479     move-object/from16 v0, v30
480 
481     invoke-virtual {v0, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
482 
483     move-result-object v30
484 
485     const-string v31, "/lib/x86_64/libbaiduprotect.so"
486 
487     invoke-virtual/range {v30 .. v31}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
488 
489     move-result-object v30
490 
491     invoke-virtual/range {v30 .. v30}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
492 
493     move-result-object v30
494 
495     move-object/from16 v0, v30
496 
497     invoke-direct {v9, v0}, Ljava/io/File;-><init>(Ljava/lang/String;)V
498 
499     .line 170
500     .restart local v9    # "f":Ljava/io/File;
501     invoke-virtual {v9}, Ljava/io/File;->exists()Z
502 
503     move-result v30
504 
505     if-eqz v30, :cond_5
506 
507     .line 171
508     move-object/from16 v24, v29
509 
510     .line 172
511     new-instance v30, Ljava/lang/StringBuilder;
512 
513     const-string v31, "/data/app/"
514 
515     invoke-direct/range {v30 .. v31}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
516 
517     move-object/from16 v0, v30
518 
519     invoke-virtual {v0, v3}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
520 
521     move-result-object v30
522 
523     invoke-virtual/range {v30 .. v30}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
524 
525     move-result-object v4
526 
527     .line 173
528     goto/16 :goto_1
529 
530     .line 177
531     .end local v2    # "apkInstallName":Ljava/lang/String;
532     .end local v9    # "f":Ljava/io/File;
533     :cond_9
534     new-instance v9, Ljava/io/File;
535 
536     new-instance v30, Ljava/lang/StringBuilder;
537 
538     const-string v31, "/data/data/"
539 
540     invoke-direct/range {v30 .. v31}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
541 
542     move-object/from16 v0, v30
543 
544     move-object/from16 v1, v29
545 
546     invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
547 
548     move-result-object v30
549 
550     const-string v31, "/lib/libbaiduprotect.so"
551 
552     invoke-virtual/range {v30 .. v31}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
553 
554     move-result-object v30
555 
556     invoke-virtual/range {v30 .. v30}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
557 
558     move-result-object v30
559 
560     move-object/from16 v0, v30
561 
562     invoke-direct {v9, v0}, Ljava/io/File;-><init>(Ljava/lang/String;)V
563 
564     .line 178
565     .restart local v9    # "f":Ljava/io/File;
566     invoke-virtual {v9}, Ljava/io/File;->exists()Z
567     :try_end_2
568     .catch Ljava/io/IOException; {:try_start_2 .. :try_end_2} :catch_0
569 
570     move-result v30
571 
572     if-eqz v30, :cond_5
573 
574     .line 179
575     move-object/from16 v24, v29
576 
577     .line 180
578     move-object/from16 v4, v25
579 
580     .line 181
581     goto/16 :goto_1
582 
583     .line 187
584     .end local v3    # "apkName":Ljava/lang/String;
585     .end local v5    # "br":Ljava/io/BufferedReader;
586     .end local v9    # "f":Ljava/io/File;
587     .end local v16    # "lastIndex":I
588     .end local v19    # "line":Ljava/lang/String;
589     .end local v25    # "path":Ljava/lang/String;
590     .end local v26    # "s":[Ljava/lang/String;
591     .end local v29    # "tmpPackageName":Ljava/lang/String;
592     :catch_0
593     move-exception v8
594 
595     .line 188
596     .local v8, "e":Ljava/io/IOException;
597     invoke-virtual {v8}, Ljava/io/IOException;->printStackTrace()V
598 
599     goto/16 :goto_2
600 
601     .line 196
602     .end local v8    # "e":Ljava/io/IOException;
603     :cond_a
604     const-string v28, "libbaiduprotect_x86.so"
605 
606     .restart local v28    # "soname":Ljava/lang/String;
607     goto/16 :goto_3
608 
609     .line 219
610     .restart local v7    # "dataFolder":Ljava/lang/String;
611     .restart local v9    # "f":Ljava/io/File;
612     .restart local v12    # "fileModified":J
613     .restart local v17    # "libPath":Ljava/lang/String;
614     .restart local v18    # "libTargetFolder":Ljava/lang/String;
615     .restart local v20    # "localZipEntry":Ljava/util/zip/ZipEntry;
616     .restart local v21    # "localZipInputStream":Ljava/util/zip/ZipInputStream;
617     .restart local v22    # "newFileModified":J
618     .restart local v27    # "soEntryName":Ljava/lang/String;
619     :cond_b
620     :try_start_3
621     invoke-virtual/range {v20 .. v20}, Ljava/util/zip/ZipEntry;->getName()Ljava/lang/String;
622 
623     move-result-object v30
624 
625     move-object/from16 v0, v30
626 
627     move-object/from16 v1, v27
628 
629     invoke-virtual {v0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
630 
631     move-result v30
632 
633     if-eqz v30, :cond_f
634 
635     .line 220
636     invoke-virtual/range {v20 .. v20}, Ljava/util/zip/ZipEntry;->getTime()J
637 
638     move-result-wide v22
639 
640     .line 221
641     new-instance v10, Ljava/io/File;
642 
643     move-object/from16 v0, v17
644 
645     invoke-direct {v10, v0}, Ljava/io/File;-><init>(Ljava/lang/String;)V
646     :try_end_3
647     .catch Ljava/io/IOException; {:try_start_3 .. :try_end_3} :catch_1
648 
649     .line 222
650     .end local v9    # "f":Ljava/io/File;
651     .local v10, "f":Ljava/io/File;
652     :try_start_4
653     invoke-virtual {v10}, Ljava/io/File;->exists()Z
654 
655     move-result v30
656 
657     if-eqz v30, :cond_d
658 
659     .line 223
660     invoke-virtual {v10}, Ljava/io/File;->lastModified()J
661 
662     move-result-wide v12
663 
664     .line 224
665     cmp-long v30, v12, v22
666 
667     if-nez v30, :cond_c
668 
669     .line 226
670     invoke-virtual/range {v21 .. v21}, Ljava/util/zip/ZipInputStream;->closeEntry()V
671 
672     move-object v9, v10
673 
674     .line 227
675     .end local v10    # "f":Ljava/io/File;
676     .restart local v9    # "f":Ljava/io/File;
677     goto/16 :goto_5
678 
679     .line 229
680     .end local v9    # "f":Ljava/io/File;
681     .restart local v10    # "f":Ljava/io/File;
682     :cond_c
683     invoke-virtual {v10}, Ljava/io/File;->delete()Z
684 
685     .line 233
686     :cond_d
687     new-instance v11, Ljava/io/FileOutputStream;
688 
689     move-object/from16 v0, v17
690 
691     invoke-direct {v11, v0}, Ljava/io/FileOutputStream;-><init>(Ljava/lang/String;)V
692 
693     .line 234
694     .local v11, "fo":Ljava/io/FileOutputStream;
695     const/16 v30, 0x400
696 
697     move/from16 v0, v30
698 
699     new-array v6, v0, [B
700 
701     .line 236
702     .local v6, "buffer":[B
703     :goto_8
704     move-object/from16 v0, v21
705 
706     invoke-virtual {v0, v6}, Ljava/util/zip/ZipInputStream;->read([B)I
707 
708     move-result v14
709 
710     .line 237
711     .local v14, "i":I
712     const/16 v30, -0x1
713 
714     move/from16 v0, v30
715 
716     if-ne v14, v0, :cond_e
717 
718     .line 242
719     invoke-virtual {v11}, Ljava/io/FileOutputStream;->flush()V
720 
721     .line 243
722     invoke-virtual {v11}, Ljava/io/FileOutputStream;->close()V
723 
724     .line 244
725     invoke-virtual/range {v21 .. v21}, Ljava/util/zip/ZipInputStream;->closeEntry()V
726 
727     .line 247
728     new-instance v9, Ljava/io/File;
729 
730     move-object/from16 v0, v17
731 
732     invoke-direct {v9, v0}, Ljava/io/File;-><init>(Ljava/lang/String;)V
733     :try_end_4
734     .catch Ljava/io/IOException; {:try_start_4 .. :try_end_4} :catch_2
735 
736     .line 248
737     .end local v10    # "f":Ljava/io/File;
738     .restart local v9    # "f":Ljava/io/File;
739     :try_start_5
740     invoke-virtual {v9}, Ljava/io/File;->exists()Z
741 
742     move-result v30
743 
744     if-eqz v30, :cond_1
745 
746     .line 249
747     move-wide/from16 v0, v22
748 
749     invoke-virtual {v9, v0, v1}, Ljava/io/File;->setLastModified(J)Z
750     :try_end_5
751     .catch Ljava/io/IOException; {:try_start_5 .. :try_end_5} :catch_1
752 
753     goto/16 :goto_5
754 
755     .line 259
756     .end local v6    # "buffer":[B
757     .end local v11    # "fo":Ljava/io/FileOutputStream;
758     .end local v14    # "i":I
759     .end local v20    # "localZipEntry":Ljava/util/zip/ZipEntry;
760     .end local v21    # "localZipInputStream":Ljava/util/zip/ZipInputStream;
761     .end local v27    # "soEntryName":Ljava/lang/String;
762     :catch_1
763     move-exception v8
764 
765     .line 260
766     .restart local v8    # "e":Ljava/io/IOException;
767     :goto_9
768     invoke-virtual {v8}, Ljava/io/IOException;->printStackTrace()V
769 
770     goto/16 :goto_6
771 
772     .line 240
773     .end local v8    # "e":Ljava/io/IOException;
774     .end local v9    # "f":Ljava/io/File;
775     .restart local v6    # "buffer":[B
776     .restart local v10    # "f":Ljava/io/File;
777     .restart local v11    # "fo":Ljava/io/FileOutputStream;
778     .restart local v14    # "i":I
779     .restart local v20    # "localZipEntry":Ljava/util/zip/ZipEntry;
780     .restart local v21    # "localZipInputStream":Ljava/util/zip/ZipInputStream;
781     .restart local v27    # "soEntryName":Ljava/lang/String;
782     :cond_e
783     const/16 v30, 0x0
784 
785     :try_start_6
786     move/from16 v0, v30
787 
788     invoke-virtual {v11, v6, v0, v14}, Ljava/io/FileOutputStream;->write([BII)V
789     :try_end_6
790     .catch Ljava/io/IOException; {:try_start_6 .. :try_end_6} :catch_2
791 
792     goto :goto_8
793 
794     .line 259
795     .end local v6    # "buffer":[B
796     .end local v11    # "fo":Ljava/io/FileOutputStream;
797     .end local v14    # "i":I
798     :catch_2
799     move-exception v8
800 
801     move-object v9, v10
802 
803     .end local v10    # "f":Ljava/io/File;
804     .restart local v9    # "f":Ljava/io/File;
805     goto :goto_9
806 
807     .line 255
808     :cond_f
809     :try_start_7
810     invoke-virtual/range {v21 .. v21}, Ljava/util/zip/ZipInputStream;->closeEntry()V
811     :try_end_7
812     .catch Ljava/io/IOException; {:try_start_7 .. :try_end_7} :catch_1
813 
814     goto/16 :goto_4
815 .end method

smali指令文件

1     private static void loadX86Library() {
2         // :( Parsing error. Please contact me.
3     }

smali2java逆向出的结果

  1 private static void loadX86Library()
  2     {
  3         boolean flag;
  4         Object obj;
  5         Object obj1;
  6         Object obj2;
  7         Object obj3;
  8         Object obj5;
  9         Object obj6;
 10         obj2 = null;
 11         obj1 = null;
 12         obj5 = null;
 13         obj6 = null;
 14         flag = is64BitEnv();
 15         obj3 = obj5;
 16         obj = obj1;
 17         BufferedReader bufferedreader = new BufferedReader(new InputStreamReader(new FileInputStream("/proc/self/maps")));
 18         obj3 = obj5;
 19         obj = obj1;
 20         String s = bufferedreader.readLine();
 21           goto _L1
 22 _L29:
 23         obj3 = obj1;
 24         obj = obj2;
 25         bufferedreader.close();
 26         obj = obj2;
 27 _L17:
 28         int i;
 29         Object obj4;
 30         String s1;
 31         if(flag)
 32             obj2 = "libbaiduprotect_x86_64.so";
 33         else
 34             obj2 = "libbaiduprotect_x86.so";
 35         if(obj1 == null || obj == null) goto _L3; else goto _L2
 36 _L2:
 37         obj = (new StringBuilder(String.valueOf(getDataFolder(((String) (obj)))))).append(((String) (obj))).append("/.x86lib/").toString();
 38         obj3 = (new StringBuilder(String.valueOf(obj))).append(((String) (obj2))).toString();
 39         obj = new File(((String) (obj)));
 40         if(!((File) (obj)).exists())
 41             ((File) (obj)).mkdir();
 42         obj2 = (new StringBuilder("assets/")).append(((String) (obj2))).toString();
 43         obj = new ZipInputStream(new FileInputStream(((String) (obj1))));
 44 _L25:
 45         obj1 = ((ZipInputStream) (obj)).getNextEntry();
 46         if(obj1 != null) goto _L5; else goto _L4
 47 _L4:
 48         ((ZipInputStream) (obj)).close();
 49 _L22:
 50         System.load(((String) (obj3)));
 51 _L3:
 52         return;
 53 _L27:
 54         obj1 = obj2;
 55         obj3 = obj5;
 56         obj = obj2;
 57         if(!s.endsWith(".apk")) goto _L7; else goto _L6
 58 _L6:
 59         obj3 = obj5;
 60         obj = obj2;
 61         System.out.println((new StringBuilder("Wigan:line=")).append(s).toString());
 62         obj3 = obj5;
 63         obj = obj2;
 64         obj1 = s.split(" ");
 65         obj3 = obj5;
 66         obj = obj2;
 67         s1 = obj1[obj1.length - 1];
 68         obj3 = obj5;
 69         obj = obj2;
 70         if(s1.startsWith("/mnt/asec/")) goto _L9; else goto _L8
 71 _L8:
 72         obj3 = obj5;
 73         obj = obj2;
 74         if(!s1.startsWith("/data/app/")) goto _L10; else goto _L9
 75 _L9:
 76         obj3 = obj5;
 77         obj = obj2;
 78         s = s1.substring(10);
 79 _L13:
 80         obj3 = obj5;
 81         obj = obj2;
 82         i = s.lastIndexOf('-');
 83         if(i != -1) goto _L12; else goto _L11
 84 _L11:
 85         obj1 = obj2;
 86 _L7:
 87         obj3 = obj5;
 88         obj = obj1;
 89         s = bufferedreader.readLine();
 90         obj2 = obj1;
 91         continue; /* Loop/switch isn't completed */
 92 _L10:
 93         obj3 = obj5;
 94         obj = obj2;
 95         if(!s1.startsWith("/app/"))
 96             break MISSING_BLOCK_LABEL_464;
 97         obj3 = obj5;
 98         obj = obj2;
 99         s = s1.substring(5);
100           goto _L13
101         obj1 = obj2;
102         obj3 = obj5;
103         obj = obj2;
104         if(!s1.startsWith("/mnt/asec2/[2]")) goto _L7; else goto _L14
105 _L14:
106         obj3 = obj5;
107         obj = obj2;
108         s = s1.substring(14);
109           goto _L13
110 _L12:
111         obj3 = obj5;
112         obj = obj2;
113         obj2 = s.substring(0, i);
114         obj4 = obj2;
115         if(!flag)
116             break MISSING_BLOCK_LABEL_650;
117         obj3 = obj5;
118         obj = obj4;
119         i = s.lastIndexOf('/');
120         obj1 = obj4;
121         if(i == -1) goto _L7; else goto _L15
122 _L15:
123         obj3 = obj5;
124         obj = obj4;
125         s1 = s.substring(0, i);
126         obj1 = obj4;
127         obj3 = obj5;
128         obj = obj4;
129         if(!(new File((new StringBuilder("/data/app/")).append(s1).append("/lib/x86_64/libbaiduprotect.so").toString())).exists()) goto _L7; else goto _L16
130 _L16:
131         obj3 = obj5;
132         obj = obj2;
133         boolean flag1;
134         try
135         {
136             obj1 = (new StringBuilder("/data/app/")).append(s).toString();
137             continue; /* Loop/switch isn't completed */
138         }
139         // Misplaced declaration of an exception variable
140         catch(Object obj1)
141         {
142             ((IOException) (obj1)).printStackTrace();
143             obj1 = obj3;
144         }
145           goto _L17
146         obj3 = obj5;
147         obj = obj4;
148         flag1 = (new File((new StringBuilder("/data/data/")).append(((String) (obj2))).append("/lib/libbaiduprotect.so").toString())).exists();
149         obj1 = obj4;
150         if(!flag1) goto _L7; else goto _L18
151 _L18:
152         obj1 = s1;
153         continue; /* Loop/switch isn't completed */
154 _L5:
155         long l;
156         if(!((ZipEntry) (obj1)).getName().equals(obj2))
157             break MISSING_BLOCK_LABEL_891;
158         l = ((ZipEntry) (obj1)).getTime();
159         obj1 = new File(((String) (obj3)));
160 label0:
161         {
162             if(!((File) (obj1)).exists())
163                 break MISSING_BLOCK_LABEL_789;
164             if(((File) (obj1)).lastModified() != l)
165                 break label0;
166             ((ZipInputStream) (obj)).closeEntry();
167         }
168           goto _L4
169         ((File) (obj1)).delete();
170         byte abyte0[];
171         obj1 = new FileOutputStream(((String) (obj3)));
172         abyte0 = new byte[1024];
173 _L23:
174         i = ((ZipInputStream) (obj)).read(abyte0);
175         if(i != -1) goto _L20; else goto _L19
176 _L19:
177         ((FileOutputStream) (obj1)).flush();
178         ((FileOutputStream) (obj1)).close();
179         ((ZipInputStream) (obj)).closeEntry();
180         obj1 = new File(((String) (obj3)));
181         if(!((File) (obj1)).exists()) goto _L4; else goto _L21
182 _L21:
183         ((File) (obj1)).setLastModified(l);
184           goto _L4
185         obj;
186 _L24:
187         ((IOException) (obj)).printStackTrace();
188           goto _L22
189 _L20:
190         ((FileOutputStream) (obj1)).write(abyte0, 0, i);
191           goto _L23
192         obj;
193           goto _L24
194         ((ZipInputStream) (obj)).closeEntry();
195           goto _L25
196 _L1:
197         if(s != null) goto _L27; else goto _L26
198 _L26:
199         obj1 = obj6;
200         if(true) goto _L29; else goto _L28
201 _L28:
202     }

DJ Java Decomplier逆向出来的结果

baiduprotect`StubApplication.loadX86Library 手工逆向的结果

这个函数逻辑是：

1. 描述内存映射区间，找出加载的apk包名。

2. 在/data/app，/mnt/asec，或/mnt/asec2[2]目录下找出安装的apk，（所谓的安装就是将apk复制到固定目录下）。

3. 用压缩包方式打开apk包，找里面的assets/libbaiduprotect_${arch}.so库文件。

4. 将找到的so库文件释放到/data/data/${appname}/.${arch}目录下。

5. 更新这个so库文件的修改时间。

6. 加载这个so库文件。

虽然在/data/lib/${appname}目录已经有一个libbaiduprotect.so，但那只是个晃。加载完真正的so后，就会将apk包内的assest/baiduprotect1.jar释放到/data/data/${appname}/.1/1.jar，再将其转换成classes.dex。这两个文件都是以加密的方式，放在存储设备上的。这才是被保护的app的正体，并且baiduprotect不会直接去加载这个dex，而是在内存中解密后，用libdvm.so的jni去进行内存加载。所以你不能通过映射区间找出其映射的位置，如果你想dump它的内存映像，就会被baiduprotect发现终止app。

posted on 2017-05-26 19:51 bbqz007 阅读(872) 评论(0) 编辑收藏举报