应用安全 --- 安卓加固 之 gs加固
gs加固是一个来自比利时的加固方案。有两个版本一个是收费的1年10k的dxxguard，一个免费的pxxguard。目前发现的加固手段有会给一个dex文件中的类中每个函数插入少量的花指令和静态代码块中插入复杂的检测代码，如果发现问题就触发各种异常代码导致app闪退。触发的异常有被除数是零，OOM，类没有找到异常，等等
IGh0dHBzOi8vZ2l0aHViLmNvbS9HdWFyZHNxdWFyZS9wcm9ndWFyZA==
加固前
package com.google.android.gms.common; import android.content.Context; import android.content.pm.PackageManager; import android.os.RemoteException; import android.os.StrictMode; import android.util.Log; import com.google.android.gms.common.internal.Preconditions; import com.google.android.gms.common.internal.zzaf; import com.google.android.gms.common.internal.zzag; import com.google.android.gms.common.util.AndroidUtilsLight; import com.google.android.gms.common.util.Hex; import com.google.android.gms.dynamic.ObjectWrapper; import com.google.android.gms.dynamite.DynamiteModule; import com.google.errorprone.annotations.CheckReturnValue; import java.security.MessageDigest; import java.util.concurrent.Callable; /* compiled from: com.google.android.gms:play-services-basement@@18.3.0 */ @CheckReturnValue /* loaded from: 1.jar:com/google/android/gms/common/zzn.class */ final class zzn { private static volatile zzag zze; private static Context zzg; static final zzl zza = new zzf(zzj.zze("0\u0082\u0005È0\u0082\u0003° \u0003\u0002\u0001\u0002\u0002\u0014\u0010\u008ae\bsù/\u008eQí")); static final zzl zzb = new zzg(zzj.zze("0\u0082\u0006\u00040\u0082\u0003ì \u0003\u0002\u0001\u0002\u0002\u0014\u0003£²\u00ad×árÊkì")); static final zzl zzc = new zzh(zzj.zze("0\u0082\u0004C0\u0082\u0003+ \u0003\u0002\u0001\u0002\u0002\t��Âà\u0087FdJ0\u008d0")); static final zzl zzd = new zzi(zzj.zze("0\u0082\u0004¨0\u0082\u0003\u0090 \u0003\u0002\u0001\u0002\u0002\t��Õ\u0085¸l}ÓNõ0")); private static final Object zzf = new Object(); /* JADX INFO: Access modifiers changed from: package-private */ /* JADX WARN: Multi-variable type inference failed */ /* JADX WARN: Type inference failed for: r0v0, types: [android.os.StrictMode$ThreadPolicy] */ /* JADX WARN: Type inference failed for: r0v1, types: [java.lang.Throwable] */ /* JADX WARN: Type inference failed for: r0v3, types: [com.google.android.gms.common.zzx] */ public static zzx zza(String str, zzj zzjVar, boolean z, boolean z2) { ?? allowThreadDiskReads = StrictMode.allowThreadDiskReads(); try { allowThreadDiskReads = zzh(str, zzjVar, z, z2); StrictMode.setThreadPolicy(allowThreadDiskReads); return allowThreadDiskReads; } catch (Throwable th) { StrictMode.setThreadPolicy(th); throw allowThreadDiskReads; } } /* JADX INFO: Access modifiers changed from: package-private */ public static zzx zzb(String str, boolean z, boolean z2, boolean z3) { return zzi(str, z, false, false, true); } private static zzx zzh(final String str, final zzj zzjVar, final boolean z, boolean z2) { try { zzj(); Preconditions.checkNotNull(zzg); try { return zze.zzh(new zzs(str, zzjVar, z, z2), ObjectWrapper.wrap(zzg.getPackageManager())) ? zzx.zzb() : new zzv(new Callable() { // from class: com.google.android.gms.common.zze @Override // java.util.concurrent.Callable public final Object call() { return zzn.zzd(z, str, zzjVar); } }, null); } catch (RemoteException e) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e); return zzx.zzd("module call", e); } } catch (DynamiteModule.LoadingException e2) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e2); return zzx.zzd("module init: ".concat(String.valueOf(e2.getMessage())), e2); } } /* JADX INFO: Access modifiers changed from: package-private */ public static zzx zzc(String str, boolean z, boolean z2, boolean z3) { return zzi(str, z, false, false, false); } /* JADX WARN: Multi-variable type inference failed */ /* JADX WARN: Type inference failed for: r0v0, types: [android.os.StrictMode$ThreadPolicy] */ /* JADX WARN: Type inference failed for: r0v1, types: [java.lang.Throwable] */ /* JADX WARN: Type inference failed for: r0v24, types: [com.google.android.gms.common.zzq] */ /* JADX WARN: Type inference failed for: r0v3, types: [java.lang.Object] */ /* JADX WARN: Type inference failed for: r4v1, types: [com.google.android.gms.dynamic.IObjectWrapper, android.os.IBinder] */ private static zzx zzi(String str, boolean z, boolean z2, boolean z3, boolean z4) { zzx zzd2; zzq zzf2; ?? allowThreadDiskReads = StrictMode.allowThreadDiskReads(); try { allowThreadDiskReads = Preconditions.checkNotNull(zzg); try { zzj(); zzo zzoVar = new zzo(str, z, false, ObjectWrapper.wrap(zzg), false, true); try { if (z4) { zzf2 = zze.zze(zzoVar); } else { zzf2 = zze.zzf(zzoVar); } allowThreadDiskReads = zzf2; if (allowThreadDiskReads.zzb()) { zzd2 = zzx.zzf(zzf2.zzc()); } else { String zza2 = zzf2.zza(); PackageManager.NameNotFoundException nameNotFoundException = zzf2.zzd() == 4 ? new PackageManager.NameNotFoundException() : null; if (zza2 == null) { zza2 = "error checking package certificate"; } zzd2 = zzx.zzg(zzf2.zzc(), zzf2.zzd(), zza2, nameNotFoundException); } } catch (RemoteException e) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e); zzd2 = zzx.zzd("module call", e); } } catch (DynamiteModule.LoadingException e2) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e2); zzd2 = zzx.zzd("module init: ".concat(String.valueOf(e2.getMessage())), e2); } StrictMode.setThreadPolicy(allowThreadDiskReads); return zzd2; } catch (Throwable th) { StrictMode.setThreadPolicy(th); throw allowThreadDiskReads; } } /* JADX INFO: Access modifiers changed from: package-private */ public static /* synthetic */ String zzd(boolean z, String str, zzj zzjVar) throws Exception { String str2 = true != (!z ? zzh(str, zzjVar, true, false).zza : false) ? "not allowed" : "debug cert rejected"; MessageDigest zza2 = AndroidUtilsLight.zza("SHA-256"); Preconditions.checkNotNull(zza2); return String.format("%s: pkg=%s, sha256=%s, atk=%s, ver=%s", str2, str, Hex.bytesToStringLowercase(zza2.digest(zzjVar.zzf())), Boolean.valueOf(z), "12451000.false"); } /* JADX INFO: Access modifiers changed from: package-private */ public static synchronized void zze(Context context) { if (zzg != null) { Log.w("GoogleCertificates", "GoogleCertificates has been initialized already"); } else if (context != null) { zzg = context.getApplicationContext(); } } private static void zzj() throws DynamiteModule.LoadingException { if (zze != null) { return; } Preconditions.checkNotNull(zzg); synchronized (zzf) { try { if (zze == null) { zze = zzaf.zzb(DynamiteModule.load(zzg, DynamiteModule.PREFER_HIGHEST_OR_LOCAL_VERSION_NO_FORCE_STAGING, "com.google.android.gms.googlecertificates").instantiate("com.google.android.gms.common.GoogleCertificatesImpl")); } } catch (Throwable th) { throw th; } } } /* JADX INFO: Access modifiers changed from: package-private */ /* JADX WARN: Multi-variable type inference failed */ /* JADX WARN: Type inference failed for: r0v0, types: [android.os.StrictMode$ThreadPolicy] */ /* JADX WARN: Type inference failed for: r0v4, types: [java.lang.Throwable] */ /* JADX WARN: Type inference failed for: r0v5, types: [android.os.StrictMode$ThreadPolicy] */ /* JADX WARN: Type inference failed for: r0v8, types: [boolean] */ public static boolean zzf() { boolean z; ?? allowThreadDiskReads = StrictMode.allowThreadDiskReads(); try { try { zzj(); allowThreadDiskReads = zze.zzg(); z = allowThreadDiskReads; } catch (RemoteException | DynamiteModule.LoadingException e) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e); z = false; } allowThreadDiskReads = allowThreadDiskReads; StrictMode.setThreadPolicy(allowThreadDiskReads); return z; } catch (Throwable th) { StrictMode.setThreadPolicy(th); throw allowThreadDiskReads; } } /* JADX INFO: Access modifiers changed from: package-private */ /* JADX WARN: Multi-variable type inference failed */ /* JADX WARN: Type inference failed for: r0v0, types: [android.os.StrictMode$ThreadPolicy] */ /* JADX WARN: Type inference failed for: r0v4, types: [java.lang.Throwable] */ /* JADX WARN: Type inference failed for: r0v5, types: [android.os.StrictMode$ThreadPolicy] */ /* JADX WARN: Type inference failed for: r0v8, types: [boolean] */ public static boolean zzg() { boolean z; ?? allowThreadDiskReads = StrictMode.allowThreadDiskReads(); try { try { zzj(); allowThreadDiskReads = zze.zzi(); z = allowThreadDiskReads; } catch (RemoteException | DynamiteModule.LoadingException e) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e); z = false; } allowThreadDiskReads = allowThreadDiskReads; StrictMode.setThreadPolicy(allowThreadDiskReads); return z; } catch (Throwable th) { StrictMode.setThreadPolicy(th); throw allowThreadDiskReads; } } }
加固后
// // Decompiled by Jadx - 1275ms // package com.google.android.gms.common; import android.content.Context; import android.content.ContextWrapper; import android.content.pm.PackageManager; import android.graphics.Color; import android.graphics.ImageFormat; import android.graphics.drawable.Drawable; import android.media.AudioTrack; import android.os.Process; import android.os.RemoteException; import android.os.StrictMode; import android.os.SystemClock; import android.telephony.cdma.CdmaCellLocation; import android.text.AndroidCharacter; import android.text.TextUtils; import android.util.Log; import android.util.TypedValue; import android.view.Gravity; import android.view.KeyEvent; import android.view.MotionEvent; import android.view.View; import android.view.ViewConfiguration; import android.widget.ExpandableListView; import android.widget.Toast; import com.bankmandiri.md.presentation.ui.MainActivity; import com.google.android.gms.common.internal.Preconditions; import com.google.android.gms.common.internal.zzae; import com.google.android.gms.common.internal.zzaf; import com.google.android.gms.common.util.AndroidUtilsLight; import com.google.android.gms.common.util.Hex; import com.google.android.gms.dynamic.ObjectWrapper; import com.google.android.gms.dynamite.DynamiteModule; import java.lang.reflect.Constructor; import java.lang.reflect.Field; import java.lang.reflect.Method; import java.security.MessageDigest; import java.util.ArrayList; import java.util.List; import java.util.Random; import o.abry; import o.fgk; final class zzn { private static int a; private static char b; private static char c; private static char d; private static char e; private static int f; static final zzl zza; static final zzl zzb; static final zzl zzc; static final zzl zzd; private static volatile zzaf zze; private static final Object zzf; private static Context zzg; private static final byte[] $$c = {90, 86, 85, 117}; private static final int $$f = 230; private static int $10 = 0; private static int $11 = 1; private static final byte[] $$d = {108, -48, 10, 71, -61, 55, 6, 25, -3, -73, 65, -61, 80, -10, 16, -80, 65, -61, 75, 2, -13, -58, 72, -61, 78, -7, -8, -57, 17, -61, 66, -1, -1, -58, 78}; private static final int $$e = 197; private static final byte[] $$a = {76, 125, 119, 121}; private static final int $$b = 211; private static int i = 0; private static int h = 1; /* JADX WARN: Removed duplicated region for block: B:10:0x0025 */ /* JADX WARN: Removed duplicated region for block: B:7:0x001f */ /* JADX WARN: Unsupported multi-entry loop pattern (BACK_EDGE: B:10:0x0025 -> B:4:0x002e). Please report as a decompilation issue!!! */ /* Code decompiled incorrectly, please refer to instructions dump. */ private static String $$g(short s, byte b2, byte b3) { int i2; int i3; int i4 = 3 - (b3 * 3); byte[] bArr = $$c; int i5 = (s * 3) + 121; int i6 = 1 - (b2 * 4); byte[] bArr2 = new byte[i6]; if (bArr == null) { int i7 = i4; int i8 = 0; int i9 = i6; i5 = (-i5) + i9; i4 = i7; i2 = i8; bArr2[i2] = (byte) i5; i3 = i2 + 1; if (i3 == i6) { return new String(bArr2, 0); } int i10 = i4 + 1; int i11 = bArr[i10]; i9 = i5; i5 = i11; i8 = i3; i7 = i10; i5 = (-i5) + i9; i4 = i7; i2 = i8; bArr2[i2] = (byte) i5; i3 = i2 + 1; if (i3 == i6) { } } else { i2 = 0; bArr2[i2] = (byte) i5; i3 = i2 + 1; if (i3 == i6) { } } } /* JADX WARN: Removed duplicated region for block: B:10:0x0024 */ /* JADX WARN: Removed duplicated region for block: B:7:0x001c */ /* JADX WARN: Unsupported multi-entry loop pattern (BACK_EDGE: B:10:0x0024 -> B:4:0x002a). Please report as a decompilation issue!!! */ /* Code decompiled incorrectly, please refer to instructions dump. */ private static void j(byte b2, short s, byte b3, Object[] objArr) { int i2; int i3; int i4 = 4 - (b2 * 3); int i5 = (s * 2) + 1; byte[] bArr = $$a; int i6 = 105 - b3; byte[] bArr2 = new byte[i5]; if (bArr == null) { int i7 = i5; int i8 = 0; i6 = (-i6) + i7; i4++; i2 = i8; bArr2[i2] = (byte) i6; i3 = i2 + 1; if (i3 == i5) { objArr[0] = new String(bArr2, 0); return; } i7 = i6; i6 = bArr[i4]; i8 = i3; i6 = (-i6) + i7; i4++; i2 = i8; bArr2[i2] = (byte) i6; i3 = i2 + 1; if (i3 == i5) { } } else { i2 = 0; bArr2[i2] = (byte) i6; i3 = i2 + 1; if (i3 == i5) { } } } /* JADX WARN: Removed duplicated region for block: B:10:0x001f */ /* JADX WARN: Removed duplicated region for block: B:7:0x0017 */ /* JADX WARN: Unsupported multi-entry loop pattern (BACK_EDGE: B:10:0x001f -> B:4:0x0028). Please report as a decompilation issue!!! */ /* Code decompiled incorrectly, please refer to instructions dump. */ private static void k(int i2, byte b2, byte b3, Object[] objArr) { int i3; int i4 = 111 - b3; int i5 = 35 - b2; byte[] bArr = $$d; byte[] bArr2 = new byte[i2 + 1]; if (bArr == null) { int i6 = i4; int i7 = 0; int i8 = i5; int i9 = (i6 + i5) - 4; int i10 = i8 + 1; i3 = i7; i4 = i9; i5 = i10; bArr2[i3] = (byte) i4; if (i3 == i2) { objArr[0] = new String(bArr2, 0); return; } int i11 = i4; i8 = i5; i5 = bArr[i5]; i7 = i3 + 1; i6 = i11; int i92 = (i6 + i5) - 4; int i102 = i8 + 1; i3 = i7; i4 = i92; i5 = i102; bArr2[i3] = (byte) i4; if (i3 == i2) { } } else { i3 = 0; bArr2[i3] = (byte) i4; if (i3 == i2) { } } } /* JADX WARN: Removed duplicated region for block: B:151:0x22c1 */ /* JADX WARN: Removed duplicated region for block: B:253:0x254c */ /* JADX WARN: Removed duplicated region for block: B:44:0x0e20 */ /* JADX WARN: Removed duplicated region for block: B:85:0x1a66 */ static { Object[] objArr; Integer num; String str; Integer num2; Object[] objArr2; int i2; Object[] objArr3; Object[] objArr4; String str2; String str3; Object[] objArr5; int i3; int i4; Object[] objArr6; int i5; int i6; Object[] objArr7; Object[] objArr8; char c2; Object[] objArr9; Object[] objArr10; Object[] objArr11; int i7; String str4; Object[] objArr12; Object[] objArr13; int i8; String str5; Object[] objArr14; Object[] objArr15; char c3; Object[] objArr16; int i9; int i10; Object[] objArr17; String str6; a = 0; f = 1; e(); Object[] objArr18 = new Object[1]; g(22 - (AudioTrack.getMinVolume() > 0.0f ? 1 : (AudioTrack.getMinVolume() == 0.0f ? 0 : -1)), new char[]{48209, 12547, 46926, 14005, 34564, 35826, 27495, 3912, 45663, 58859, 19095, 15679, 45587, 32642, 21020, 59965, 41331, 5668, 27745, 51509, 50595, 5719}, objArr18); String str7 = (String) objArr18[0]; Object[] objArr19 = new Object[1]; g(15 - (CdmaCellLocation.convertQuartSecToDecDegrees(0) > 0.0d ? 1 : (CdmaCellLocation.convertQuartSecToDecDegrees(0) == 0.0d ? 0 : -1)), new char[]{56018, 15997, 10462, 7192, 59879, 21601, 8852, 35605, 303, 25248, 38020, 31226, 2237, 64692, 63790, 11841}, objArr19); String str8 = (String) objArr19[0]; Object b2 = fgk.b(-1489550552); if (b2 == null) { char alpha = (char) (Color.alpha(0) + 31822); int makeMeasureSpec = 10472 - View.MeasureSpec.makeMeasureSpec(0, 0); int capsMode = 6 - TextUtils.getCapsMode("", 0, 0); byte b3 = (byte) 0; byte b4 = b3; Object[] objArr20 = new Object[1]; j(b3, b4, (byte) (b4 + 5), objArr20); b2 = fgk.d(alpha, makeMeasureSpec, capsMode, -1846490325, false, (String) objArr20[0], (Class[]) null); } long j = ((Field) b2).getLong(null); if (j == -1 || j + 1962 < ((Long) Class.forName(str7).getDeclaredMethod(str8, new Class[0]).invoke(null, new Object[0])).longValue()) { try { Object[] objArr21 = {0, 917504, -1022081157}; Object b5 = fgk.b(0x6c524511); if (b5 == null) { char c4 = (char) ((AudioTrack.getMaxVolume() > 0.0f ? 1 : (AudioTrack.getMaxVolume() == 0.0f ? 0 : -1)) + 31821); int maximumFlingVelocity = 10472 - (ViewConfiguration.getMaximumFlingVelocity() >> 16); int resolveSizeAndState = View.resolveSizeAndState(0, 0, 0) + 6; byte b6 = (byte) 0; byte b7 = b6; Object[] objArr22 = new Object[1]; j(b6, b7, (byte) (b7 | 8), objArr22); b5 = fgk.d(c4, maximumFlingVelocity, resolveSizeAndState, 0x5a95cd12, false, (String) objArr22[0], new Class[]{Integer.TYPE, Integer.TYPE, Integer.TYPE}); } objArr = (Object[]) ((Method) b5).invoke(null, objArr21); Object b8 = fgk.b(-1492321115); if (b8 == null) { char c5 = (char) (31823 - (Process.getElapsedCpuTime() > 0L ? 1 : (Process.getElapsedCpuTime() == 0L ? 0 : -1))); int myTid = 10472 - (Process.myTid() >> 22); int offsetAfter = TextUtils.getOffsetAfter("", 0) + 6; byte b9 = (byte) 0; byte b10 = b9; Object[] objArr23 = new Object[1]; j(b9, b10, (byte) (b10 | 8), objArr23); b8 = fgk.d(c5, myTid, offsetAfter, -1848937306, false, (String) objArr23[0], (Class[]) null); } ((Field) b8).set(null, objArr); try { Long valueOf = Long.valueOf(((Long) Class.forName(str7).getDeclaredMethod(str8, new Class[0]).invoke(null, new Object[0])).longValue()); Object b11 = fgk.b(-1489550552); if (b11 == null) { char packedPositionGroup = (char) (31822 - ExpandableListView.getPackedPositionGroup(0L)); int windowTouchSlop = (ViewConfiguration.getWindowTouchSlop() >> 8) + 10472; int makeMeasureSpec2 = View.MeasureSpec.makeMeasureSpec(0, 0) + 6; byte b12 = (byte) 0; byte b13 = b12; Object[] objArr24 = new Object[1]; j(b12, b13, (byte) (b13 + 5), objArr24); b11 = fgk.d(packedPositionGroup, windowTouchSlop, makeMeasureSpec2, -1846490325, false, (String) objArr24[0], (Class[]) null); } ((Field) b11).set(null, valueOf); } catch (Exception unused) { throw new RuntimeException(); } } catch (Throwable th) { Throwable cause = th.getCause(); if (cause == null) { throw th; } throw cause; } } else { Object b14 = fgk.b(-1492321115); if (b14 == null) { char c6 = (char) (31822 - (TypedValue.complexToFloat(0) > 0.0f ? 1 : (TypedValue.complexToFloat(0) == 0.0f ? 0 : -1))); int i11 = (SystemClock.elapsedRealtimeNanos() > 0L ? 1 : (SystemClock.elapsedRealtimeNanos() == 0L ? 0 : -1)) + 10471; int i12 = (ExpandableListView.getPackedPositionForGroup(0) > 0L ? 1 : (ExpandableListView.getPackedPositionForGroup(0) == 0L ? 0 : -1)) + 6; byte b15 = (byte) 0; byte b16 = b15; Object[] objArr25 = new Object[1]; j(b15, b16, (byte) (b16 | 8), objArr25); b14 = fgk.d(c6, i11, i12, -1848937306, false, (String) objArr25[0], (Class[]) null); } Object[] objArr26 = (Object[]) ((Field) b14).get(null); objArr = new Object[]{new int[1], new int[]{((int[]) objArr26[1])[0]}, new int[]{((int[]) objArr26[2])[0]}, (String[]) objArr26[3]}; int i13 = ~(((int) SystemClock.uptimeMillis()) | 0x1ca50e3a); int i14 = ((((0x57aed3b4 | i13) * (-658)) + 0x753e8b28) + ((i13 | 0x430ad184) * 658)) - 0x3cebb885; int i15 = (i14 << 13) ^ i14; int i16 = i15 ^ (i15 >>> 17); ((int[]) objArr[0])[0] = i16 ^ (i16 << 5); } int i17 = ((int[]) objArr[1])[0]; int i18 = ((int[]) objArr[2])[0]; if (i18 == i17) { int i19 = ((int[]) objArr[0])[0]; Object[] objArr27 = {new int[1], new int[]{((int[]) objArr[1])[0]}, new int[]{((int[]) objArr[2])[0]}, (String[]) objArr[3]}; int i20 = i19 + (((~(r7 | 0x53661697)) * 420) - 0x713aeebc) + (((~((~((int) Process.getElapsedCpuTime())) | 0x53661697)) | 0x10421411) * 420); int i21 = i20 ^ (i20 << 13); int i22 = i21 ^ (i21 >>> 17); ((int[]) objArr27[0])[0] = i22 ^ (i22 << 5); int i23 = ((int[]) objArr27[0])[0]; objArr2 = new Object[]{new int[1], new int[]{((int[]) objArr27[1])[0]}, new int[]{((int[]) objArr27[2])[0]}, (String[]) objArr27[3]}; num = 1; int startElapsedRealtime = (int) Process.getStartElapsedRealtime(); int i24 = (-1653884056) + ((~(startElapsedRealtime | 0x02313072)) * 216); int i25 = ~startElapsedRealtime; int i26 = i23 + i24 + (((-1699646213) | i25) * (-216)) + (((~(i25 | 0x02313072)) | 0x657fbb56) * 216); int i27 = i26 ^ (i26 << 13); int i28 = i27 ^ (i27 >>> 17); ((int[]) objArr2[0])[0] = i28 ^ (i28 << 5); num2 = 0; str = str7; i2 = 0; } else { num = 1; ArrayList arrayList = new ArrayList(); String[] strArr = (String[]) objArr[3]; if (strArr != null) { int i29 = a + 55; f = i29 % 128; for (int i30 = i29 % 2 == 0 ? 1 : 0; i30 < strArr.length; i30++) { arrayList.add(strArr[i30]); } } Object[] objArr28 = objArr; long j2 = i17 ^ i18; str = str7; num2 = 0; long j3 = -1; long j4 = 0; long j5 = (((j3 - ((j3 >> 63) << 32)) | (0 << 32)) & j2) | (j4 - ((j4 >> 63) << 32)) | (1 << 32); Object b17 = fgk.b(0x20d9a7e6); if (b17 == null) { b17 = fgk.d((char) Gravity.getAbsoluteGravity(0, 0), (ViewConfiguration.getKeyRepeatDelay() >> 16) + 11314, TextUtils.indexOf((CharSequence) "", '0') + 7, 0x161e2fe5, false, "c", new Class[0]); } Object invoke = ((Method) b17).invoke(null, null); Object[] objArr29 = {1252794371, Long.valueOf(j5), arrayList, MainActivity.B(), false}; Object b18 = fgk.b(-185514598); if (b18 == null) { b18 = fgk.d((char) (17651 - Gravity.getAbsoluteGravity(0, 0)), 11307 - ImageFormat.getBitsPerPixel(0), (AudioTrack.getMaxVolume() > 0.0f ? 1 : (AudioTrack.getMaxVolume() == 0.0f ? 0 : -1)) + 5, -1036595815, false, "c", new Class[]{Integer.TYPE, Long.TYPE, List.class, String.class, Boolean.TYPE}); } ((Method) b18).invoke(invoke, objArr29); int i31 = ((int[]) objArr28[0])[0]; Object[] objArr30 = {new int[1], new int[]{((int[]) objArr28[1])[0]}, new int[]{((int[]) objArr28[2])[0]}, (String[]) objArr28[3]}; int nextInt = new Random().nextInt(0x3b990b90); int i32 = ~nextInt; int i33 = i31 + (-296065121) + (((~((-61500414) | i32)) | 0x64067fcb) * (-602)) + (((~(nextInt | (-61500414))) | 158665 | (~(0x67ae7fff | i32))) * (-301)) + ((~(i32 | 0x64067fcb)) * 301); int i34 = (i33 << 13) ^ i33; int i35 = i34 ^ (i34 >>> 17); ((int[]) objArr30[0])[0] = i35 ^ (i35 << 5); int[] iArr = new int[i18]; int i36 = i18 - 1; iArr[i36] = 1; Toast.makeText((Context) null, iArr[((i36 * i18) % 2) - 1], 1).show(); int i37 = ((int[]) objArr30[0])[0]; objArr2 = new Object[]{new int[1], new int[]{((int[]) objArr30[1])[0]}, new int[]{((int[]) objArr30[2])[0]}, (String[]) objArr30[3]}; int freeMemory = (int) Runtime.getRuntime().freeMemory(); int i38 = i37 + 0x0cdecaa0 + (((~((-809505867) | freeMemory)) | (~((~freeMemory) | 0x3770d77e))) * (-318)) + (((~(0x3260d75a | freeMemory)) | 0x05100024) * (-318)) + (((~(freeMemory | (-845207387))) | (-894440559)) * 318); int i39 = (i38 << 13) ^ i38; int i40 = i39 ^ (i39 >>> 17); i2 = 0; ((int[]) objArr2[0])[0] = i40 ^ (i40 << 5); } Object b19 = fgk.b(-283824105); if (b19 == null) { char c7 = (char) (ExpandableListView.getPackedPositionForGroup(i2) > 0L ? 1 : (ExpandableListView.getPackedPositionForGroup(i2) == 0L ? 0 : -1)); int longPressTimeout = (ViewConfiguration.getLongPressTimeout() >> 16) + 10336; int red = 6 - Color.red(i2); byte b20 = (byte) i2; Object[] objArr31 = new Object[1]; j(b20, b20, (byte) $$a.length, objArr31); b19 = fgk.d(c7, longPressTimeout, red, -640501740, false, (String) objArr31[i2], (Class[]) null); } long j6 = ((Field) b19).getLong(null); if (j6 == -1 || j6 + 1942 < ((Long) Class.forName(str).getDeclaredMethod(str8, new Class[0]).invoke(null, new Object[0])).longValue()) { Object[] objArr32 = new Object[1]; g((ViewConfiguration.getPressedStateDuration() >> 16) + 26, new char[]{48209, 12547, 46926, 14005, 34564, 35826, 27495, 3912, 10462, 7192, 13819, 23397, 40833, 65393, 5081, 15287, 24927, 59908, 11411, 38206, 55817, 11307, 61942, 40364, 51137, 53773}, objArr32); Class<?> cls = Class.forName((String) objArr32[0]); Object[] objArr33 = new Object[1]; g(17 - TextUtils.indexOf((CharSequence) "", '0', 0, 0), new char[]{4718, 24663, 39270, 61010, 63481, 54593, 12901, 8078, 16086, 61921, 36784, 58417, 48496, 48526, 5081, 15287, 40329, 48930}, objArr33); Context context = (Context) cls.getMethod((String) objArr33[0], new Class[0]).invoke(null, null); if (context != null) { if ((context instanceof ContextWrapper) && ((ContextWrapper) context).getBaseContext() == null) { int i41 = 2 % 2; context = null; } else { context = context.getApplicationContext(); } } Object[] objArr34 = new Object[1]; g(64 - View.resolveSize(0, 0), new char[]{52819, 38996, 42972, 64302, 23018, 59786, 28847, 34289, 61063, 52199, 1502, 14952, 50714, 208, 15254, 38769, 29674, 46192, 15254, 38769, 42103, 62255, 21883, 53534, 32507, 59520, 8408, 23281, 1020, 28119, 29942, 25011, 41453, 56202, 21004, 61216, 5824, 15115, 49234, 27973, 4088, 46683, 8714, 45766, 56502, 5542, 41242, 17341, 41242, 17341, 11768, 48644, 2354, 52387, 60932, 55036, 56772, 24075, 18499, 8988, 53766, 56625, 38864, 7758}, objArr34); String str9 = (String) objArr34[0]; Object[] objArr35 = new Object[1]; g(ExpandableListView.getPackedPositionChild(0L) + 65, new char[]{52819, 38996, 42972, 64302, 23018, 59786, 28847, 34289, 61063, 52199, 1502, 14952, 50714, 208, 15254, 38769, 29674, 46192, 15254, 38769, 42103, 62255, 21883, 53534, 32507, 59520, 8408, 23281, 1020, 28119, 29942, 25011, 41453, 56202, 21004, 61216, 5824, 15115, 49234, 27973, 4088, 46683, 8714, 45766, 56502, 5542, 41242, 17341, 41242, 17341, 11768, 48644, 2354, 52387, 60932, 55036, 56772, 24075, 18499, 8988, 53766, 56625, 38864, 7758}, objArr35); try { Object[] objArr36 = {context, new String[]{str9, (String) objArr35[0]}, num2, 2, -2062752758}; byte[] bArr = $$d; byte b21 = (byte) (-bArr[25]); Object[] objArr37 = new Object[1]; k(b21, (byte) (b21 | 24), (byte) (bArr[31] + 1), objArr37); Class<?> cls2 = Class.forName((String) objArr37[0]); byte b22 = (byte) (bArr[31] + 1); Object[] objArr38 = new Object[1]; k(b22, (byte) (b22 | 24), (byte) (bArr[2] + 1), objArr38); objArr3 = (Object[]) cls2.getMethod((String) objArr38[0], Context.class, String[].class, Integer.TYPE, Integer.TYPE, Integer.TYPE).invoke(null, objArr36); int i42 = ((int[]) objArr3[0])[0]; int i43 = ((int[]) objArr3[2])[0]; if (context != null) { Object b23 = fgk.b(-285671147); if (b23 == null) { char c8 = (char) (CdmaCellLocation.convertQuartSecToDecDegrees(0) > 0.0d ? 1 : (CdmaCellLocation.convertQuartSecToDecDegrees(0) == 0.0d ? 0 : -1)); int bitsPerPixel = ImageFormat.getBitsPerPixel(0) + 10337; int scrollBarSize = (ViewConfiguration.getScrollBarSize() >> 8) + 6; byte b24 = (byte) 0; byte b25 = b24; Object[] objArr39 = new Object[1]; j(b24, b25, (byte) (b25 | 6), objArr39); b23 = fgk.d(c8, bitsPerPixel, scrollBarSize, -666990314, false, (String) objArr39[0], (Class[]) null); } ((Field) b23).set(null, objArr3); try { Long valueOf2 = Long.valueOf(((Long) Class.forName(str).getDeclaredMethod(str8, new Class[0]).invoke(null, new Object[0])).longValue()); Object b26 = fgk.b(-283824105); if (b26 == null) { int mirror = 10384 - AndroidCharacter.getMirror('0'); int i44 = (ExpandableListView.getPackedPositionForChild(0, 0) > 0L ? 1 : (ExpandableListView.getPackedPositionForChild(0, 0) == 0L ? 0 : -1)) + 7; byte b27 = (byte) 0; Object[] objArr40 = new Object[1]; j(b27, b27, (byte) $$a.length, objArr40); b26 = fgk.d((char) ((SystemClock.elapsedRealtimeNanos() > 0L ? 1 : (SystemClock.elapsedRealtimeNanos() == 0L ? 0 : -1)) - 1), mirror, i44, -640501740, false, (String) objArr40[0], (Class[]) null); } ((Field) b26).set(null, valueOf2); } catch (Exception unused2) { throw new RuntimeException(); } } } catch (Throwable th2) { Throwable cause2 = th2.getCause(); if (cause2 == null) { throw th2; } throw cause2; } } else { Object b28 = fgk.b(-285671147); if (b28 == null) { char c9 = (char) (1 - (SystemClock.uptimeMillis() > 0L ? 1 : (SystemClock.uptimeMillis() == 0L ? 0 : -1))); int i45 = 10337 - (ViewConfiguration.getZoomControlsTimeout() > 0L ? 1 : (ViewConfiguration.getZoomControlsTimeout() == 0L ? 0 : -1)); int i46 = 7 - (SystemClock.elapsedRealtime() > 0L ? 1 : (SystemClock.elapsedRealtime() == 0L ? 0 : -1)); byte b29 = (byte) 0; byte b30 = b29; Object[] objArr41 = new Object[1]; j(b29, b30, (byte) (b30 | 6), objArr41); b28 = fgk.d(c9, i45, i46, -666990314, false, (String) objArr41[0], (Class[]) null); } Object[] objArr42 = (Object[]) ((Field) b28).get(null); int i47 = ((int[]) objArr42[2])[0]; int i48 = ((int[]) objArr42[0])[0]; String[] strArr2 = (String[]) objArr42[3]; int[] iArr2 = {i47}; int nextInt2 = new Random().nextInt(); int i49 = ((0x76055047 + (((~((-381584302) | nextInt2)) | 0x097d256a) * (-366))) + (((~(nextInt2 | (-377651846))) | 0x09412442) * 366)) - 0x7af31bf6; int i50 = (i49 << 13) ^ i49; int i51 = i50 ^ (i50 >>> 17); ((int[]) objArr3[1])[0] = i51 ^ (i51 << 5); objArr3 = new Object[]{new int[]{i48}, new int[1], iArr2, strArr2}; } int i52 = ((int[]) objArr3[0])[0]; int i53 = ((int[]) objArr3[2])[0]; if (i53 == i52) { int i54 = f + 43; a = i54 % 128; int i55 = i54 % 2; int i56 = ((int[]) objArr3[1])[0]; int i57 = ((int[]) objArr3[2])[0]; int i58 = ((int[]) objArr3[0])[0]; String[] strArr3 = (String[]) objArr3[3]; int[] iArr3 = {i57}; int elapsedRealtime = (int) SystemClock.elapsedRealtime(); int i59 = i56 + (-668470957) + (((~(elapsedRealtime | 0x0c93b9ed)) | 0x13a7ef2a) * 191) + (((~((~elapsedRealtime) | 0x0c93b9ed)) | 0x13244602) * 191); int i60 = i59 ^ (i59 << 13); int i61 = i60 ^ (i60 >>> 17); ((int[]) r2[1])[0] = i61 ^ (i61 << 5); Object[] objArr43 = {new int[]{i58}, new int[1], iArr3, strArr3}; int i62 = ((int[]) objArr43[1])[0]; int i63 = ((int[]) objArr43[2])[0]; int[] iArr4 = {((int[]) objArr43[0])[0]}; int nextInt3 = new Random().nextInt(); int i64 = i62 + (-2024792096) + (((~(nextInt3 | 0x3fde7783)) | 2132072) * 305) + (((~((~nextInt3) | 0x3fde7783)) | 0x1fa2ce6b) * 305); int i65 = (i64 << 13) ^ i64; int i66 = i65 ^ (i65 >>> 17); ((int[]) objArr5[1])[0] = i66 ^ (i66 << 5); objArr5 = new Object[]{iArr4, new int[1], new int[]{i63}, strArr3}; objArr4 = objArr2; str2 = str8; str3 = ""; i3 = 0; } else { ArrayList arrayList2 = new ArrayList(); String[] strArr4 = (String[]) objArr3[3]; if (strArr4 != null) { for (String str10 : strArr4) { arrayList2.add(str10); } } objArr4 = objArr2; str2 = str8; long j7 = -1; long j8 = 0; long j9 = ((i53 ^ i52) & ((0 << 32) | (j7 - ((j7 >> 63) << 32)))) | (8 << 32) | (j8 - ((j8 >> 63) << 32)); Object b31 = fgk.b(0x20d9a7e6); if (b31 == null) { b31 = fgk.d((char) (TypedValue.complexToFloat(0) > 0.0f ? 1 : (TypedValue.complexToFloat(0) == 0.0f ? 0 : -1)), 11314 - (KeyEvent.getMaxKeyCode() >> 16), 5 - (ExpandableListView.getPackedPositionForChild(0, 0) > 0L ? 1 : (ExpandableListView.getPackedPositionForChild(0, 0) == 0L ? 0 : -1)), 0x161e2fe5, false, "c", new Class[0]); } Object invoke2 = ((Method) b31).invoke(null, null); Object[] objArr44 = {1252794371, Long.valueOf(j9), arrayList2, MainActivity.B(), false}; Object b32 = fgk.b(-185514598); if (b32 == null) { str3 = ""; b32 = fgk.d((char) ((TypedValue.complexToFloat(0) > 0.0f ? 1 : (TypedValue.complexToFloat(0) == 0.0f ? 0 : -1)) + 17651), 11307 - TextUtils.lastIndexOf(str3, '0'), 6 - (TypedValue.complexToFloat(0) > 0.0f ? 1 : (TypedValue.complexToFloat(0) == 0.0f ? 0 : -1)), -1036595815, false, "c", new Class[]{Integer.TYPE, Long.TYPE, List.class, String.class, Boolean.TYPE}); } else { str3 = ""; } ((Method) b32).invoke(invoke2, objArr44); int i67 = ((int[]) objArr3[1])[0]; int i68 = ((int[]) objArr3[2])[0]; int i69 = ((int[]) objArr3[0])[0]; String[] strArr5 = (String[]) objArr3[3]; int maxMemory = (int) Runtime.getRuntime().maxMemory(); int i70 = i67 + ((((-973838435) + (((~maxMemory) | 8702280) * 1324)) + (((~(maxMemory | 0x0794dd4b)) | (~(0x18a6cbcc | maxMemory))) * (-1324))) - 0x5479bee6); int i71 = i70 ^ (i70 << 13); int i72 = i71 ^ (i71 >>> 17); ((int[]) r2[1])[0] = i72 ^ (i72 << 5); Object[] objArr45 = {new int[]{i69}, new int[1], new int[]{i68}, strArr5}; int[] iArr5 = new int[i53]; int i73 = i53 - 1; iArr5[i73] = 1; Toast.makeText((Context) null, iArr5[((i53 * i73) % 2) - 1], 1).show(); int i74 = ((int[]) objArr45[1])[0]; int i75 = ((int[]) objArr45[2])[0]; int i76 = ((int[]) objArr45[0])[0]; String[] strArr6 = (String[]) objArr45[3]; int[] iArr6 = {i75}; int elapsedCpuTime = (int) Process.getElapsedCpuTime(); int i77 = ~elapsedCpuTime; int i78 = i74 + 0x4cfa7a57 + ((0x0e124496 | i77) * (-192)) + (((~((-287882050) | i77)) | 0x0100a940) * (-384)) + (((~(elapsedCpuTime | 0x1f3affd7)) | (~(i77 | (-271061506))) | (~((-16820545) | elapsedCpuTime))) * 192); int i79 = (i78 << 13) ^ i78; int i80 = i79 ^ (i79 >>> 17); i3 = 0; ((int[]) objArr5[1])[0] = i80 ^ (i80 << 5); objArr5 = new Object[]{new int[]{i76}, new int[1], iArr6, strArr6}; } Object b33 = fgk.b(0x2c5e649b); if (b33 == null) { char c10 = (char) (TypedValue.complexToFloat(i3) > 0.0f ? 1 : (TypedValue.complexToFloat(i3) == 0.0f ? 0 : -1)); int indexOf = 10398 - TextUtils.indexOf(str3, str3); int i81 = 7 - (ViewConfiguration.getScrollFriction() > 0.0f ? 1 : (ViewConfiguration.getScrollFriction() == 0.0f ? 0 : -1)); byte b34 = (byte) i3; byte b35 = b34; Object[] objArr46 = new Object[1]; j(b34, b35, (byte) (b35 | 6), objArr46); b33 = fgk.d(c10, indexOf, i81, 0x1a99ec98, false, (String) objArr46[i3], (Class[]) null); } long j10 = ((Field) b33).getLong(null); if (j10 != -1) { int i82 = a + 5; f = i82 % 128; int i83 = i82 % 2; if (j10 + 1997 >= ((Long) Class.forName(str).getDeclaredMethod(str2, new Class[0]).invoke(null, new Object[0])).longValue()) { Object b36 = fgk.b(0x2c6c7c1c); if (b36 == null) { char pressedStateDuration = (char) (ViewConfiguration.getPressedStateDuration() >> 16); int packedPositionGroup2 = 10398 - ExpandableListView.getPackedPositionGroup(0L); int threadPriority = 6 - ((Process.getThreadPriority(0) + 20) >> 6); byte b37 = (byte) 0; byte b38 = b37; Object[] objArr47 = new Object[1]; j(b37, b38, (byte) (b38 + 5), objArr47); b36 = fgk.d(pressedStateDuration, packedPositionGroup2, threadPriority, 0x1aabf41f, false, (String) objArr47[0], (Class[]) null); } Object[] objArr48 = (Object[]) ((Field) b36).get(null); objArr6 = new Object[]{r7, r1, new int[1], r9}; int i84 = ((int[]) objArr48[3])[0]; int i85 = ((int[]) objArr48[0])[0]; String str11 = (String) objArr48[1]; int[] iArr7 = {i84}; int[] iArr8 = {i85}; int myTid2 = Process.myTid(); int i86 = (((-1668211639) + (((-16846861) | (~myTid2)) * (-490))) + (((~(myTid2 | (-185177117))) | 0x0a088410) * 490)) - 0x69af2edc; int i87 = (i86 << 13) ^ i86; int i88 = i87 ^ (i87 >>> 17); ((int[]) objArr6[2])[0] = i88 ^ (i88 << 5); int i89 = f + 33; a = i89 % 128; int i90 = i89 % 2; int i91 = 2 % 2; i5 = ((int[]) objArr6[0])[0]; i6 = ((int[]) objArr6[3])[0]; if (i6 == i5) { long j11 = -1; long j12 = (i6 ^ i5) & ((0 << 32) | (j11 - ((j11 >> 63) << 32))); long j13 = 0; long j14 = j12 | (5 << 32) | (j13 - ((j13 >> 63) << 32)); Object b39 = fgk.b(0x20d9a7e6); if (b39 == null) { b39 = fgk.d((char) (AndroidCharacter.getMirror('0') - '0'), (ViewConfiguration.getZoomControlsTimeout() > 0L ? 1 : (ViewConfiguration.getZoomControlsTimeout() == 0L ? 0 : -1)) + 11313, (SystemClock.uptimeMillis() > 0L ? 1 : (SystemClock.uptimeMillis() == 0L ? 0 : -1)) + 5, 0x161e2fe5, false, "c", new Class[0]); } Object invoke3 = ((Method) b39).invoke(null, null); Object[] objArr49 = {1252794371, Long.valueOf(j14), new ArrayList(), MainActivity.B(), false}; Object b40 = fgk.b(-185514598); if (b40 == null) { b40 = fgk.d((char) (AndroidCharacter.getMirror('0') + 17603), 11308 - View.MeasureSpec.getMode(0), (AudioTrack.getMaxVolume() > 0.0f ? 1 : (AudioTrack.getMaxVolume() == 0.0f ? 0 : -1)) + 5, -1036595815, false, "c", new Class[]{Integer.TYPE, Long.TYPE, List.class, String.class, Boolean.TYPE}); } ((Method) b40).invoke(invoke3, objArr49); Object[] objArr50 = {r2, r4, new int[1], r5}; int i92 = ((int[]) objArr6[2])[0]; int i93 = ((int[]) objArr6[3])[0]; int i94 = ((int[]) objArr6[0])[0]; String str12 = (String) objArr6[1]; int[] iArr9 = {i93}; int[] iArr10 = {i94}; int startUptimeMillis = (int) Process.getStartUptimeMillis(); int i95 = ~startUptimeMillis; int i96 = i92 + (-317278573) + (((~((-766349891) | i95)) | 0x20ad1040 | (~(0x1d108316 | i95))) * (-1136)) + (((~((-766349891) | startUptimeMillis)) | (~(0x1d108316 | startUptimeMillis)) | (~((-269484309) | i95))) * (-568)) + (((~(startUptimeMillis | (-548212801))) | (~(i95 | (-487621399))) | (~(0x2dad9242 | i95))) * 568); int i97 = (i96 << 13) ^ i96; int i98 = i97 ^ (i97 >>> 17); ((int[]) objArr50[2])[0] = i98 ^ (i98 << 5); throw new RuntimeException(String.valueOf(i6)); } Object[] objArr51 = {r8, r4, new int[1], r9}; int i99 = ((int[]) objArr6[2])[0]; int i100 = ((int[]) objArr6[3])[0]; int i101 = ((int[]) objArr6[0])[0]; String str13 = (String) objArr6[1]; int[] iArr11 = {i100}; int[] iArr12 = {i101}; int i102 = ~((int) Runtime.getRuntime().maxMemory()); int i103 = i99 + 0x5cf5677f + ((~((-10748501) | i102)) * 52) + (((~(0x1b43d581 | i102)) | (~(0x0aa6c655 | i102)) | (-468178902)) * (-52)) + (((~(i102 | (-457430402))) | 0x0a02c401) * 52); int i104 = (i103 << 13) ^ i103; int i105 = i104 ^ (i104 >>> 17); ((int[]) objArr51[2])[0] = i105 ^ (i105 << 5); Object[] objArr52 = {r5, r2, new int[1], r9}; int i106 = ((int[]) objArr51[2])[0]; int i107 = ((int[]) objArr51[3])[0]; int i108 = ((int[]) objArr51[0])[0]; String str14 = (String) objArr51[1]; int[] iArr13 = {i107}; int[] iArr14 = {i108}; int nextInt4 = new Random().nextInt(); int i109 = (-991159680) + (((~((~nextInt4) | 0x211f05f9)) | (-834606590)) * (-245)); int i110 = ~(nextInt4 | 0x211f05f9); int i111 = i106 + i109 + (i110 * (-245)) + ((i110 | 0x31bc1525) * 245); int i112 = (i111 << 13) ^ i111; int i113 = i112 ^ (i112 >>> 17); ((int[]) objArr52[2])[0] = i113 ^ (i113 << 5); Object b41 = fgk.b(0x2cb2f1a1); if (b41 == null) { char threadPriority2 = (char) ((Process.getThreadPriority(0) + 20) >> 6); int indexOf2 = TextUtils.indexOf((CharSequence) str3, '0') + 10399; int indexOf3 = 6 - TextUtils.indexOf(str3, str3, 0); byte b42 = (byte) 0; byte b43 = b42; Object[] objArr53 = new Object[1]; j(b42, b43, b43, objArr53); b41 = fgk.d(threadPriority2, indexOf2, indexOf3, 0x1a7579a2, false, (String) objArr53[0], (Class[]) null); } long j15 = ((Field) b41).getLong(null); if (j15 == -1 || j15 + 1918 < ((Long) Class.forName(str).getDeclaredMethod(str2, new Class[0]).invoke(null, new Object[0])).longValue()) { byte[] bArr2 = $$d; Object[] objArr54 = new Object[1]; k(bArr2[6], (byte) (bArr2[28] + 1), (byte) (bArr2[31] + 1), objArr54); Class<?> cls3 = Class.forName((String) objArr54[0]); byte b44 = (byte) (bArr2[31] + 1); byte b45 = (byte) (b44 | 12); Object[] objArr55 = new Object[1]; k(b44, b45, b45, objArr55); Object[] objArr56 = (Object[]) cls3.getMethod((String) objArr55[0], Integer.TYPE, Integer.TYPE).invoke(null, num2, 0x6ea27267); Object b46 = fgk.b(0x2c96c29f); if (b46 == null) { char maximumDrawingCacheSize = (char) (ViewConfiguration.getMaximumDrawingCacheSize() >> 24); int i114 = 10399 - (SystemClock.elapsedRealtime() > 0L ? 1 : (SystemClock.elapsedRealtime() == 0L ? 0 : -1)); int mirror2 = '6' - AndroidCharacter.getMirror('0'); byte b47 = (byte) 0; byte b48 = b47; Object[] objArr57 = new Object[1]; j(b47, b48, (byte) (b48 + 2), objArr57); b46 = fgk.d(maximumDrawingCacheSize, i114, mirror2, 0x1a514a9c, false, (String) objArr57[0], (Class[]) null); } ((Field) b46).set(null, objArr56); try { Long valueOf3 = Long.valueOf(((Long) Class.forName(str).getDeclaredMethod(str2, new Class[0]).invoke(null, new Object[0])).longValue()); Object b49 = fgk.b(0x2cb2f1a1); if (b49 == null) { char doubleTapTimeout = (char) (ViewConfiguration.getDoubleTapTimeout() >> 16); int i115 = 10399 - (ViewConfiguration.getScrollFriction() > 0.0f ? 1 : (ViewConfiguration.getScrollFriction() == 0.0f ? 0 : -1)); int keyCodeFromString = 6 - KeyEvent.keyCodeFromString(str3); byte b50 = (byte) 0; byte b51 = b50; objArr7 = objArr56; Object[] objArr58 = new Object[1]; j(b50, b51, b51, objArr58); b49 = fgk.d(doubleTapTimeout, i115, keyCodeFromString, 0x1a7579a2, false, (String) objArr58[0], (Class[]) null); } else { objArr7 = objArr56; } ((Field) b49).set(null, valueOf3); objArr8 = objArr7; c2 = 0; } catch (Exception unused3) { throw new RuntimeException(); } } else { Object b52 = fgk.b(0x2c96c29f); if (b52 == null) { char packedPositionChild = (char) ((-1) - ExpandableListView.getPackedPositionChild(0L)); int makeMeasureSpec3 = View.MeasureSpec.makeMeasureSpec(0, 0) + 10398; int windowTouchSlop2 = 6 - (ViewConfiguration.getWindowTouchSlop() >> 8); byte b53 = (byte) 0; byte b54 = b53; Object[] objArr59 = new Object[1]; j(b53, b54, (byte) (b54 + 2), objArr59); b52 = fgk.d(packedPositionChild, makeMeasureSpec3, windowTouchSlop2, 0x1a514a9c, false, (String) objArr59[0], (Class[]) null); } Object[] objArr60 = (Object[]) ((Field) b52).get(null); objArr8 = new Object[]{r5, r1, new int[1], r9}; int i116 = ((int[]) objArr60[3])[0]; int i117 = ((int[]) objArr60[0])[0]; String str15 = (String) objArr60[1]; int[] iArr15 = {i116}; int[] iArr16 = {i117}; int myPid = Process.myPid(); int i118 = (-1393320392) + (((~((-933394076) | myPid)) | 0x10a21090) * 345) + (((~((-933394076) | (~myPid))) | (-933722112)) * 345) + ((~(myPid | (-279056529))) * 345) + 0x6ea27267; int i119 = (i118 << 13) ^ i118; int i120 = i119 ^ (i119 >>> 17); ((int[]) objArr8[2])[0] = i120 ^ (i120 << 5); c2 = 0; } int i121 = ((int[]) objArr8[c2])[c2]; int i122 = ((int[]) objArr8[3])[c2]; if (i122 != i121) { String str16 = str3; ArrayList arrayList3 = new ArrayList(); arrayList3.add((String) objArr8[1]); long j16 = -1; long j17 = 0; long j18 = ((i122 ^ i121) & ((0 << 32) | (j16 - ((j16 >> 63) << 32)))) | (6 << 32) | (j17 - ((j17 >> 63) << 32)); Object b55 = fgk.b(0x20d9a7e6); if (b55 == null) { b55 = fgk.d((char) View.MeasureSpec.getMode(0), (Process.myPid() >> 22) + 11314, 6 - (ViewConfiguration.getDoubleTapTimeout() >> 16), 0x161e2fe5, false, "c", new Class[0]); } Object invoke4 = ((Method) b55).invoke(null, null); Object[] objArr61 = {1252794371, Long.valueOf(j18), arrayList3, MainActivity.B(), false}; Object b56 = fgk.b(-185514598); if (b56 == null) { b56 = fgk.d((char) (View.resolveSize(0, 0) + 17651), Drawable.resolveOpacity(0, 0) + 11308, 5 - TextUtils.lastIndexOf(str16, '0'), -1036595815, false, "c", new Class[]{Integer.TYPE, Long.TYPE, List.class, String.class, Boolean.TYPE}); } ((Method) b56).invoke(invoke4, objArr61); Object[] objArr62 = {r2, r4, new int[1], r5}; int i123 = ((int[]) objArr8[2])[0]; int i124 = ((int[]) objArr8[3])[0]; int i125 = ((int[]) objArr8[0])[0]; String str17 = (String) objArr8[1]; int[] iArr17 = {i124}; int[] iArr18 = {i125}; int i126 = (int) Runtime.getRuntime().totalMemory(); int i127 = ~i126; int i128 = i123 + (-864275165) + (((~(0x0c4ba862 | i127)) | 1066633) * 184) + ((i126 | 0x080a8822) * (-184)) + ((~((-72443594) | i127)) * 184); int i129 = (i128 << 13) ^ i128; int i130 = i129 ^ (i129 >>> 17); ((int[]) objArr62[2])[0] = i130 ^ (i130 << 5); throw new RuntimeException(String.valueOf(i122)); } Object[] objArr63 = new Object[4]; int[] iArr19 = new int[1]; objArr63[c2] = iArr19; objArr63[2] = new int[1]; int[] iArr20 = new int[1]; objArr63[3] = iArr20; int i131 = ((int[]) objArr8[2])[c2]; int i132 = ((int[]) objArr8[3])[c2]; int i133 = ((int[]) objArr8[c2])[c2]; String str18 = (String) objArr8[1]; iArr20[c2] = i132; iArr19[c2] = i133; objArr63[1] = str18; int elapsedRealtime2 = (int) SystemClock.elapsedRealtime(); int i134 = ~elapsedRealtime2; int i135 = (~((-224068681) | i134)) | 0x0c190408 | (~(0x03420ae3 | i134)); int i136 = i131 + 0x562bd5f1 + (((~(elapsedRealtime2 | (-33557156))) | i135) * 590) + (i135 * (-1180)) + (((~((-54659812) | i134)) | (~(i134 | 0x0d5b0448))) * 590); int i137 = (i136 << 13) ^ i136; int i138 = i137 ^ (i137 >>> 17); ((int[]) objArr63[2])[0] = i138 ^ (i138 << 5); Object[] objArr64 = {r5, r2, new int[1], r11}; int i139 = ((int[]) objArr63[2])[0]; int i140 = ((int[]) objArr63[3])[0]; int i141 = ((int[]) objArr63[0])[0]; String str19 = (String) objArr63[1]; int[] iArr21 = {i140}; int[] iArr22 = {i141}; int maxMemory2 = (int) Runtime.getRuntime().maxMemory(); int i142 = (-750272367) + ((maxMemory2 | 0x0292cbeb) * (-50)); int i143 = ~((-33702721) | maxMemory2); int i144 = ~maxMemory2; int i145 = i139 + i142 + ((i143 | (~((-201850881) | i144))) * 50) + (((~(i144 | 0x0292cbeb)) | (~((-235553601) | i144)) | 0x0c080000) * 50); int i146 = (i145 << 13) ^ i145; int i147 = i146 ^ (i146 >>> 17); ((int[]) objArr64[2])[0] = i147 ^ (i147 << 5); Object b57 = fgk.b(0x2c7a939d); if (b57 == null) { char indexOf4 = (char) TextUtils.indexOf(str3, str3, 0, 0); int indexOf5 = TextUtils.indexOf(str3, str3, 0) + 10398; int myTid3 = 6 - (Process.myTid() >> 22); byte b58 = (byte) 0; Object[] objArr65 = new Object[1]; j(b58, b58, (byte) $$a.length, objArr65); b57 = fgk.d(indexOf4, indexOf5, myTid3, 0x1abd1b9e, false, (String) objArr65[0], (Class[]) null); } long j19 = ((Field) b57).getLong(null); if (j19 == -1 || j19 + 1957 < ((Long) Class.forName(str).getDeclaredMethod(str2, new Class[0]).invoke(null, new Object[0])).longValue()) { Object[] objArr66 = new Object[1]; g(KeyEvent.getDeadChar(0, 0) + 26, new char[]{48209, 12547, 46926, 14005, 34564, 35826, 27495, 3912, 10462, 7192, 13819, 23397, 40833, 65393, 5081, 15287, 24927, 59908, 11411, 38206, 55817, 11307, 61942, 40364, 51137, 53773}, objArr66); Class<?> cls4 = Class.forName((String) objArr66[0]); Object[] objArr67 = new Object[1]; g(18 - Color.red(0), new char[]{4718, 24663, 39270, 61010, 63481, 54593, 12901, 8078, 16086, 61921, 36784, 58417, 48496, 48526, 5081, 15287, 40329, 48930}, objArr67); Context context2 = (Context) cls4.getMethod((String) objArr67[0], new Class[0]).invoke(null, null); if (context2 != null) { context2 = ((context2 instanceof ContextWrapper) && ((ContextWrapper) context2).getBaseContext() == null) ? null : context2.getApplicationContext(); } byte[] bArr3 = $$d; byte b59 = bArr3[6]; Object[] objArr68 = new Object[1]; k(b59, (byte) (b59 << 1), (byte) (bArr3[31] + 1), objArr68); Class<?> cls5 = Class.forName((String) objArr68[0]); byte b60 = (byte) (bArr3[31] + 1); byte b61 = bArr3[6]; Object[] objArr69 = new Object[1]; k(b60, b61, (byte) (b61 | 8), objArr69); Object[] objArr70 = (Object[]) cls5.getMethod((String) objArr69[0], Context.class, Integer.TYPE, Integer.TYPE).invoke(null, context2, num2, 0x1ca7079b); if (context2 != null) { int i148 = f + 35; a = i148 % 128; int i149 = i148 % 2; Object b62 = fgk.b(0x2ca4da20); if (b62 == null) { char size = (char) View.MeasureSpec.getSize(0); int edgeSlop = (ViewConfiguration.getEdgeSlop() >> 16) + 10398; int i150 = 6 - (TypedValue.complexToFloat(0) > 0.0f ? 1 : (TypedValue.complexToFloat(0) == 0.0f ? 0 : -1)); byte b63 = (byte) 0; byte b64 = b63; objArr10 = objArr64; Object[] objArr71 = new Object[1]; j(b63, b64, (byte) (b64 + 1), objArr71); b62 = fgk.d(size, edgeSlop, i150, 0x1a635223, false, (String) objArr71[0], (Class[]) null); } else { objArr10 = objArr64; } ((Field) b62).set(null, objArr70); try { Long valueOf4 = Long.valueOf(((Long) Class.forName(str).getDeclaredMethod(str2, new Class[0]).invoke(null, new Object[0])).longValue()); Object b65 = fgk.b(0x2c7a939d); if (b65 == null) { char resolveSizeAndState2 = (char) View.resolveSizeAndState(0, 0, 0); int keyRepeatDelay = 10398 - (ViewConfiguration.getKeyRepeatDelay() >> 16); int keyRepeatDelay2 = (ViewConfiguration.getKeyRepeatDelay() >> 16) + 6; byte b66 = (byte) 0; objArr9 = objArr70; Object[] objArr72 = new Object[1]; j(b66, b66, (byte) $$a.length, objArr72); b65 = fgk.d(resolveSizeAndState2, keyRepeatDelay, keyRepeatDelay2, 0x1abd1b9e, false, (String) objArr72[0], (Class[]) null); } else { objArr9 = objArr70; } ((Field) b65).set(null, valueOf4); int i151 = 2 % 2; } catch (Exception unused4) { throw new RuntimeException(); } } else { objArr9 = objArr70; objArr10 = objArr64; } objArr11 = objArr9; i7 = 0; } else { int i152 = a + 65; f = i152 % 128; int i153 = i152 % 2; Object b67 = fgk.b(0x2ca4da20); if (b67 == null) { char keyRepeatTimeout = (char) (ViewConfiguration.getKeyRepeatTimeout() >> 16); int indexOf6 = TextUtils.indexOf((CharSequence) str3, '0', 0, 0) + 10399; int alpha2 = 6 - Color.alpha(0); byte b68 = (byte) 0; byte b69 = b68; Object[] objArr73 = new Object[1]; j(b68, b69, (byte) (b69 + 1), objArr73); b67 = fgk.d(keyRepeatTimeout, indexOf6, alpha2, 0x1a635223, false, (String) objArr73[0], (Class[]) null); } Object[] objArr74 = (Object[]) ((Field) b67).get(null); objArr11 = new Object[]{r5, r1, new int[1], r11}; int i154 = ((int[]) objArr74[3])[0]; int i155 = ((int[]) objArr74[0])[0]; String str20 = (String) objArr74[1]; int[] iArr23 = {i154}; int[] iArr24 = {i155}; int startElapsedRealtime2 = (int) Process.getStartElapsedRealtime(); int i156 = (-703036217) + (((~(startElapsedRealtime2 | 0x2a1bdb94)) | 0x197ecc68) * (-668)) + ((0x2a1bdb94 | (~(0x197ecc68 | startElapsedRealtime2))) * 1336) + ((startElapsedRealtime2 | 0x3b7fdffc) * 668) + 0x1ca7079b; int i157 = (i156 << 13) ^ i156; int i158 = i157 ^ (i157 >>> 17); ((int[]) objArr11[2])[0] = i158 ^ (i158 << 5); i7 = 0; objArr10 = objArr64; } int i159 = ((int[]) objArr11[i7])[i7]; int i160 = ((int[]) objArr11[3])[i7]; if (i160 == i159) { Object[] objArr75 = new Object[4]; int[] iArr25 = new int[1]; objArr75[i7] = iArr25; objArr75[2] = new int[1]; int[] iArr26 = new int[1]; objArr75[3] = iArr26; int i161 = ((int[]) objArr11[2])[i7]; int i162 = ((int[]) objArr11[3])[i7]; int i163 = ((int[]) objArr11[i7])[i7]; String str21 = (String) objArr11[1]; iArr26[i7] = i162; iArr25[i7] = i163; objArr75[1] = str21; int freeMemory2 = (int) Runtime.getRuntime().freeMemory(); int i164 = ~freeMemory2; int i165 = i161 + (-529742150) + ((freeMemory2 | 0x3acb1304) * (-859)) + (((~(freeMemory2 | (-281088005))) | (~(0x3acb1304 | i164))) * 859) + (((~(0x2a2e03d8 | i164)) | (-988746717)) * 859); int i166 = (i165 << 13) ^ i165; int i167 = i166 ^ (i166 >>> 17); ((int[]) objArr75[2])[0] = i167 ^ (i167 << 5); Object[] objArr76 = {r9, r2, new int[1], r11}; int i168 = ((int[]) objArr75[2])[0]; int i169 = ((int[]) objArr75[3])[0]; int i170 = ((int[]) objArr75[0])[0]; String str22 = (String) objArr75[1]; int[] iArr27 = {i169}; int[] iArr28 = {i170}; int startUptimeMillis2 = (int) Process.getStartUptimeMillis(); int i171 = ~(0x3fe7d775 | startUptimeMillis2); int i172 = i168 + 0x2317276f + ((0x0c80c041 | i171) * (-476)) + (i171 * 952) + ((~((~startUptimeMillis2) | 0x3fe7d775)) * 476); int i173 = (i172 << 13) ^ i172; int i174 = i173 ^ (i173 >>> 17); ((int[]) objArr76[2])[0] = i174 ^ (i174 << 5); objArr13 = objArr76; i8 = 0; str4 = str3; objArr12 = objArr4; } else { str4 = str3; long j20 = -1; objArr12 = objArr4; long j21 = 0; long j22 = ((i160 ^ i159) & ((j20 - ((j20 >> 63) << 32)) | (i7 << 32))) | (7 << 32) | (j21 - ((j21 >> 63) << 32)); Object b70 = fgk.b(0x20d9a7e6); if (b70 == null) { b70 = fgk.d((char) ((Process.getThreadPriority(0) + 20) >> 6), 11314 - (Process.myPid() >> 22), 6 - View.combineMeasuredStates(0, 0), 0x161e2fe5, false, "c", new Class[0]); } Object invoke5 = ((Method) b70).invoke(null, null); Object[] objArr77 = {1252794371, Long.valueOf(j22), new ArrayList(), MainActivity.B(), false}; Object b71 = fgk.b(-185514598); if (b71 == null) { b71 = fgk.d((char) (Process.getGidForName(str4) + 17652), 11308 - ((Process.getThreadPriority(0) + 20) >> 6), (Process.myTid() >> 22) + 6, -1036595815, false, "c", new Class[]{Integer.TYPE, Long.TYPE, List.class, String.class, Boolean.TYPE}); } ((Method) b71).invoke(invoke5, objArr77); Object[] objArr78 = {r9, r4, new int[1], r11}; int i175 = ((int[]) objArr11[2])[0]; int i176 = ((int[]) objArr11[3])[0]; int i177 = ((int[]) objArr11[0])[0]; String str23 = (String) objArr11[1]; int[] iArr29 = {i176}; int[] iArr30 = {i177}; int i178 = (int) Runtime.getRuntime().totalMemory(); int i179 = ~i178; int i180 = i175 + 0x6308b5f7 + (((~(0x0f9bedeb | i179)) | 0x01012140) * 220) + (((~(i179 | 0x0789a163)) | 0x09136dc8) * (-440)) + ((i178 | 0x0f9bedeb) * 220); int i181 = (i180 << 13) ^ i180; int i182 = i181 ^ (i181 >>> 17); ((int[]) objArr78[2])[0] = i182 ^ (i182 << 5); int[] iArr31 = new int[i160]; int i183 = i160 - 1; iArr31[i183] = 1; Toast.makeText((Context) null, iArr31[((i160 * i183) % 2) - 1], 1).show(); objArr13 = new Object[]{r1, r2, new int[1], r11}; int i184 = ((int[]) objArr78[2])[0]; int i185 = ((int[]) objArr78[3])[0]; int i186 = ((int[]) objArr78[0])[0]; String str24 = (String) objArr78[1]; int[] iArr32 = {i185}; int[] iArr33 = {i186}; int myUid = Process.myUid(); int i187 = i184 + 0x45a38e6b + (((~(0x1bea2a01 | myUid)) | (-747059502)) * (-964)) + (((~((~myUid) | 0x1bea2a01)) | (-1072642862)) * (-964)); int i188 = (i187 << 13) ^ i187; int i189 = i188 ^ (i188 >>> 17); i8 = 0; ((int[]) objArr13[2])[0] = i189 ^ (i189 << 5); } Object b72 = fgk.b(-141272996); if (b72 == null) { char argb = (char) Color.argb(i8, i8, i8, i8); str5 = str4; int indexOf7 = 10375 - TextUtils.indexOf((CharSequence) str5, '0'); int mirror3 = '6' - AndroidCharacter.getMirror('0'); byte b73 = (byte) i8; Object[] objArr79 = new Object[1]; j(b73, b73, (byte) $$a.length, objArr79); b72 = fgk.d(argb, indexOf7, mirror3, -1051471777, false, (String) objArr79[i8], (Class[]) null); } else { str5 = str4; } long j23 = ((Field) b72).getLong(null); try { if (j23 != -1) { int i190 = f + 11; a = i190 % 128; int i191 = i190 % 2; if (j23 + 1958 >= ((Long) Class.forName(str).getDeclaredMethod(str2, new Class[0]).invoke(null, new Object[0])).longValue()) { Object b74 = fgk.b(-142196517); if (b74 == null) { char indexOf8 = (char) (TextUtils.indexOf((CharSequence) str5, '0') + 1); int myPid2 = (Process.myPid() >> 22) + 10376; int bitsPerPixel2 = 5 - ImageFormat.getBitsPerPixel(0); byte b75 = (byte) 0; byte b76 = b75; Object[] objArr80 = new Object[1]; j(b75, b76, (byte) (b76 + 5), objArr80); b74 = fgk.d(indexOf8, myPid2, bitsPerPixel2, -1052653352, false, (String) objArr80[0], (Class[]) null); } Object[] objArr81 = (Object[]) ((Field) b74).get(null); objArr16 = new Object[]{new int[1], new int[1], new int[1]}; int i192 = ((int[]) objArr81[2])[0]; int i193 = ((int[]) objArr81[1])[0]; ((int[]) objArr16[2])[0] = i192; ((int[]) objArr16[1])[0] = i193; int myPid3 = Process.myPid(); int i194 = ~myPid3; int i195 = ~(0x01761b99 | i194); int i196 = (-591363382) + ((0x6a896460 | i195) * (-712)) + (((~(myPid3 | 0x6bff7ff9)) | (~(i194 | (-1787389025)))) * (-712)) + (((-1806663282) | i195) * 712) + 0x0d6f55e5; int i197 = (i196 << 13) ^ i196; int i198 = i197 ^ (i197 >>> 17); ((int[]) objArr16[0])[0] = i198 ^ (i198 << 5); c3 = 2; Object obj = objArr16[1]; i9 = ((int[]) obj)[0]; Object obj2 = objArr16[c3]; i10 = ((int[]) obj2)[0]; if (i10 == i9) { long j24 = i10 ^ i9; long j25 = -1; long j26 = j24 & ((0 << 32) | (j25 - ((j25 >> 63) << 32))); long j27 = 0; long j28 = j26 | (11 << 32) | (j27 - ((j27 >> 63) << 32)); Object b77 = fgk.b(0x20d9a7e6); if (b77 == null) { b77 = fgk.d((char) (ViewConfiguration.getDoubleTapTimeout() >> 16), 11314 - (Process.myTid() >> 22), 6 + Color.red(0), 0x161e2fe5, false, "c", new Class[0]); } Object invoke6 = ((Method) b77).invoke(null, null); Object[] objArr82 = {1252794371, Long.valueOf(j28), new ArrayList(), MainActivity.B(), false}; Object b78 = fgk.b(-185514598); if (b78 == null) { b78 = fgk.d((char) (17651 - (ViewConfiguration.getScrollBarFadeDuration() >> 16)), 11308 - (ViewConfiguration.getScrollDefaultDelay() >> 16), 7 - (SystemClock.elapsedRealtime() > 0L ? 1 : (SystemClock.elapsedRealtime() == 0L ? 0 : -1)), -1036595815, false, "c", new Class[]{Integer.TYPE, Long.TYPE, List.class, String.class, Boolean.TYPE}); } ((Method) b78).invoke(invoke6, objArr82); Object[] objArr83 = {new int[1], new int[1], new int[1]}; int i199 = ((int[]) objArr16[0])[0]; int i200 = ((int[]) objArr16[2])[0]; int i201 = ((int[]) objArr16[1])[0]; ((int[]) objArr83[2])[0] = i200; ((int[]) objArr83[1])[0] = i201; int startElapsedRealtime3 = (int) Process.getStartElapsedRealtime(); int i202 = ~startElapsedRealtime3; int i203 = i199 + (-1529875030) + (((~(0x34d7beb1 | i202)) | 0x384ddb59) * (-328)) + ((startElapsedRealtime3 | 0x384ddb59) * 164) + (((~(startElapsedRealtime3 | (-886554290))) | 0x30459a11 | (~(i202 | 0x3cdffff9))) * 164); int i204 = (i203 << 13) ^ i203; int i205 = i204 ^ (i204 >>> 17); ((int[]) objArr83[0])[0] = i205 ^ (i205 << 5); throw new RuntimeException(String.valueOf(i10)); } Object[] objArr84 = {new int[1], new int[1], new int[1]}; int i206 = ((int[]) objArr16[0])[0]; int i207 = ((int[]) obj2)[0]; int i208 = ((int[]) obj)[0]; ((int[]) objArr84[2])[0] = i207; ((int[]) objArr84[1])[0] = i208; int nextInt5 = new Random().nextInt(0x40e975a5); int i209 = (~((-1332215997) | nextInt5)) | 0x0d28000c; int i210 = ~nextInt5; int i211 = i206 + 0x7794374a + ((i209 | (~(0x5ffd99fe | i210))) * 886) + (((~(i210 | 0x4f6800bc)) | 0x1dbd994e) * (-1772)) + ((~(i210 | 0x1dbd994e)) * 886); int i212 = i211 ^ (i211 << 13); int i213 = i212 ^ (i212 >>> 17); Object obj3 = objArr84[0]; ((int[]) obj3)[0] = i213 ^ (i213 << 5); Object[] objArr85 = {new int[1], new int[1], new int[1]}; int i214 = ((int[]) obj3)[0]; int i215 = ((int[]) objArr84[2])[0]; int i216 = ((int[]) objArr84[1])[0]; ((int[]) objArr85[2])[0] = i215; ((int[]) objArr85[1])[0] = i216; int elapsedCpuTime2 = (int) Process.getElapsedCpuTime(); int i217 = (~((-1333688671) | elapsedCpuTime2)) | 0x0d26200c; int i218 = ~elapsedCpuTime2; int i219 = i214 + (-1908165306) + ((i217 | (~(0x5fff79fe | i218))) * 886) + (((~(i218 | 0x4f7e795e)) | 0x1da720ac) * (-1772)) + ((~(i218 | 0x1da720ac)) * 886); int i220 = (i219 << 13) ^ i219; int i221 = i220 ^ (i220 >>> 17); ((int[]) objArr85[0])[0] = i221 ^ (i221 << 5); Object b79 = fgk.b(0x1b51fc90); if (b79 == null) { char c11 = (char) ((TypedValue.complexToFloat(0) > 0.0f ? 1 : (TypedValue.complexToFloat(0) == 0.0f ? 0 : -1)) + 43239); int blue = Color.blue(0) + 10410; int lastIndexOf = 5 - TextUtils.lastIndexOf(str5, '0', 0, 0); byte b80 = (byte) 0; byte b81 = b80; Object[] objArr86 = new Object[1]; j(b80, b81, (byte) (b81 | 7), objArr86); b79 = fgk.d(c11, blue, lastIndexOf, 0x2d967493, false, (String) objArr86[0], (Class[]) null); } long j29 = ((Field) b79).getLong(null); if (j29 == -1 || j29 + 1913 < ((Long) Class.forName(str).getDeclaredMethod(str2, new Class[0]).invoke(null, new Object[0])).longValue()) { byte[] bArr4 = $$d; byte b82 = bArr4[6]; Object[] objArr87 = new Object[1]; k(b82, b82, (byte) (bArr4[31] + 1), objArr87); Class<?> cls6 = Class.forName((String) objArr87[0]); byte b83 = (byte) (bArr4[31] + 1); Object[] objArr88 = new Object[1]; k(b83, b83, (byte) (-bArr4[20]), objArr88); objArr17 = (Object[]) cls6.getMethod((String) objArr88[0], Integer.TYPE, Integer.TYPE).invoke(null, num2, 0x78089b0f); Object b84 = fgk.b(0x1b601411); if (b84 == null) { char c12 = (char) (43240 - (AudioTrack.getMaxVolume() > 0.0f ? 1 : (AudioTrack.getMaxVolume() == 0.0f ? 0 : -1))); int lastIndexOf2 = 10409 - TextUtils.lastIndexOf(str5, '0', 0); int keyRepeatTimeout2 = (ViewConfiguration.getKeyRepeatTimeout() >> 16) + 6; byte b85 = (byte) 0; byte b86 = b85; str6 = str5; Object[] objArr89 = new Object[1]; j(b85, b86, (byte) (b86 | 6), objArr89); b84 = fgk.d(c12, lastIndexOf2, keyRepeatTimeout2, 0x2da79c12, false, (String) objArr89[0], (Class[]) null); } else { str6 = str5; } ((Field) b84).set(null, objArr17); try { Long valueOf5 = Long.valueOf(((Long) Class.forName(str).getDeclaredMethod(str2, new Class[0]).invoke(null, new Object[0])).longValue()); Object b87 = fgk.b(0x1b51fc90); if (b87 == null) { char maximumDrawingCacheSize2 = (char) ((ViewConfiguration.getMaximumDrawingCacheSize() >> 24) + 43239); int makeMeasureSpec4 = View.MeasureSpec.makeMeasureSpec(0, 0) + 10410; int pressedStateDuration2 = 6 - (ViewConfiguration.getPressedStateDuration() >> 16); byte b88 = (byte) 0; byte b89 = b88; Object[] objArr90 = new Object[1]; j(b88, b89, (byte) (b89 | 7), objArr90); b87 = fgk.d(maximumDrawingCacheSize2, makeMeasureSpec4, pressedStateDuration2, 0x2d967493, false, (String) objArr90[0], (Class[]) null); } ((Field) b87).set(null, valueOf5); } catch (Exception unused5) { throw new RuntimeException(); } } else { Object b90 = fgk.b(0x1b601411); if (b90 == null) { char makeMeasureSpec5 = (char) (View.MeasureSpec.makeMeasureSpec(0, 0) + 43239); int green = Color.green(0) + 10410; int i222 = 7 - (SystemClock.currentThreadTimeMillis() > (-1L) ? 1 : (SystemClock.currentThreadTimeMillis() == (-1L) ? 0 : -1)); byte b91 = (byte) 0; byte b92 = b91; Object[] objArr91 = new Object[1]; j(b91, b92, (byte) (b92 | 6), objArr91); b90 = fgk.d(makeMeasureSpec5, green, i222, 0x2da79c12, false, (String) objArr91[0], (Class[]) null); } Object[] objArr92 = (Object[]) ((Field) b90).get(null); objArr17 = new Object[]{new int[1], r4, r0, r11}; int i223 = ((int[]) objArr92[3])[0]; int i224 = ((int[]) objArr92[1])[0]; String[] strArr7 = (String[]) objArr92[2]; int[] iArr34 = {i223}; int[] iArr35 = {i224}; int i225 = (~((int) Process.getStartElapsedRealtime())) | 0x27a41ae9; int i226 = (-490469970) + (i225 * 495) + (((~i225) | 0x25801ae0) * 495) + 0x78089b0f; int i227 = (i226 << 13) ^ i226; int i228 = i227 ^ (i227 >>> 17); ((int[]) objArr17[0])[0] = i228 ^ (i228 << 5); str6 = str5; } int i229 = ((int[]) objArr17[1])[0]; int i230 = ((int[]) objArr17[3])[0]; if (i230 != i229) { ArrayList arrayList4 = new ArrayList(); String[] strArr8 = (String[]) objArr17[2]; if (strArr8 != null) { int i231 = 0; while (i231 < strArr8.length) { int i232 = a + 77; f = i232 % 128; if (i232 % 2 == 0) { arrayList4.add(strArr8[i231]); i231 += 35; } else { arrayList4.add(strArr8[i231]); i231++; } } } long j30 = -1; long j31 = (i229 ^ i230) & ((0 << 32) | (j30 - ((j30 >> 63) << 32))); long j32 = 0; long j33 = j31 | (10 << 32) | (j32 - ((j32 >> 63) << 32)); Object b93 = fgk.b(0x20d9a7e6); if (b93 == null) { b93 = fgk.d((char) Drawable.resolveOpacity(0, 0), 11314 - View.combineMeasuredStates(0, 0), 6 - Color.argb(0, 0, 0, 0), 0x161e2fe5, false, "c", new Class[0]); } Object invoke7 = ((Method) b93).invoke(null, null); Object[] objArr93 = {1252794371, Long.valueOf(j33), arrayList4, MainActivity.B(), false}; Object b94 = fgk.b(-185514598); if (b94 == null) { b94 = fgk.d((char) (17650 - MotionEvent.axisFromString(str6)), 11307 - TextUtils.indexOf((CharSequence) str6, '0'), 6 - View.MeasureSpec.makeMeasureSpec(0, 0), -1036595815, false, "c", new Class[]{Integer.TYPE, Long.TYPE, List.class, String.class, Boolean.TYPE}); } ((Method) b94).invoke(invoke7, objArr93); Object[] objArr94 = {new int[1], r3, r2, r5}; int i233 = ((int[]) objArr17[0])[0]; int i234 = ((int[]) objArr17[3])[0]; int i235 = ((int[]) objArr17[1])[0]; String[] strArr9 = (String[]) objArr17[2]; int[] iArr36 = {i234}; int[] iArr37 = {i235}; int myTid4 = Process.myTid(); int i236 = ~((-1202579366) | myTid4); int i237 = ~myTid4; int i238 = i236 | (~(0x1dca133a | i237)); int i239 = ~(0x47ade7a5 | i237); int i240 = i233 + (-726654325) + ((i238 | i239) * (-516)) + (((~(myTid4 | (-92799777))) | (~((-406982683) | i237))) * 516) + ((0x1842101a | i239) * 516); int i241 = (i240 << 13) ^ i240; int i242 = i241 ^ (i241 >>> 17); ((int[]) objArr94[0])[0] = i242 ^ (i242 << 5); throw new RuntimeException(String.valueOf(i230)); } Object[] objArr95 = {new int[1], r3, r2, r9}; int i243 = ((int[]) objArr17[0])[0]; int i244 = ((int[]) objArr17[3])[0]; int i245 = ((int[]) objArr17[1])[0]; String[] strArr10 = (String[]) objArr17[2]; int[] iArr38 = {i244}; int[] iArr39 = {i245}; int i246 = ~Process.myUid(); int i247 = i243 + (-724906739) + (((-16530) | i246) * 494) + (((~(i246 | 0x5abfb54e)) | (-1342697696)) * 494); int i248 = (i247 << 13) ^ i247; int i249 = i248 ^ (i248 >>> 17); ((int[]) objArr95[0])[0] = i249 ^ (i249 << 5); Object[] objArr96 = {new int[1], r5, strArr10, r9}; int i250 = ((int[]) objArr95[0])[0]; int[] iArr40 = {((int[]) objArr95[3])[0]}; int[] iArr41 = {((int[]) objArr95[1])[0]}; int myTid5 = Process.myTid(); int i251 = i250 + (-144576063) + (((~(myTid5 | 0x4feedd3e)) | 0x15891da1) * 191) + (((~((~myTid5) | 0x4feedd3e)) | 0x10010081) * 191); int i252 = (i251 << 13) ^ i251; int i253 = i252 ^ (i252 >>> 17); ((int[]) objArr96[0])[0] = i253 ^ (i253 << 5); String concat = "30\\22\\14\\".concat("0\u0082\u0005È0\u0082\u0003° \u0003\u0002\u0001\u0002\u0002\u0014\u0010\u008ae\bsù/\u008eQí"); int i254 = ((int[]) objArr5[1])[0]; int i255 = i254 * i254; int i256 = -(0x0eebea55 * i254); int i257 = (i255 ^ i256) + ((i255 & i256) << 1); int i258 = -(i254 * (-57439989)); int i259 = ((i257 ^ i258) + ((i258 & i257) << 1)) - (-2068830464); int i260 = (((i259 >> 17) - 65535) / 32768) - (-1); int i261 = (i259 & i260) + (i260 | i259); int i262 = i259 >> 19; int i263 = ((i262 ^ (-16383)) + ((i262 & (-16383)) << 1)) / 8192; int i264 = -(((i263 & 1) + (i263 | 1)) ^ i261); int i265 = ((i264 | 7) << 1) - (i264 ^ 7); int i266 = i265 >> 27; int i267 = (((i266 | (-63)) << 1) - (i266 ^ (-63))) / 32; zza = new zzf(zzj.zze(concat.substring(56007 / (((-(((i267 & 1) + (i267 | 1)) - (-1))) & i265) * 889)))); zzb = new zzg(zzj.zze("0\u0082\u0006\u00040\u0082\u0003ì \u0003\u0002\u0001\u0002\u0002\u0014\u0003£²\u00ad×árÊkì")); String concat2 = "14/17/".concat("0\u0082\u0004C0\u0082\u0003+ \u0003\u0002\u0001\u0002\u0002\t\u0000Âà\u0087FdJ0\u008d0"); int i268 = ((int[]) objArr13[2])[0]; int i269 = i268 * i268; int i270 = -(0x0eccb720 * i268); int i271 = (i269 & i270) + (i269 | i270); int i272 = -(i268 * 0x709ff908); int i273 = ((i271 | i272) << 1) - (i272 ^ i271); int i274 = ((i273 | 0x32bdc190) << 1) - (0x32bdc190 ^ i273); int i275 = ((i274 >> 25) - 255) / 128; int i276 = ((i275 | 1) << 1) - (i275 ^ 1); int i277 = ((i274 | i276) << 1) - (i276 ^ i274); int i278 = i274 >> 18; int i279 = (-(i277 ^ ((((i278 & (-32767)) + (i278 | (-32767))) / 16384) - (-1)))) + 5; int i280 = ((i279 >> 22) - 2047) / 1024; int i281 = ((i280 | 1) << 1) - (i280 ^ 1); zzc = new zzh(zzj.zze(concat2.substring(12270 / ((i279 & (-((i281 & 1) + (i281 | 1)))) * 409)))); String concat3 = "25,19,7,".concat("0\u0082\u0004¨0\u0082\u0003\u0090 \u0003\u0002\u0001\u0002\u0002\t\u0000Õ\u0085¸l}ÓNõ0"); int i282 = ((int[]) objArr12[0])[0]; int i283 = i282 * i282; int i284 = -(0x6df8c6eb * i282); int i285 = (((i283 & i284) + (i283 | i284)) - (~(-(i282 * (-1917060567))))) - 1; int i286 = (i285 & 0x536fca64) + (0x536fca64 | i285); int i287 = i286 >> 18; int i288 = (((i287 | (-32767)) << 1) - (i287 ^ (-32767))) / 16384; int i289 = (i286 - (~((i288 & 1) + (i288 | 1)))) - 1; int i290 = i286 >> 16; int i291 = ((i290 & (-131071)) + (i290 | (-131071))) / 65536; int i292 = -(i289 ^ (((i291 | 1) << 1) - (i291 ^ 1))); int i293 = ((i292 | 7) << 1) - (i292 ^ 7); int i294 = i293 >> 19; int i295 = (((i294 ^ (-16383)) + ((i294 & (-16383)) << 1)) / 8192) - (-1); int i296 = 807240 / (((-((i295 ^ 1) + ((i295 & 1) << 1))) & i293) * 961); int i297 = ((int[]) objArr52[2])[0]; int i298 = i297 * i297; int i299 = -(0x662c44fd * i297); int i300 = (i298 ^ i299) + ((i298 & i299) << 1); int i301 = -(i297 * (-1731463397)); int i302 = (i300 & i301) + (i301 | i300); int i303 = (i302 ^ 0x0726d090) + ((0x0726d090 & i302) << 1); int i304 = i303 >> 20; int i305 = (((i304 | (-8191)) << 1) - (i304 ^ (-8191))) / 4096; int i306 = (i303 - (~(((i305 | 1) << 1) - (i305 ^ 1)))) - 1; int i307 = i303 >> 23; int i308 = -(i306 ^ (((((i307 | (-1023)) << 1) - (i307 ^ (-1023))) / 512) - (-1))); int i309 = (i308 & 8) + (i308 | 8); int i310 = i309 >> 24; int i311 = ((((i310 | (-511)) << 1) - (i310 ^ (-511))) / 256) - (-1); int i312 = i296 + (5704560 / (((-((i311 & 1) + (i311 | 1))) & i309) * 1390)); int i313 = ((int[]) objArr10[2])[0]; int i314 = i313 * i313; int i315 = -(0x4d130bde * i313); int i316 = ((i314 | i315) << 1) - (i314 ^ i315); int i317 = -(i313 * 0x634f979c); int i318 = ((i316 & i317) + (i317 | i316)) - (-1416832393); int i319 = i318 >> 26; int i320 = ((((i319 | (-127)) << 1) - (i319 ^ (-127))) / 64) - (-1); int i321 = (i318 ^ i320) + ((i320 & i318) << 1); int i322 = ((i318 >> 29) - 15) / 8; int i323 = -(i321 ^ ((i322 & 1) + (i322 | 1))); int i324 = ((i323 | 2) << 1) - (i323 ^ 2); int i325 = i324 >> 16; int i326 = ((i325 & (-131071)) + (i325 | (-131071))) / 65536; int i327 = (i326 & 1) + (i326 | 1); int i328 = i312 + (287226 / (((-((i327 ^ 1) + ((i327 & 1) << 1))) & i324) * 197)); int i329 = ((int[]) objArr85[0])[0]; int i330 = ((i329 * i329) - (~(-(0x6bfc9ddf * i329)))) - 1; int i331 = -(i329 * 0x0b4c7011); int i332 = ((i330 ^ i331) + ((i330 & i331) << 1)) - 0x7b176fc0; int i333 = i332 >> 22; int i334 = ((i333 & (-2047)) + (i333 | (-2047))) / 1024; int i335 = (i334 ^ 1) + ((i334 & 1) << 1); int i336 = ((i332 | i335) << 1) - (i335 ^ i332); int i337 = i332 >> 17; int i338 = ((i337 & (-65535)) + (i337 | (-65535))) / 32768; int i339 = -(((i338 ^ 1) + ((i338 & 1) << 1)) ^ i336); int i340 = (i339 & 7) + (i339 | 7); int i341 = i340 >> 21; int i342 = ((i341 & (-4095)) + (i341 | (-4095))) / 2048; int i343 = (i342 & 1) + (i342 | 1); int i344 = i328 + (2471448 / (((-((i343 & 1) + (i343 | 1))) & i340) * 1252)); int i345 = ((int[]) objArr96[0])[0]; int i346 = ((i345 * i345) - (~(-(0x7fdefaf0 * i345)))) - 1; int i347 = -(i345 * (-1864095292)); int i348 = (i346 ^ i347) + ((i347 & i346) << 1); int i349 = (i348 ^ (-606156892)) + (((-606156892) & i348) << 1); int i350 = i349 >> 27; int i351 = ((i350 & (-63)) + (i350 | (-63))) / 32; int i352 = (i351 ^ 1) + ((i351 & 1) << 1); int i353 = ((i349 | i352) << 1) - (i352 ^ i349); int i354 = i349 >> 29; int i355 = ((i354 ^ (-15)) + ((i354 & (-15)) << 1)) / 8; int i356 = -(((i355 & 1) + (i355 | 1)) ^ i353); int i357 = ((i356 | 6) << 1) - (i356 ^ 6); int i358 = ((i357 >> 25) - 255) / 128; zzd = new zzi(zzj.zze(concat3.substring(i344 + ((-19023408) / (((-(((i358 ^ 1) + ((i358 & 1) << 1)) - (-1))) & i357) * 1938))))); zzf = new Object(); return; } } Long valueOf6 = Long.valueOf(((Long) Class.forName(str).getDeclaredMethod(str2, new Class[0]).invoke(null, new Object[0])).longValue()); Object b95 = fgk.b(-141272996); if (b95 == null) { char packedPositionGroup3 = (char) ExpandableListView.getPackedPositionGroup(0L); int green2 = Color.green(0) + 10376; int normalizeMetaState = 6 - KeyEvent.normalizeMetaState(0); byte b96 = (byte) 0; objArr15 = objArr14; Object[] objArr97 = new Object[1]; j(b96, b96, (byte) $$a.length, objArr97); b95 = fgk.d(packedPositionGroup3, green2, normalizeMetaState, -1051471777, false, (String) objArr97[0], (Class[]) null); } else { objArr15 = objArr14; } ((Field) b95).set(null, valueOf6); c3 = 2; int i359 = 2 % 2; objArr16 = objArr15; Object obj4 = objArr16[1]; i9 = ((int[]) obj4)[0]; Object obj22 = objArr16[c3]; i10 = ((int[]) obj22)[0]; if (i10 == i9) { } } catch (Exception unused6) { throw new RuntimeException(); } Object b97 = fgk.b(0x3b9b926b); if (b97 == null) { b97 = fgk.d((char) Gravity.getAbsoluteGravity(0, 0), 10550 - ExpandableListView.getPackedPositionGroup(0L), (ViewConfiguration.getJumpTapTimeout() >> 16) + 6, 0x0d5c1a68, false, (String) null, new Class[0]); } Object[] objArr98 = {null, ((Constructor) b97).newInstance(null), 0x0d6f55e5, num}; Object b98 = fgk.b(0x46d68e90); if (b98 == null) { char longPressTimeout2 = (char) (ViewConfiguration.getLongPressTimeout() >> 16); int maxKeyCode = (KeyEvent.getMaxKeyCode() >> 16) + 10376; int indexOf9 = 6 - TextUtils.indexOf(str5, str5, 0); byte b99 = (byte) 0; Object[] objArr99 = new Object[1]; j(b99, b99, (byte) $$a.length, objArr99); b98 = fgk.d(longPressTimeout2, maxKeyCode, indexOf9, 0x70110693, false, (String) objArr99[0], new Class[]{(Class) fgk.d((char) TextUtils.getOffsetBefore(str5, 0), (TypedValue.complexToFloat(0) > 0.0f ? 1 : (TypedValue.complexToFloat(0) == 0.0f ? 0 : -1)) + 10382, 8 - (ViewConfiguration.getTapTimeout() >> 16)), (Class) fgk.d((char) (64288 - TextUtils.getCapsMode(str5, 0, 0)), (ViewConfiguration.getScrollDefaultDelay() >> 16) + 10390, 8 - View.MeasureSpec.getSize(0)), Integer.TYPE, Integer.TYPE}); } objArr14 = (Object[]) ((Method) b98).invoke(null, objArr98); Object b100 = fgk.b(-142196517); if (b100 == null) { char pressedStateDuration3 = (char) (ViewConfiguration.getPressedStateDuration() >> 16); int scrollBarFadeDuration = (ViewConfiguration.getScrollBarFadeDuration() >> 16) + 10376; int offsetBefore = 6 - TextUtils.getOffsetBefore(str5, 0); byte b101 = (byte) 0; byte b102 = b101; Object[] objArr100 = new Object[1]; j(b101, b102, (byte) (b102 + 5), objArr100); b100 = fgk.d(pressedStateDuration3, scrollBarFadeDuration, offsetBefore, -1052653352, false, (String) objArr100[0], (Class[]) null); } ((Field) b100).set(null, objArr14); } } Object[] objArr101 = new Object[1]; g((ViewConfiguration.getScrollBarFadeDuration() >> 16) + 26, new char[]{48209, 12547, 46926, 14005, 34564, 35826, 27495, 3912, 10462, 7192, 13819, 23397, 40833, 65393, 5081, 15287, 24927, 59908, 11411, 38206, 55817, 11307, 61942, 40364, 51137, 53773}, objArr101); Class<?> cls7 = Class.forName((String) objArr101[0]); Object[] objArr102 = new Object[1]; g(19 - (AudioTrack.getMaxVolume() > 0.0f ? 1 : (AudioTrack.getMaxVolume() == 0.0f ? 0 : -1)), new char[]{4718, 24663, 39270, 61010, 63481, 54593, 12901, 8078, 16086, 61921, 36784, 58417, 48496, 48526, 5081, 15287, 40329, 48930}, objArr102); Context context3 = (Context) cls7.getMethod((String) objArr102[0], new Class[0]).invoke(null, null); if (context3 != null) { if (context3 instanceof ContextWrapper) { int i360 = a + 91; f = i360 % 128; i4 = 2; int i361 = i360 % 2; if (((ContextWrapper) context3).getBaseContext() == null) { context3 = null; } } else { i4 = 2; } context3 = context3.getApplicationContext(); int i362 = i4 % i4; } else { i4 = 2; } int i363 = a + 63; f = i363 % 128; int i364 = i363 % i4; Object[] objArr103 = new Object[4]; objArr103[3] = 0x429a5dc4; objArr103[i4] = num; objArr103[1] = num2; objArr103[0] = context3; byte[] bArr5 = $$d; byte b103 = bArr5[6]; Object[] objArr104 = new Object[1]; k(b103, (byte) (b103 << 2), (byte) (bArr5[31] + 1), objArr104); Class<?> cls8 = Class.forName((String) objArr104[0]); byte b104 = (byte) (bArr5[31] + 1); Object[] objArr105 = new Object[1]; k(b104, (byte) (b104 | 18), bArr5[2], objArr105); objArr6 = (Object[]) cls8.getMethod((String) objArr105[0], Context.class, Integer.TYPE, Integer.TYPE, Integer.TYPE).invoke(null, objArr103); if (context3 != null) { Object b105 = fgk.b(0x2c6c7c1c); if (b105 == null) { char touchSlop = (char) (ViewConfiguration.getTouchSlop() >> 8); int packedPositionGroup4 = 10398 - ExpandableListView.getPackedPositionGroup(0L); int lastIndexOf3 = TextUtils.lastIndexOf(str3, '0', 0) + 7; byte b106 = (byte) 0; byte b107 = b106; Object[] objArr106 = new Object[1]; j(b106, b107, (byte) (b107 + 5), objArr106); b105 = fgk.d(touchSlop, packedPositionGroup4, lastIndexOf3, 0x1aabf41f, false, (String) objArr106[0], (Class[]) null); } ((Field) b105).set(null, objArr6); try { Long valueOf7 = Long.valueOf(((Long) Class.forName(str).getDeclaredMethod(str2, new Class[0]).invoke(null, new Object[0])).longValue()); Object b108 = fgk.b(0x2c5e649b); if (b108 == null) { char green3 = (char) Color.green(0); int maximumDrawingCacheSize3 = (ViewConfiguration.getMaximumDrawingCacheSize() >> 24) + 10398; int deadChar = 6 - KeyEvent.getDeadChar(0, 0); byte b109 = (byte) 0; byte b110 = b109; Object[] objArr107 = new Object[1]; j(b109, b110, (byte) (b110 | 6), objArr107); b108 = fgk.d(green3, maximumDrawingCacheSize3, deadChar, 0x1a99ec98, false, (String) objArr107[0], (Class[]) null); } ((Field) b108).set(null, valueOf7); } catch (Exception unused7) { throw new RuntimeException(); } } i5 = ((int[]) objArr6[0])[0]; i6 = ((int[]) objArr6[3])[0]; if (i6 == i5) { } } private static void g(int i2, char[] cArr, Object[] objArr) { int i3 = 2 % 2; abry abryVar = new abry(); char[] cArr2 = new char[cArr.length]; int i4 = 0; abryVar.b = 0; char[] cArr3 = new char[2]; while (abryVar.b < cArr.length) { cArr3[i4] = cArr[abryVar.b]; cArr3[1] = cArr[abryVar.b + 1]; int i5 = $11 + 23; $10 = i5 % 128; if (i5 % 2 != 0) { int i6 = 4 % 4; } int i7 = 58224; int i8 = i4; while (i8 < 16) { char c2 = cArr3[1]; char c3 = cArr3[i4]; int i9 = (c3 + i7) ^ ((c3 << 4) + ((char) (e ^ (-975154066375451040L)))); int i10 = c3 >>> 5; try { Object[] objArr2 = new Object[4]; objArr2[3] = Integer.valueOf(c); objArr2[2] = Integer.valueOf(i10); objArr2[1] = Integer.valueOf(i9); objArr2[i4] = Integer.valueOf(c2); Object b2 = fgk.b(0x5ceeba29); if (b2 == null) { char trimmedLength = (char) (26487 - TextUtils.getTrimmedLength("")); int lastIndexOf = TextUtils.lastIndexOf("", '0', i4) + 11587; int resolveOpacity = Drawable.resolveOpacity(i4, i4) + 6; Class[] clsArr = new Class[4]; clsArr[i4] = Integer.TYPE; clsArr[1] = Integer.TYPE; clsArr[2] = Integer.TYPE; clsArr[3] = Integer.TYPE; b2 = fgk.d(trimmedLength, lastIndexOf, resolveOpacity, 0x6a29322a, false, "x", clsArr); } char charValue = ((Character) ((Method) b2).invoke(null, objArr2)).charValue(); cArr3[1] = charValue; char[] cArr4 = cArr3; Object[] objArr3 = {Integer.valueOf(cArr3[i4]), Integer.valueOf((charValue + i7) ^ ((charValue << 4) + ((char) (d ^ (-975154066375451040L))))), Integer.valueOf(charValue >>> 5), Integer.valueOf(b)}; Object b3 = fgk.b(0x5ceeba29); if (b3 == null) { b3 = fgk.d((char) ((AudioTrack.getMinVolume() > 0.0f ? 1 : (AudioTrack.getMinVolume() == 0.0f ? 0 : -1)) + 26487), Color.alpha(0) + 11586, (TypedValue.complexToFraction(0, 0.0f, 0.0f) > 0.0f ? 1 : (TypedValue.complexToFraction(0, 0.0f, 0.0f) == 0.0f ? 0 : -1)) + 6, 0x6a29322a, false, "x", new Class[]{Integer.TYPE, Integer.TYPE, Integer.TYPE, Integer.TYPE}); } cArr4[0] = ((Character) ((Method) b3).invoke(null, objArr3)).charValue(); i7 -= 40503; i8++; int i11 = $10 + 59; $11 = i11 % 128; int i12 = i11 % 2; cArr3 = cArr4; i4 = 0; } catch (Throwable th) { Throwable cause = th.getCause(); if (cause == null) { throw th; } throw cause; } } char[] cArr5 = cArr3; cArr2[abryVar.b] = cArr5[0]; cArr2[abryVar.b + 1] = cArr5[1]; Object[] objArr4 = {abryVar, abryVar}; Object b4 = fgk.b(0x5a5866a0); if (b4 == null) { byte b5 = (byte) 0; byte b6 = b5; b4 = fgk.d((char) (ViewConfiguration.getFadingEdgeLength() >> 16), (ViewConfiguration.getGlobalActionKeyTimeout() > 0L ? 1 : (ViewConfiguration.getGlobalActionKeyTimeout() == 0L ? 0 : -1)) + 10397, 6 - (TypedValue.complexToFloat(0) > 0.0f ? 1 : (TypedValue.complexToFloat(0) == 0.0f ? 0 : -1)), 0x6c9feea3, false, $$g(b5, b6, b6), new Class[]{Object.class, Object.class}); } ((Method) b4).invoke(null, objArr4); cArr3 = cArr5; i4 = 0; } String str = new String(cArr2, 0, i2); int i13 = $10 + 37; $11 = i13 % 128; if (i13 % 2 != 0) { objArr[0] = str; } else { int i14 = 52 / 0; objArr[0] = str; } } static zzx zzb(String str, boolean z, boolean z2, boolean z3) { int i2 = 2 % 2; int i3 = h + 111; i = i3 % 128; return i3 % 2 != 0 ? zzi(str, z, false, true, true) : zzi(str, z, false, false, true); } static zzx zzc(String str, boolean z, boolean z2, boolean z3) { int i2 = 2 % 2; int i3 = h + 57; i = i3 % 128; int i4 = i3 % 2; zzx zzi = zzi(str, z, false, false, false); int i5 = h + 7; i = i5 % 128; int i6 = i5 % 2; return zzi; } static String zzd(boolean z, String str, zzj zzjVar) throws Exception { String str2; int i2 = 2 % 2; int i3 = h + 109; i = i3 % 128; if (i3 % 2 != 0) { throw null; } if (z || !zzh(str, zzjVar, true, false).zza) { str2 = "not allowed"; } else { str2 = "debug cert rejected"; } MessageDigest zza2 = AndroidUtilsLight.zza("SHA-256"); Preconditions.checkNotNull(zza2); String format = String.format("%s: pkg=%s, sha256=%s, atk=%s, ver=%s", str2, str, Hex.bytesToStringLowercase(zza2.digest(zzjVar.zzf())), Boolean.valueOf(z), "12451000.false"); int i4 = i + 67; h = i4 % 128; int i5 = i4 % 2; return format; } static void zze(Context context) { synchronized (zzn.class) { if (zzg != null) { Log.w("GoogleCertificates", "GoogleCertificates has been initialized already"); } else if (context != null) { zzg = context.getApplicationContext(); } } } private static void zzj() throws DynamiteModule.LoadingException { if (zze != null) { return; } Preconditions.checkNotNull(zzg); synchronized (zzf) { if (zze == null) { zze = zzae.zzb(DynamiteModule.load(zzg, DynamiteModule.PREFER_HIGHEST_OR_LOCAL_VERSION_NO_FORCE_STAGING, "com.google.android.gms.googlecertificates").instantiate("com.google.android.gms.common.GoogleCertificatesImpl")); } } } private static zzx zzh(String str, zzj zzjVar, boolean z, boolean z2) { int i2 = 2 % 2; try { zzj(); Preconditions.checkNotNull(zzg); try { if (zze.zzh(new zzs(str, zzjVar, z, z2), ObjectWrapper.wrap(zzg.getPackageManager()))) { int i3 = h + 17; i = i3 % 128; int i4 = i3 % 2; return zzx.zzb(); } zzv zzvVar = new zzv(new zze(z, str, zzjVar), (zzu) null); int i5 = h + 9; i = i5 % 128; if (i5 % 2 != 0) { int i6 = 82 / 0; } return zzvVar; } catch (RemoteException e2) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e2); return zzx.zzd("module call", e2); } catch (Exception e3) { throw e3; } } catch (DynamiteModule.LoadingException e4) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e4); return zzx.zzd("module init: ".concat(String.valueOf(e4.getMessage())), e4); } } /* JADX WARN: Multi-variable type inference failed */ /* JADX WARN: Type inference failed for: r1v3, types: [int] */ /* JADX WARN: Type inference failed for: r1v6 */ /* JADX WARN: Type inference failed for: r1v8 */ /* JADX WARN: Type inference failed for: r1v9 */ static zzx zza(String str, zzj zzjVar, boolean z, boolean z2) { zzx zzh; int i2 = 2 % 2; int i3 = h + 5; i = i3 % 128; StrictMode.ThreadPolicy threadPolicy = i3 % 2; try { if (threadPolicy != 0) { StrictMode.ThreadPolicy allowThreadDiskReads = StrictMode.allowThreadDiskReads(); zzh = zzh(str, zzjVar, z, z2); StrictMode.setThreadPolicy(allowThreadDiskReads); int i4 = 98 / 0; threadPolicy = allowThreadDiskReads; } else { StrictMode.ThreadPolicy allowThreadDiskReads2 = StrictMode.allowThreadDiskReads(); zzh = zzh(str, zzjVar, z, z2); } int i5 = h + 29; i = i5 % 128; if (i5 % 2 == 0) { return zzh; } throw null; } finally { StrictMode.setThreadPolicy(threadPolicy); } } static boolean zzf() { int i2 = 2 % 2; int i3 = i + 121; h = i3 % 128; int i4 = i3 % 2; StrictMode.ThreadPolicy allowThreadDiskReads = StrictMode.allowThreadDiskReads(); try { try { zzj(); return zze.zzg(); } finally { StrictMode.setThreadPolicy(allowThreadDiskReads); } } catch (DynamiteModule.LoadingException | RemoteException e2) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e2); StrictMode.setThreadPolicy(allowThreadDiskReads); int i5 = i + 85; h = i5 % 128; int i6 = i5 % 2; return false; } } static boolean zzg() { int i2 = 2 % 2; int i3 = i + 27; h = i3 % 128; int i4 = i3 % 2; StrictMode.ThreadPolicy allowThreadDiskReads = StrictMode.allowThreadDiskReads(); try { try { zzj(); boolean zzi = zze.zzi(); StrictMode.setThreadPolicy(allowThreadDiskReads); int i5 = h + 87; i = i5 % 128; if (i5 % 2 == 0) { return zzi; } throw null; } catch (Throwable th) { StrictMode.setThreadPolicy(allowThreadDiskReads); throw th; } } catch (DynamiteModule.LoadingException | RemoteException e2) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e2); StrictMode.setThreadPolicy(allowThreadDiskReads); return false; } } /* JADX WARN: Multi-variable type inference failed */ /* JADX WARN: Type inference failed for: r11v1, types: [java.lang.String] */ /* JADX WARN: Type inference failed for: r11v6 */ private static zzx zzi(String str, boolean z, boolean z2, boolean z3, boolean z4) { zzx zzd2; zzq zzf2; String str2 = "Failed to get Google certificates from remote"; String str3 = "GoogleCertificates"; int i2 = 2 % 2; StrictMode.ThreadPolicy allowThreadDiskReads = StrictMode.allowThreadDiskReads(); try { Preconditions.checkNotNull(zzg); try { zzj(); zzo zzoVar = new zzo(str, z, false, ObjectWrapper.wrap(zzg), false); try { if (z4) { int i3 = i + 31; h = i3 % 128; int i4 = i3 % 2; zzf2 = zze.zze(zzoVar); } else { zzf2 = zze.zzf(zzoVar); } str2 = 1; str3 = null; if (!zzf2.zzb()) { String zza2 = zzf2.zza(); PackageManager.NameNotFoundException nameNotFoundException = zzf2.zzd() == 4 ? new PackageManager.NameNotFoundException() : null; if (zza2 == null) { zza2 = "error checking package certificate"; } zzd2 = zzx.zzg(zzf2.zzc(), zzf2.zzd(), zza2, nameNotFoundException); int i5 = h + 39; i = i5 % 128; int i6 = i5 % 2; } else { int i7 = h + 37; i = i7 % 128; if (i7 % 2 != 0) { zzx.zzf(zzf2.zzc()); str3.hashCode(); throw null; } zzd2 = zzx.zzf(zzf2.zzc()); } } catch (RemoteException e2) { Log.e(str3, str2, e2); zzd2 = zzx.zzd("module call", e2); } } catch (DynamiteModule.LoadingException e3) { Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e3); zzd2 = zzx.zzd("module init: ".concat(String.valueOf(e3.getMessage())), e3); } StrictMode.setThreadPolicy(allowThreadDiskReads); int i8 = i + 81; h = i8 % 128; int i9 = i8 % 2; return zzd2; } catch (Throwable th) { StrictMode.setThreadPolicy(allowThreadDiskReads); throw th; } } static void e() { d = (char) 396; b = (char) 55775; e = (char) 3241; c = (char) 25637; } }
全局视角：加固前后代码对比分析
一、类结构对比
加固前结构
text
zzn
├── 静态常量: zza, zzb, zzc, zzd (证书)
├── 静态变量: zze, zzf, zzg
└── 方法: zza, zzb, zzc, zzd, zze, zzf, zzg, zzh, zzi, zzj加固后结构
text
zzn
├── 加密数据: $$a, $$b, $$c, $$d, $$e, $$f (新增)
├── 状态变量: a, b, c, d, e, f, h, i, $10, $11 (新增)
├── 静态常量: zza, zzb, zzc, zzd (保留但初始化方式改变)
├── 静态变量: zze, zzf, zzg (保留)
├── 解密函数: $$g, j, k, g, e (新增)
└── 业务方法: zza, zzb, zzc, zzd, zze, zzf, zzg, zzh, zzi, zzj (保留但被混淆)二、静态初始化块 <clinit> 对比
加固前（约15行）
Java
static {
zza = new zzf(zzj.zze("0\u0082\u0005È...")); // 直接初始化证书1
zzb = new zzg(zzj.zze("0\u0082\u0006\u0004...")); // 直接初始化证书2
zzc = new zzh(zzj.zze("0\u0082\u0004C...")); // 直接初始化证书3
zzd = new zzi(zzj.zze("0\u0082\u0004¨...")); // 直接初始化证书4
zzf = new Object(); // 锁对象
}加固后（约2000+行）
Java
static {
// ===== 阶段1: 初始化混淆状态 =====
a = 0; f = 1;
e(); // 初始化解密密钥 d, b, e, c
// ===== 阶段2: 时间戳完整性检查 #1 =====
Object[] objArr18 = new Object[1];
g(22 - (AudioTrack.getMinVolume() > 0.0f ? 1 : 0),
new char[]{48209, 12547...}, objArr18); // 解密类名
String str7 = (String) objArr18[0]; // "java.lang.System" 或类似
// 获取当前时间并与存储的时间戳比较
Object b2 = fgk.b(-1489550552); // 反射获取时间戳字段
long j = ((Field) b2).getLong(null);
if (j == -1 || j + 1962 < currentTime) {
// 首次运行或时间戳过期：重新初始化
// ... 复杂的初始化逻辑
} else {
// 时间戳有效：从缓存加载
// ... 状态恢复逻辑
}
// ===== 阶段3: 时间戳完整性检查 #2 =====
// 类似的检查逻辑，针对不同的保护区域
// ===== 阶段4: 时间戳完整性检查 #3 =====
// ...
// ===== 阶段5: 动态模块加载检查 =====
// 获取应用上下文
Context context = (Context) cls.getMethod("getApplicationContext")
.invoke(null, null);
// 加载加密的证书数据
Object[] objArr36 = {context, new String[]{str9, str10}, 0, 2, -2062752758};
objArr3 = (Object[]) cls2.getMethod(...).invoke(null, objArr36);
// ===== 阶段6: 多重状态机验证 =====
// 通过复杂的数组操作和数学运算验证状态一致性
int i52 = ((int[]) objArr3[0])[0];
int i53 = ((int[]) objArr3[2])[0];
if (i53 != i52) {
// 状态不一致：触发报告机制
ArrayList arrayList2 = new ArrayList();
// ... 收集异常信息
((Method) b32).invoke(invoke2, objArr44); // 上报
// 触发崩溃陷阱
Toast.makeText((Context) null, iArr5[...], 1).show();
}
// ===== 阶段7~12: 更多验证层 =====
// 每层都有类似结构：
// 1. 时间戳检查
// 2. 状态一致性验证
// 3. 异常处理/上报
// ===== 最终阶段: 证书初始化 =====
// 通过复杂的数学运算计算字符串截取位置
String concat = "30\\22\\14\\".concat("0\u0082\u0005È...");
int i254 = ((int[]) objArr5[1])[0];
// ... 复杂的位运算
int offset = 56007 / (((-(((i267 & 1) + (i267 | 1)) - (-1))) & i265) * 889);
zza = new zzf(zzj.zze(concat.substring(offset))); // 最终初始化证书
zzb = new zzg(zzj.zze("..."));
zzc = new zzh(zzj.zze(concat2.substring(calculatedOffset2)));
zzd = new zzi(zzj.zze(concat3.substring(calculatedOffset3)));
zzf = new Object();
}静态初始化块核心区别总结
| 方面 | 加固前 | 加固后 |
|---|---|---|
| 代码行数 | ~15行 | ~2000行 |
| 证书数据 | 明文字符串 | 加密+动态计算偏移 |
| 初始化流程 | 直接赋值 | 多阶段验证后赋值 |
| 时间检查 | 无 | 6+层时间戳验证 |
| 状态管理 | 无 | 复杂状态机 |
| 异常处理 | 无 | 上报+崩溃陷阱 |
三、解密辅助函数（新增）
e() - 密钥初始化
Java
static void e() {
d = (char) 396;
b = (char) 55775;
e = (char) 3241;
c = (char) 25637;
}作用：初始化 TEA/XTEA 解密算法的密钥
$$g() - 短字符串解密
Java
private static String $$g(short s, byte b2, byte b3) {
int i4 = 3 - (b3 * 3);
byte[] bArr = $$c; // {90, 86, 85, 117}
int i5 = (s * 3) + 121;
int i6 = 1 - (b2 * 4);
byte[] bArr2 = new byte[i6];
// 迭代解密
for (int i = 0; i < i6; i++) {
bArr2[i] = (byte) ((-bArr[i4++]) + previousValue);
}
return new String(bArr2, 0);
}作用：从 $$c 解密短字符串（如字段名）
j() - 中等字符串解密
Java
private static void j(byte b2, short s, byte b3, Object[] objArr) {
int i5 = (s * 2) + 1;
byte[] bArr = $$a; // {76, 125, 119, 121}
int i6 = 105 - b3;
byte[] bArr2 = new byte[i5];
// 类似的迭代解密逻辑
objArr[0] = new String(bArr2, 0);
}作用：从 $$a 解密中等长度字符串
k() - 长字符串解密
Java
private static void k(int i2, byte b2, byte b3, Object[] objArr) {
int i4 = 111 - b3;
int i5 = 35 - b2;
byte[] bArr = $$d; // 较长的加密数据
byte[] bArr2 = new byte[i2 + 1];
// 解密逻辑
objArr[0] = new String(bArr2, 0);
}作用：从 $$d 解密长字符串（如完整类名）
g() - TEA/XTEA 字符串解密
Java
private static void g(int i2, char[] cArr, Object[] objArr) {
abry abryVar = new abry(); // 状态对象
char[] cArr2 = new char[cArr.length];
char[] cArr3 = new char[2]; // 2字符块
while (abryVar.b < cArr.length) {
cArr3[0] = cArr[abryVar.b];
cArr3[1] = cArr[abryVar.b + 1];
int i7 = 58224; // 初始 delta
for (int round = 0; round < 16; round++) {
// TEA 解密轮函数
char c2 = cArr3[1];
char c3 = cArr3[0];
int i9 = (c3 + i7) ^ ((c3 << 4) + ((char) (e ^ (-975154066375451040L))));
// ... 更多运算
cArr3[1] = decryptedChar1;
cArr3[0] = decryptedChar0;
i7 -= 40503; // delta 递减
}
cArr2[abryVar.b] = cArr3[0];
cArr2[abryVar.b + 1] = cArr3[1];
abryVar.b += 2;
}
objArr[0] = new String(cArr2, 0, i2);
}作用：使用变种 TEA 算法解密字符数组，主要用于解密类名和方法名
四、业务方法对比
zzb() - 证书验证入口1
加固前：
Java
static zzx zzb(String str, boolean z, boolean z2, boolean z3) {
return zzi(str, z, false, false, true);
}加固后：
Java
static zzx zzb(String str, boolean z, boolean z2, boolean z3) {
int i2 = 2 % 2;
int i3 = h + 111;
i = i3 % 128;
return i3 % 2 != 0
? zzi(str, z, false, true, true) // 这个分支永远不会执行正确逻辑
: zzi(str, z, false, false, true); // 实际执行的分支
}区别分析：
- 添加了不透明谓词
i3 % 2 - 表面上有两个分支，实际只有一个会执行
h和i是状态变量，用于混淆控制流
zzc() - 证书验证入口2
加固前：
Java
static zzx zzc(String str, boolean z, boolean z2, boolean z3) {
return zzi(str, z, false, false, false);
}加固后：
Java
static zzx zzc(String str, boolean z, boolean z2, boolean z3) {
int i2 = 2 % 2;
int i3 = h + 57;
i = i3 % 128;
int i4 = i3 % 2;
zzx zzi = zzi(str, z, false, false, false);
int i5 = h + 7;
i = i5 % 128;
int i6 = i5 % 2;
return zzi;
}区别分析：
- 前后添加了状态更新代码
- 实际逻辑未变
- 状态变量构成全局验证链
zzd() - 错误信息生成
加固前：
Java
static /* synthetic */ String zzd(boolean z, String str, zzj zzjVar) throws Exception {
String str2 = true != (!z ? zzh(str, zzjVar, true, false).zza : false)
? "not allowed"
: "debug cert rejected";
MessageDigest zza2 = AndroidUtilsLight.zza("SHA-256");
Preconditions.checkNotNull(zza2);
return String.format("%s: pkg=%s, sha256=%s, atk=%s, ver=%s",
str2, str,
Hex.bytesToStringLowercase(zza2.digest(zzjVar.zzf())),
Boolean.valueOf(z), "12451000.false");
}加固后：
Java
static String zzd(boolean z, String str, zzj zzjVar) throws Exception {
String str2;
int i2 = 2 % 2;
int i3 = h + 109;
i = i3 % 128;
if (i3 % 2 != 0) {
throw null; // 死代码/反调试陷阱
}
if (z || !zzh(str, zzjVar, true, false).zza) {
str2 = "not allowed";
} else {
str2 = "debug cert rejected";
}
MessageDigest zza2 = AndroidUtilsLight.zza("SHA-256");
Preconditions.checkNotNull(zza2);
String format = String.format("%s: pkg=%s, sha256=%s, atk=%s, ver=%s",
str2, str,
Hex.bytesToStringLowercase(zza2.digest(zzjVar.zzf())),
Boolean.valueOf(z), "12451000.false");
int i4 = i + 67;
h = i4 % 128;
int i5 = i4 % 2;
return format;
}区别分析：
- 逻辑被拆分为更清晰的 if-else
- 添加了
throw null陷阱（正常情况不会触发） - 状态变量更新
zze() - 上下文初始化
加固前：
Java
static synchronized void zze(Context context) {
if (zzg != null) {
Log.w("GoogleCertificates", "GoogleCertificates has been initialized already");
} else if (context != null) {
zzg = context.getApplicationContext();
}
}加固后：
Java
static void zze(Context context) {
synchronized (zzn.class) {
if (zzg != null) {
Log.w("GoogleCertificates", "GoogleCertificates has been initialized already");
} else if (context != null) {
zzg = context.getApplicationContext();
}
}
}区别分析：
- 同步方式从方法级改为代码块级
- 逻辑基本不变（此方法相对简单，混淆较少）
zzf() 和 zzg() - 布尔查询方法
加固前：
Java
static boolean zzf() {
StrictMode.ThreadPolicy policy = StrictMode.allowThreadDiskReads();
try {
zzj();
return zze.zzg();
} catch (RemoteException | DynamiteModule.LoadingException e) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e);
return false;
} finally {
StrictMode.setThreadPolicy(policy);
}
}加固后：
Java
static boolean zzf() {
int i2 = 2 % 2;
int i3 = i + 121;
h = i3 % 128;
int i4 = i3 % 2;
StrictMode.ThreadPolicy allowThreadDiskReads = StrictMode.allowThreadDiskReads();
try {
try {
zzj();
return zze.zzg();
} finally {
StrictMode.setThreadPolicy(allowThreadDiskReads);
}
} catch (DynamiteModule.LoadingException | RemoteException e2) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e2);
StrictMode.setThreadPolicy(allowThreadDiskReads);
int i5 = i + 85;
h = i5 % 128;
int i6 = i5 % 2;
return false;
}
}区别分析：
- 添加状态变量操作
- try-catch 结构稍有调整
- 核心逻辑不变
zza() - 核心证书验证
加固前：
Java
public static zzx zza(String str, zzj zzjVar, boolean z, boolean z2) {
StrictMode.ThreadPolicy policy = StrictMode.allowThreadDiskReads();
try {
return zzh(str, zzjVar, z, z2);
} finally {
StrictMode.setThreadPolicy(policy);
}
}加固后：
Java
static zzx zza(String str, zzj zzjVar, boolean z, boolean z2) {
zzx zzh;
int i2 = 2 % 2;
int i3 = h + 5;
i = i3 % 128;
StrictMode.ThreadPolicy threadPolicy = i3 % 2; // 类型混淆！
try {
if (threadPolicy != 0) { // 不透明谓词
StrictMode.ThreadPolicy allowThreadDiskReads = StrictMode.allowThreadDiskReads();
zzh = zzh(str, zzjVar, z, z2);
StrictMode.setThreadPolicy(allowThreadDiskReads);
int i4 = 98 / 0; // 死代码，制造异常
threadPolicy = allowThreadDiskReads;
} else {
StrictMode.ThreadPolicy allowThreadDiskReads2 = StrictMode.allowThreadDiskReads();
zzh = zzh(str, zzjVar, z, z2);
}
int i5 = h + 29;
i = i5 % 128;
if (i5 % 2 == 0) {
return zzh;
}
throw null; // 死代码
} finally {
StrictMode.setThreadPolicy(threadPolicy);
}
}区别分析：
- 严重的类型混淆（int 赋值给 ThreadPolicy 引用）
- 两个看似不同的分支
- 添加死代码
98 / 0和throw null - Jadx 反编译警告表明混淆成功
zzh() - 实际证书检查
加固前：
Java
private static zzx zzh(String str, zzj zzjVar, boolean z, boolean z2) {
try {
zzj();
Preconditions.checkNotNull(zzg);
try {
if (zze.zzh(new zzs(str, zzjVar, z, z2),
ObjectWrapper.wrap(zzg.getPackageManager()))) {
return zzx.zzb();
}
return new zzv(new Callable() {
@Override
public Object call() {
return zzn.zzd(z, str, zzjVar);
}
}, null);
} catch (RemoteException e) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e);
return zzx.zzd("module call", e);
}
} catch (DynamiteModule.LoadingException e2) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e2);
return zzx.zzd("module init: ".concat(String.valueOf(e2.getMessage())), e2);
}
}加固后：
Java
private static zzx zzh(String str, zzj zzjVar, boolean z, boolean z2) {
int i2 = 2 % 2;
try {
zzj();
Preconditions.checkNotNull(zzg);
try {
if (zze.zzh(new zzs(str, zzjVar, z, z2),
ObjectWrapper.wrap(zzg.getPackageManager()))) {
int i3 = h + 17;
i = i3 % 128;
int i4 = i3 % 2;
return zzx.zzb();
}
zzv zzvVar = new zzv(new zze(z, str, zzjVar), (zzu) null);
int i5 = h + 9;
i = i5 % 128;
if (i5 % 2 != 0) {
int i6 = 82 / 0; // 死代码
}
return zzvVar;
} catch (RemoteException e2) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e2);
return zzx.zzd("module call", e2);
} catch (Exception e3) {
throw e3;
}
} catch (DynamiteModule.LoadingException e4) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e4);
return zzx.zzd("module init: ".concat(String.valueOf(e4.getMessage())), e4);
}
}区别分析：
- Lambda 表达式被替换为具体类
zze - 添加状态变量操作和死代码
- 添加了额外的
catch (Exception e3)块
zzi() - 扩展证书验证
加固前：
Java
private static zzx zzi(String str, boolean z, boolean z2, boolean z3, boolean z4) {
StrictMode.ThreadPolicy policy = StrictMode.allowThreadDiskReads();
try {
Preconditions.checkNotNull(zzg);
zzj();
zzo zzoVar = new zzo(str, z, false, ObjectWrapper.wrap(zzg), false, true);
zzq result = z4 ? zze.zze(zzoVar) : zze.zzf(zzoVar);
if (result.zzb()) {
return zzx.zzf(result.zzc());
} else {
String msg = result.zza();
Exception ex = result.zzd() == 4 ? new PackageManager.NameNotFoundException() : null;
if (msg == null) msg = "error checking package certificate";
return zzx.zzg(result.zzc(), result.zzd(), msg, ex);
}
} catch (DynamiteModule.LoadingException | RemoteException e) {
Log.e("GoogleCertificates", "...", e);
return zzx.zzd("...", e);
} finally {
StrictMode.setThreadPolicy(policy);
}
}加固后：
Java
private static zzx zzi(String str, boolean z, boolean z2, boolean z3, boolean z4) {
zzx zzd2;
zzq zzf2;
String str2 = "Failed to get Google certificates from remote";
String str3 = "GoogleCertificates";
int i2 = 2 % 2;
StrictMode.ThreadPolicy allowThreadDiskReads = StrictMode.allowThreadDiskReads();
try {
// 字符串被提取为局部变量，然后在某些分支中被重新赋值
allowThreadDiskReads = Preconditions.checkNotNull(zzg); // 类型混淆
try {
zzj();
zzo zzoVar = new zzo(str, z, false, ObjectWrapper.wrap(zzg), false);
try {
if (z4) {
int i3 = i + 31;
h = i3 % 128;
int i4 = i3 % 2;
zzf2 = zze.zze(zzoVar);
} else {
zzf2 = zze.zzf(zzoVar);
}
str2 = 1; // 重新赋值为整数！类型混淆
str3 = null;
if (!zzf2.zzb()) {
String zza2 = zzf2.zza();
PackageManager.NameNotFoundException ex =
zzf2.zzd() == 4 ? new PackageManager.NameNotFoundException() : null;
if (zza2 == null) {
zza2 = "error checking package certificate";
}
zzd2 = zzx.zzg(zzf2.zzc(), zzf2.zzd(), zza2, ex);
int i5 = h + 39;
i = i5 % 128;
int i6 = i5 % 2;
} else {
int i7 = h + 37;
i = i7 % 128;
if (i7 % 2 != 0) {
zzx.zzf(zzf2.zzc());
str3.hashCode(); // 空指针陷阱
throw null;
}
zzd2 = zzx.zzf(zzf2.zzc());
}
} catch (RemoteException e2) {
Log.e(str3, str2, e2); // 使用可能被污染的变量
zzd2 = zzx.zzd("module call", e2);
}
} catch (DynamiteModule.LoadingException e3) {
Log.e("GoogleCertificates", "...", e3);
zzd2 = zzx.zzd("module init: ".concat(String.valueOf(e3.getMessage())), e3);
}
StrictMode.setThreadPolicy(allowThreadDiskReads);
int i8 = i + 81;
h = i8 % 128;
int i9 = i8 % 2;
return zzd2;
} catch (Throwable th) {
StrictMode.setThreadPolicy(allowThreadDiskReads);
throw th;
}
}区别分析：
- 大量类型混淆（String 赋值为 int，ThreadPolicy 赋值为 Context）
- 字符串变量被动态重新赋值
- 添加空指针陷阱
str3.hashCode() zzo构造函数参数数量改变- 状态变量操作贯穿整个方法
zzj() - 模块加载
加固前：
Java
private static void zzj() throws DynamiteModule.LoadingException {
if (zze != null) {
return;
}
Preconditions.checkNotNull(zzg);
synchronized (zzf) {
if (zze == null) {
zze = zzaf.zzb(DynamiteModule.load(zzg,
DynamiteModule.PREFER_HIGHEST_OR_LOCAL_VERSION_NO_FORCE_STAGING,
"com.google.android.gms.googlecertificates")
.instantiate("com.google.android.gms.common.GoogleCertificatesImpl"));
}
}
}加固后： 基本相同（此方法混淆较少）
Java
private static void zzj() throws DynamiteModule.LoadingException {
if (zze != null) {
return;
}
Preconditions.checkNotNull(zzg);
synchronized (zzf) {
if (zze == null) {
zze = zzae.zzb(DynamiteModule.load(zzg,
DynamiteModule.PREFER_HIGHEST_OR_LOCAL_VERSION_NO_FORCE_STAGING,
"com.google.android.gms.googlecertificates")
.instantiate("com.google.android.gms.common.GoogleCertificatesImpl"));
}
}
}区别分析：
zzaf变为zzae（可能是版本差异或混淆）- 其他逻辑不变
五、全局状态机分析
加固后代码引入了一个贯穿所有方法的状态机：
Java
private static int a; // 状态变量 A
private static int f; // 状态变量 F
private static int i = 0; // 状态变量 I
private static int h = 1; // 状态变量 H
private static int $10 = 0; // 额外状态
private static int $11 = 1; // 额外状态状态更新模式
Java
// 模式1：更新 i 和 h
int i3 = h + 111;
i = i3 % 128; // i 总是在 0-127 范围内
// 模式2：更新 a 和 f
int i54 = f + 43;
a = i54 % 128;
// 模式3：在 g() 函数中更新 $10 和 $11
int i5 = $11 + 23;
$10 = i5 % 128;状态验证
Java
// 状态被用于生成不透明谓词
if (i3 % 2 != 0) {
// 分支 A
} else {
// 分支 B
}状态机目的：
- 使静态分析无法确定分支走向
- 构建方法调用链的隐式验证
- 检测代码是否被修改（状态不一致 = 篡改）
六、总结对比表
一、加固方案识别与特征分析
通过对比两个版本，该加固方案具有以下核心特征：
1.1 混淆特征矩阵
| 混淆类型 | 原版 | 加固版 | 混淆程度 |
|---|---|---|---|
| 字符串加密 | 明文 | 多层加密 | 高 |
| 控制流 | 线性 | 不透明谓词+伪造分支 | 极高 |
| 数值常量 | 直接值 | 复杂位运算 | 高 |
| 反射调用 | 无 | 大量动态反射 | 高 |
| 完整性校验 | 无 | 时间戳+签名校验 | 中 |
| 防调试 | 无 | 多重检测 | 中 |
1.2 关键混淆组件识别
text
核心混淆类:
├── o.fgk - 反射调用门面类（动态方法/字段访问）
├── o.abry - 字符串解密辅助类（循环计数器）
├── $$a/$$c/$$d - 加密字节数组（存储加密数据）
├── $$g/j/k - 字符串解密方法
└── 静态初始化块 - 完整性校验+动态解密入口二、还原流程概述
text
┌─────────────────────────────────────────────────────────────────┐
│ 完整还原流程 │
├─────────────────────────────────────────────────────────────────┤
│ 阶段1: 环境准备 → 阶段2: 字符串解密 → 阶段3: 反射还原 │
│ ↓ │
│ 阶段4: 控制流简化 → 阶段5: 数值还原 → 阶段6: 代码重构 │
│ ↓ │
│ 阶段7: 验证测试 → 阶段8: 功能对比 │
└─────────────────────────────────────────────────────────────────┘三、阶段1：环境准备与工具配置
3.1 必需工具清单
Bash
# 反编译工具
jadx-gui >= 1.4.7 # 主力反编译器
apktool >= 2.7.0 # APK解包/重打包
dex2jar # dex转jar
# 动态分析工具
frida >= 16.0 # Hook框架
objection # Frida封装
android-studio # 调试环境
# 辅助工具
python >= 3.8 # 脚本编写
jeb-decompiler # 商业反编译器(可选)
ghidra # 逆向工程套件3.2 分析环境搭建
Python
# 创建分析项目结构
project/
├── original/ # 原版代码
├── obfuscated/ # 加固版代码
├── scripts/ # 还原脚本
│ ├── string_decrypt.py
│ ├── reflection_resolve.py
│ └── control_flow_simplify.py
├── hooks/ # Frida脚本
├── output/ # 还原输出
└── logs/ # 分析日志四、阶段2：字符串解密还原
4.1 解密方法分析
方法 $$g 分析：
Java
// 加固版中的字符串解密方法
private static String $$g(short s, byte b2, byte b3) {
int i4 = 3 - (b3 * 3); // 计算偏移量
byte[] bArr = $$c; // 加密字节数组
int i5 = (s * 3) + 121; // 初始种子
int i6 = 1 - (b2 * 4); // 输出长度
byte[] bArr2 = new byte[i6];
// ... 解密循环
}方法 j 分析：
Java
private static void j(byte b2, short s, byte b3, Object[] objArr) {
int i4 = 4 - (b2 * 3); // 偏移计算
int i5 = (s * 2) + 1; // 长度计算
byte[] bArr = $$a; // 加密数据源
int i6 = 105 - b3; // 初始值
// XOR解密逻辑
}方法 k 分析：
Java
private static void k(int i2, byte b2, byte b3, Object[] objArr) {
int i4 = 111 - b3; // 初始偏移
int i5 = 35 - b2; // 数组索引
byte[] bArr = $$d; // 加密数据源
// 复合解密运算
}4.2 Python解密脚本实现
Python
# scripts/string_decrypt.py
class StringDecryptor:
def __init__(self):
# 从加固版提取的加密字节数组
self.array_c = bytes([90, 86, 85, 117])
self.array_a = bytes([76, 125, 119, 121])
self.array_d = bytes([108, -48 & 0xFF, 10, 71, -61 & 0xFF, 55, 6, 25,
-3 & 0xFF, -73 & 0xFF, 65, -61 & 0xFF, 80,
-10 & 0xFF, 16, -80 & 0xFF, 65, -61 & 0xFF,
75, 2, -13 & 0xFF, -58 & 0xFF, 72, -61 & 0xFF,
78, -7 & 0xFF, -8 & 0xFF, -57 & 0xFF, 17,
-61 & 0xFF, 66, -1 & 0xFF, -1 & 0xFF, -58 & 0xFF, 78])
def decrypt_g(self, s: int, b2: int, b3: int) -> str:
"""还原 $$g 方法"""
i4 = 3 - (b3 * 3)
bArr = self.array_c
i5 = (s * 3) + 121
i6 = 1 - (b2 * 4)
result = bytearray(i6)
i2 = 0
while i2 < i6:
result[i2] = ((-i5) + i6) & 0xFF
i3 = i2 + 1
if i3 >= i6:
break
i4 += 1
i11 = bArr[i4] if i4 < len(bArr) else 0
i5 = (-i11) + result[i2]
i2 = i3
return result.decode('utf-8', errors='ignore')
def decrypt_j(self, b2: int, s: int, b3: int) -> str:
"""还原 j 方法"""
i4 = 4 - (b2 * 3)
i5 = (s * 2) + 1
bArr = self.array_a
i6 = 105 - b3
result = bytearray(i5)
i2 = 0
while i2 < i5:
result[i2] = i6 & 0xFF
i3 = i2 + 1
if i3 >= i5:
break
i7 = i6
i4 += 1
i6 = ((-bArr[i4] if i4 < len(bArr) else 0) + i7) & 0xFF
i2 = i3
return result.decode('utf-8', errors='ignore')
def decrypt_k(self, i2: int, b2: int, b3: int) -> str:
"""还原 k 方法"""
i4 = 111 - b3
i5 = 35 - b2
bArr = self.array_d
result = bytearray(i2 + 1)
i3 = 0
while i3 <= i2:
result[i3] = i4 & 0xFF
if i3 >= i2:
break
i8 = i5 + 1
val = bArr[i8] if i8 < len(bArr) else 0
i4 = (i4 + val) - 4
i5 = i8
i3 += 1
return result.decode('utf-8', errors='ignore')
# 使用示例
decryptor = StringDecryptor()
# 解密代码中的调用
# j(b9, b10, (byte) (b10 | 8), objArr23)
# 参数: b9=0, b10=0, b3=8
print(decryptor.decrypt_j(0, 0, 8)) # 输出解密结果4.3 Frida动态解密Hook
JavaScript
// hooks/string_decrypt_hook.js
Java.perform(function() {
console.log("[*] Starting string decryption hook");
var zzn = Java.use("com.google.android.gms.common.zzn");
// Hook $$g 方法
var $$g = zzn.class.getDeclaredMethod("$$g",
Java.use("short").class,
Java.use("byte").class,
Java.use("byte").class);
$$g.setAccessible(true);
// 包装调用
var originalG = $$g;
zzn["$$g"].implementation = function(s, b2, b3) {
var result = this["$$g"](s, b2, b3);
console.log("[$$g] params: s=" + s + ", b2=" + b2 + ", b3=" + b3);
console.log("[$$g] decrypted: " + result);
return result;
};
// Hook j 方法
zzn.j.implementation = function(b2, s, b3, objArr) {
this.j(b2, s, b3, objArr);
console.log("[j] params: b2=" + b2 + ", s=" + s + ", b3=" + b3);
console.log("[j] decrypted: " + objArr[0]);
};
// Hook k 方法
zzn.k.implementation = function(i2, b2, b3, objArr) {
this.k(i2, b2, b3, objArr);
console.log("[k] params: i2=" + i2 + ", b2=" + b2 + ", b3=" + b3);
console.log("[k] decrypted: " + objArr[0]);
};
});4.4 方法 g 的复杂解密还原
Python
# g 方法使用了 TEA 变体加密
class TEADecryptor:
def __init__(self):
# 从静态初始化块 e() 方法提取的密钥
self.d = 396
self.b = 55775
self.e = 3241
self.c = 25637
def decrypt_g(self, length: int, encrypted: list) -> str:
"""
还原 g 方法 - TEA变体解密
"""
result = [0] * len(encrypted)
temp = [0, 0]
pos = 0
while pos < len(encrypted):
temp[0] = encrypted[pos]
temp[1] = encrypted[pos + 1]
delta = 58224
for _ in range(16):
c1 = temp[1]
c0 = temp[0]
# 解密轮函数
v1 = (c0 + delta) ^ ((c0 << 4) + (self.e ^ (-975154066375451040)))
v2 = c0 >> 5
temp[1] = (c1 ^ v1 ^ (v2 + self.c)) & 0xFFFF
v3 = (temp[1] + delta) ^ ((temp[1] << 4) + (self.d ^ (-975154066375451040)))
v4 = temp[1] >> 5
temp[0] = (c0 ^ v3 ^ (v4 + self.b)) & 0xFFFF
delta -= 40503
result[pos] = temp[0]
result[pos + 1] = temp[1]
pos += 2
return ''.join(chr(c & 0xFFFF) for c in result[:length])五、阶段3：反射调用还原
5.1 fgk 类功能分析
Java
// fgk 类是一个反射调用缓存门面
// fgk.b(int hash) - 通过hash查找缓存的反射对象
// fgk.d(char, int, int, int, boolean, String, Class[]) - 动态获取Method/Field/Constructor5.2 反射目标解析表
通过分析调用参数，建立映射表：
Python
# scripts/reflection_resolve.py
REFLECTION_MAP = {
# hash值 -> 实际目标
-1489550552: {
'type': 'Field',
'class': 'o.xxx', # 需要动态分析确定
'name': 'timestamp_field',
'signature': 'J' # long类型
},
0x6c524511: {
'type': 'Method',
'class': 'o.yyy',
'name': 'initArray',
'params': ['int', 'int', 'int'],
'return': 'Object[]'
},
0x20d9a7e6: {
'type': 'Method',
'class': 'protector_class',
'name': 'c',
'params': [],
'return': 'Object'
},
-185514598: {
'type': 'Method',
'class': 'protector_class',
'name': 'c',
'params': ['int', 'long', 'List', 'String', 'boolean'],
'return': 'void'
},
# ... 其他映射
}
def resolve_reflection(hash_value: int) -> dict:
"""解析反射调用目标"""
return REFLECTION_MAP.get(hash_value, {'type': 'unknown'})5.3 Frida Hook反射调用
JavaScript
// hooks/reflection_hook.js
Java.perform(function() {
var fgk = Java.use("o.fgk");
// Hook fgk.b - 缓存查找
fgk.b.overload('int').implementation = function(hash) {
var result = this.b(hash);
console.log("[fgk.b] hash: 0x" + hash.toString(16));
if (result != null) {
console.log("[fgk.b] result: " + result.toString());
}
return result;
};
// Hook fgk.d - 动态获取
fgk.d.implementation = function(c, i1, i2, i3, b, s, classes) {
var result = this.d(c, i1, i2, i3, b, s, classes);
console.log("[fgk.d] params: char=" + c +
", i1=" + i1 + ", i2=" + i2 + ", i3=" + i3 +
", bool=" + b + ", str=" + s);
if (classes != null) {
var classNames = [];
for (var i = 0; i < classes.length; i++) {
classNames.push(classes[i].getName());
}
console.log("[fgk.d] classes: " + JSON.stringify(classNames));
}
console.log("[fgk.d] result: " + result);
return result;
};
});5.4 反射调用静态还原
Java
// 加固版代码片段:
Object b2 = fgk.b(-1489550552);
if (b2 == null) {
char alpha = (char) (Color.alpha(0) + 31822); // = 31822 = 0x7C4E
int makeMeasureSpec = 10472 - View.MeasureSpec.makeMeasureSpec(0, 0); // = 10472
int capsMode = 6 - TextUtils.getCapsMode("", 0, 0); // = 6
Object[] objArr20 = new Object[1];
j((byte)0, (byte)0, (byte)5, objArr20); // 解密字段名
b2 = fgk.d(alpha, makeMeasureSpec, capsMode, -1846490325, false,
(String) objArr20[0], (Class[]) null);
}
long j = ((Field) b2).getLong(null);
// 还原后:
// 字段名解密结果: "a" (假设)
// 类名通过参数计算得出
Field targetField = SomeClass.class.getDeclaredField("a");
targetField.setAccessible(true);
long j = targetField.getLong(null);六、阶段4：控制流简化
6.1 识别不透明谓词
Java
// 加固版中的不透明谓词示例:
int i17 = ((int[]) objArr[1])[0];
int i18 = ((int[]) objArr[2])[0];
if (i18 == i17) { // 不透明谓词 - 运行时总是特定值
// 真实代码路径
} else {
// 伪造代码路径 (包含 Toast.makeText 等干扰代码)
}6.2 控制流分析脚本
Python
# scripts/control_flow_simplify.py
import re
from typing import List, Tuple
class ControlFlowAnalyzer:
def __init__(self, code: str):
self.code = code
self.opaque_predicates = []
def find_opaque_predicates(self) -> List[Tuple[int, str]]:
"""识别不透明谓词模式"""
patterns = [
# 模式1: 数组元素比较
r'if \(\(\(int\[\]\) objArr\[\d+\]\)\[0\] == \(\(int\[\]\) objArr\[\d+\]\)\[0\]\)',
# 模式2: 系统时间检查
r'if \(.+ \+ \d+ [<>]= .+\.invoke\(null.+\)\.longValue\(\)\)',
# 模式3: Random产生的条件
r'if \(new Random\(\)\.nextInt\(.+\) [<>=]+ \d+\)',
]
for pattern in patterns:
matches = re.finditer(pattern, self.code)
for match in matches:
self.opaque_predicates.append((match.start(), match.group()))
return self.opaque_predicates
def remove_dead_code(self) -> str:
"""移除死代码分支"""
# 识别 Toast.makeText 相关的陷阱代码
dead_patterns = [
r'Toast\.makeText\(\(Context\) null,.+\)\.show\(\);',
r'throw new RuntimeException\(String\.valueOf\(.+\)\);',
r'int\[\] iArr\d+ = new int\[.+\];[\s\S]*?iArr\d+\[.+\] = 1;',
]
result = self.code
for pattern in dead_patterns:
result = re.sub(pattern, '/* DEAD CODE REMOVED */', result)
return result
def simplify_numeric_expressions(self) -> str:
"""简化数值混淆表达式"""
# 识别复杂位运算模式
# 例如: (((~((-381584296) | nextInt2)) | 0x097d256a) * (-366))
# 这些通常计算结果是常量
# 使用符号执行或静态分析确定实际值
pass
def analyze_static_block(code: str) -> dict:
"""分析静态初始化块"""
analyzer = ControlFlowAnalyzer(code)
return {
'opaque_predicates': analyzer.find_opaque_predicates(),
'cleaned_code': analyzer.remove_dead_code(),
}6.3 Frida动态跟踪控制流
JavaScript
// hooks/control_flow_trace.js
Java.perform(function() {
// 跟踪静态初始化
var zzn = Java.use("com.google.android.gms.common.zzn");
// 记录所有分支执行
var branches = [];
// Hook 条件判断相关的调用
var SystemClock = Java.use("android.os.SystemClock");
SystemClock.uptimeMillis.implementation = function() {
var result = this.uptimeMillis();
console.log("[SystemClock.uptimeMillis] = " + result);
return result;
};
var Process = Java.use("android.os.Process");
Process.getElapsedCpuTime.implementation = function() {
var result = this.getElapsedCpuTime();
console.log("[Process.getElapsedCpuTime] = " + result);
return result;
};
// 记录数组操作
var ArrayList = Java.use("java.util.ArrayList");
ArrayList.add.overload('java.lang.Object').implementation = function(obj) {
console.log("[ArrayList.add] " + obj);
return this.add(obj);
};
});七、阶段5：数值常量还原
7.1 位运算混淆分析
Java
// 加固版中的数值混淆示例:
int i13 = ~(((int) SystemClock.uptimeMillis()) | 0x1ca50e3a);
int i14 = ((((0x57aed3b4 | i13) * (-658)) + 0x753e8b28) +
((i13 | 0x430ad184) * 658)) - 0x3cebb885;
int i15 = (i14 << 13) ^ i14;
int i16 = i15 ^ (i15 >>> 17);
((int[]) objArr[0])[0] = i16 ^ (i16 << 5); // 最终是一个伪随机数生成器
// 还原分析: 这是 Xorshift 伪随机数生成器的变体7.2 数值还原脚本
Python
# scripts/numeric_deobfuscate.py
class NumericDeobfuscator:
def __init__(self):
self.known_constants = {}
def evaluate_expression(self, expr: str) -> int:
"""静态求值混淆表达式"""
# 替换已知的Android API返回值
replacements = {
'Color.alpha(0)': 0,
'Color.red(0)': 0,
'Color.green(0)': 0,
'Color.blue(0)': 0,
'View.MeasureSpec.makeMeasureSpec(0, 0)': 0,
'TextUtils.getCapsMode("", 0, 0)': 0,
'ViewConfiguration.getMaximumFlingVelocity() >> 16': 0,
'AudioTrack.getMinVolume() > 0.0f ? 1 : 0': 0,
'AudioTrack.getMaxVolume() > 0.0f ? 1 : 0': 1,
# ... 更多映射
}
for pattern, value in replacements.items():
expr = expr.replace(pattern, str(value))
try:
return eval(expr)
except:
return None
def analyze_xorshift(self, code_block: str) -> dict:
"""分析Xorshift随机数生成器"""
# 识别模式: (x << 13) ^ x; x ^ (x >>> 17); x ^ (x << 5)
pattern = r'\((\w+) << 13\) \^ \1.*\1 \^ \(\1 >>> 17\).*\1 \^ \(\1 << 5\)'
if re.search(pattern, code_block):
return {
'type': 'xorshift',
'purpose': 'pseudo_random_generator',
'can_predict': True
}
return None
def trace_array_operations(self, code: str) -> List[dict]:
"""追踪数组操作以确定实际使用的值"""
operations = []
# 匹配数组赋值
pattern = r'\(\(int\[\]\) (\w+)\[(\d+)\]\)\[(\d+)\] = (.+);'
for match in re.finditer(pattern, code):
operations.append({
'array': match.group(1),
'outer_idx': int(match.group(2)),
'inner_idx': int(match.group(3)),
'value_expr': match.group(4)
})
return operations7.3 常量值静态计算
Python
def compute_obfuscated_constant(seed: int) -> int:
"""
计算加固版中使用的混淆常量
基于 Xorshift 算法
"""
x = seed
x = (x ^ (x << 13)) & 0xFFFFFFFF
x = (x ^ (x >> 17)) & 0xFFFFFFFF
x = (x ^ (x << 5)) & 0xFFFFFFFF
return x
# 示例: 计算初始化块中的关键值
# 这些值决定了代码执行路径
initial_seeds = [
0x1ca50e3a, # 从代码中提取的魔数
0x57aed3b4,
0x430ad184,
]
for seed in initial_seeds:
result = compute_obfuscated_constant(seed)
print(f"Seed 0x{seed:08x} -> Result: 0x{result:08x}")八、阶段6：完整性校验绕过
8.1 校验机制分析
Java
// 加固版中的完整性校验:
long j = ((Field) b2).getLong(null); // 获取存储的时间戳
if (j == -1 || j + 1962 < System.currentTimeMillis()) {
// 校验失败分支 - 执行初始化/修复
Object[] objArr21 = {0, 917504, -1022081157};
// ... 重新初始化保护数据
} else {
// 校验通过 - 使用缓存数据
}8.2 Frida绕过脚本
JavaScript
// hooks/integrity_bypass.js
Java.perform(function() {
// 绕过时间戳校验
var System = Java.use("java.lang.System");
System.currentTimeMillis.implementation = function() {
// 返回一个合适的时间戳使校验通过
return Long.MAX_VALUE - 10000;
};
// 绕过签名校验 (如果有)
var Signature = Java.use("android.content.pm.Signature");
Signature.toByteArray.implementation = function() {
// 返回预期的签名字节
return this.toByteArray();
};
// Hook MainActivity.B() - 可能返回包名或签名
try {
var MainActivity = Java.use("com.bankmandiri.md.presentation.ui.MainActivity");
MainActivity.B.implementation = function() {
console.log("[MainActivity.B] called");
var result = this.B();
console.log("[MainActivity.B] result: " + result);
return result;
};
} catch(e) {
console.log("MainActivity not found");
}
});九、阶段7：代码重构与还原
9.1 还原后的代码结构
Java
// 还原版 zzn.java
package com.google.android.gms.common;
import android.content.Context;
import android.content.pm.PackageManager;
import android.os.RemoteException;
import android.os.StrictMode;
import android.util.Log;
import com.google.android.gms.common.internal.Preconditions;
import com.google.android.gms.common.internal.zzaf;
import com.google.android.gms.common.internal.zzag;
import com.google.android.gms.common.util.AndroidUtilsLight;
import com.google.android.gms.common.util.Hex;
import com.google.android.gms.dynamic.ObjectWrapper;
import com.google.android.gms.dynamite.DynamiteModule;
import java.security.MessageDigest;
import java.util.concurrent.Callable;
final class zzn {
private static volatile zzag zze;
private static Context zzg;
// 还原后的常量 - 证书数据
static final zzl zza = new zzf(zzj.zze(
"0\u0082\u0005È0\u0082\u0003° \u0003\u0002\u0001\u0002\u0002\u0014" +
"\u0010\u008ae\bsù/\u008eQí"));
static final zzl zzb = new zzg(zzj.zze(
"0\u0082\u0006\u00040\u0082\u0003ì \u0003\u0002\u0001\u0002\u0002\u0014" +
"\u0003£²\u00ad×árÊkì"));
static final zzl zzc = new zzh(zzj.zze(
"0\u0082\u0004C0\u0082\u0003+ \u0003\u0002\u0001\u0002\u0002\t" +
"\u0000Âà\u0087FdJ0\u008d0"));
static final zzl zzd = new zzi(zzj.zze(
"0\u0082\u0004¨0\u0082\u0003\u0090 \u0003\u0002\u0001\u0002\u0002\t" +
"\u0000Õ\u0085¸l}ÓNõ0"));
private static final Object zzf = new Object();
// 还原后的方法
static zzx zza(String str, zzj zzjVar, boolean z, boolean z2) {
StrictMode.ThreadPolicy policy = StrictMode.allowThreadDiskReads();
try {
return zzh(str, zzjVar, z, z2);
} finally {
StrictMode.setThreadPolicy(policy);
}
}
static zzx zzb(String str, boolean z, boolean z2, boolean z3) {
return zzi(str, z, false, false, true);
}
static zzx zzc(String str, boolean z, boolean z2, boolean z3) {
return zzi(str, z, false, false, false);
}
static String zzd(boolean z, String str, zzj zzjVar) throws Exception {
String message;
if (!z && !zzh(str, zzjVar, true, false).zza) {
message = "not allowed";
} else {
message = "debug cert rejected";
}
MessageDigest md = AndroidUtilsLight.zza("SHA-256");
Preconditions.checkNotNull(md);
return String.format("%s: pkg=%s, sha256=%s, atk=%s, ver=%s",
message, str,
Hex.bytesToStringLowercase(md.digest(zzjVar.zzf())),
Boolean.valueOf(z),
"12451000.false");
}
static synchronized void zze(Context context) {
if (zzg != null) {
Log.w("GoogleCertificates", "GoogleCertificates has been initialized already");
} else if (context != null) {
zzg = context.getApplicationContext();
}
}
static boolean zzf() {
StrictMode.ThreadPolicy policy = StrictMode.allowThreadDiskReads();
try {
zzj();
return zze.zzg();
} catch (RemoteException | DynamiteModule.LoadingException e) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e);
return false;
} finally {
StrictMode.setThreadPolicy(policy);
}
}
static boolean zzg() {
StrictMode.ThreadPolicy policy = StrictMode.allowThreadDiskReads();
try {
zzj();
return zze.zzi();
} catch (RemoteException | DynamiteModule.LoadingException e) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e);
return false;
} finally {
StrictMode.setThreadPolicy(policy);
}
}
private static zzx zzh(String str, zzj zzjVar, boolean z, boolean z2) {
try {
zzj();
Preconditions.checkNotNull(zzg);
try {
if (zze.zzh(new zzs(str, zzjVar, z, z2),
ObjectWrapper.wrap(zzg.getPackageManager()))) {
return zzx.zzb();
} else {
return new zzv(new Callable<String>() {
@Override
public String call() throws Exception {
return zzn.zzd(z, str, zzjVar);
}
}, null);
}
} catch (RemoteException e) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e);
return zzx.zzd("module call", e);
}
} catch (DynamiteModule.LoadingException e) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e);
return zzx.zzd("module init: " + e.getMessage(), e);
}
}
private static zzx zzi(String str, boolean z, boolean z2, boolean z3, boolean z4) {
zzx result;
StrictMode.ThreadPolicy policy = StrictMode.allowThreadDiskReads();
try {
Preconditions.checkNotNull(zzg);
try {
zzj();
zzo request = new zzo(str, z, false, ObjectWrapper.wrap(zzg), false, true);
zzq response = z4 ? zze.zze(request) : zze.zzf(request);
if (response.zzb()) {
result = zzx.zzf(response.zzc());
} else {
String message = response.zza();
PackageManager.NameNotFoundException exception =
response.zzd() == 4 ? new PackageManager.NameNotFoundException() : null;
if (message == null) {
message = "error checking package certificate";
}
result = zzx.zzg(response.zzc(), response.zzd(), message, exception);
}
} catch (RemoteException e) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e);
result = zzx.zzd("module call", e);
}
} catch (DynamiteModule.LoadingException e) {
Log.e("GoogleCertificates", "Failed to get Google certificates from remote", e);
result = zzx.zzd("module init: " + e.getMessage(), e);
} finally {
StrictMode.setThreadPolicy(policy);
}
return result;
}
private static void zzj() throws DynamiteModule.LoadingException {
if (zze != null) {
return;
}
Preconditions.checkNotNull(zzg);
synchronized (zzf) {
if (zze == null) {
zze = zzaf.zzb(DynamiteModule.load(zzg,
DynamiteModule.PREFER_HIGHEST_OR_LOCAL_VERSION_NO_FORCE_STAGING,
"com.google.android.gms.googlecertificates")
.instantiate("com.google.android.gms.common.GoogleCertificatesImpl"));
}
}
}
}十、阶段8：验证与对比
10.1 功能验证清单
Markdown
## 验证检查表
### 核心功能验证
- [ ] zza() 方法签名验证功能正常
- [ ] zzb/zzc() 证书检查功能正常
- [ ] zzd() 错误信息生成正确
- [ ] zze() Context初始化正常
- [ ] zzf/zzg() 远程证书获取正常
- [ ] zzh() 核心验证逻辑正确
- [ ] zzi() 证书状态查询正确
- [ ] zzj() Dynamite模块加载正常
### 数据验证
- [ ] zza-zzd 证书常量值与原版一致
- [ ] 字符串常量完全还原
- [ ] 异常处理逻辑完整
### 行为验证
- [ ] StrictMode策略恢复正确
- [ ] 线程安全性保持
- [ ] 远程调用超时处理正确10.2 自动化对比测试
Python
# scripts/verification_test.py
import hashlib
import difflib
def compare_methods(original: str, restored: str) -> dict:
"""对比原版与还原版的方法"""
# 提取方法签名
original_methods = extract_method_signatures(original)
restored_methods = extract_method_signatures(restored)
results = {
'matching': [],
'missing': [],
'extra': [],
'different': []
}
for method in original_methods:
if method in restored_methods:
# 比较方法体
orig_body = get_method_body(original, method)
rest_body = get_method_body(restored, method)
if normalize_code(orig_body) == normalize_code(rest_body):
results['matching'].append(method)
else:
results['different'].append({
'method': method,
'diff': list(difflib.unified_diff(
orig_body.splitlines(),
rest_body.splitlines()
))
})
else:
results['missing'].append(method)
for method in restored_methods:
if method not in original_methods:
results['extra'].append(method)
return results
def normalize_code(code: str) -> str:
"""标准化代码用于比较"""
# 移除注释、空白、变量名差异等
import re
code = re.sub(r'//.*', '', code)
code = re.sub(r'/\*.*?\*/', '', code, flags=re.DOTALL)
code = re.sub(r'\s+', ' ', code)
return code.strip()十一、关键差异总结
11.1 原版 vs 加固版对照表
| 组件 | 原版 | 加固版 | 还原方法 |
|---|---|---|---|
| 静态初始化 | 4行简单赋值 | 500+行混淆代码 | 提取常量值 |
| 字符串 | 明文 | 加密+动态解密 | 解密脚本 |
| 方法调用 | 直接调用 | 反射+缓存 | 解析反射目标 |
| 控制流 | 线性 | 不透明谓词 | 符号执行 |
| 常量 | 直接值 | 位运算表达式 | 静态求值 |
| 类引用 | 直接引用 | 动态加载 | Hook分析 |
11.2 移除的保护代码
Java
// 需要移除的加固特有代码:
// 1. 时间戳校验
if (j == -1 || j + 1962 < System.currentTimeMillis()) { ... }
// 2. 完整性检查报告
Object[] objArr49 = {1252794371, Long.valueOf(j18), arrayList, MainActivity.B(), false};
((Method) b40).invoke(invoke, objArr49);
// 3. 伪造的异常触发
Toast.makeText((Context) null, iArr[...], 1).show();
throw new RuntimeException(String.valueOf(i6));
// 4. 无用的数组操作
int[] iArr = new int[i18];
iArr[i36] = 1;
// 5. 动态解密基础设施
private static void e() { d = 396; b = 55775; ... }十二、完整还原工作流自动化
Python
# scripts/full_restoration_pipeline.py
import os
import json
from pathlib import Path
class RestorationPipeline:
def __init__(self, obfuscated_path: str, output_path: str):
self.obfuscated_path = Path(obfuscated_path)
self.output_path = Path(output_path)
self.results = {}
def run(self):
"""执行完整还原流程"""
print("=" * 60)
print("开始代码还原流程")
print("=" * 60)
# 阶段1: 提取加密数据
print("\n[阶段1] 提取加密数据...")
self.extract_encrypted_data()
# 阶段2: 字符串解密
print("\n[阶段2] 执行字符串解密...")
self.decrypt_strings()
# 阶段3: 反射还原
print("\n[阶段3] 解析反射调用...")
self.resolve_reflections()
# 阶段4: 控制流简化
print("\n[阶段4] 简化控制流...")
self.simplify_control_flow()
# 阶段5: 常量还原
print("\n[阶段5] 还原数值常量...")
self.restore_constants()
# 阶段6: 代码重构
print("\n[阶段6] 重构代码...")
self.restructure_code()
# 阶段7: 验证
print("\n[阶段7] 验证还原结果...")
self.verify_restoration()
# 保存结果
self.save_results()
print("\n" + "=" * 60)
print("还原完成!")
print("=" * 60)
def extract_encrypted_data(self):
"""提取加密的字节数组和密钥"""
# 从静态字段提取
self.results['arrays'] = {
'$$a': [76, 125, 119, 121],
'$$c': [90, 86, 85, 117],
'$$d': [108, 208, 10, 71, 195, ...] # 完整数据
}
# 从e()方法提取密钥
self.results['keys'] = {
'd': 396,
'b': 55775,
'e': 3241,
'c': 25637
}
def decrypt_strings(self):
"""执行字符串解密"""
decryptor = StringDecryptor()
self.results['strings'] = {}
# 解密所有加密字符串调用
encrypted_calls = self.find_decrypt_calls()
for call in encrypted_calls:
decrypted = decryptor.decrypt(call)
self.results['strings'][str(call)] = decrypted
def resolve_reflections(self):
"""解析反射调用"""
self.results['reflections'] = {}
# 解析所有fgk调用
fgk_calls = self.find_fgk_calls()
for call in fgk_calls:
resolved = self.resolve_fgk_call(call)
self.results['reflections'][str(call['hash'])] = resolved
def simplify_control_flow(self):
"""简化控制流"""
analyzer = ControlFlowAnalyzer(self.read_file())
# 移除不透明谓词
self.results['opaque_predicates'] = analyzer.find_opaque_predicates()
# 移除死代码
self.results['dead_code_removed'] = True
def restore_constants(self):
"""还原常量值"""
self.results['constants'] = {
'zza_cert': "0\u0082\u0005È...",
'zzb_cert': "0\u0082\u0006\u0004...",
'zzc_cert': "0\u0082\u0004C...",
'zzd_cert': "0\u0082\u0004¨..."
}
def restructure_code(self):
"""重构代码结构"""
# 生成还原后的代码
restored_code = self.generate_restored_code()
# 写入输出文件
output_file = self.output_path / "zzn_restored.java"
with open(output_file, 'w') as f:
f.write(restored_code)
def verify_restoration(self):
"""验证还原结果"""
original = self.load_original()
restored = self.load_restored()
comparison = compare_methods(original, restored)
self.results['verification'] = comparison
def save_results(self):
"""保存分析结果"""
with open(self.output_path / "restoration_report.json", 'w') as f:
json.dump(self.results, f, indent=2, ensure_ascii=False)
if __name__ == "__main__":
pipeline = RestorationPipeline(
obfuscated_path="obfuscated/zzn.java",
output_path="output/"
)
pipeline.run()总结
还原此商业加固方案需要：
- 静态分析：理解混淆模式和加密算法
- 动态分析：使用Frida Hook验证假设
- 自动化脚本：批量处理字符串解密、反射解析
- 手工验证：对比原版确保功能完整
预计工作量：对于有经验的逆向工程师，完整还原此类约500行混淆代码大约需要2-4天。
浙公网安备 33010602011771号