Android-a way to counter the Anti-compilation tool

Reprint please indicate source: http://blog.csdn.net/goldenfish1919/article/details/41010261

First, let's look at the format of the Dex file:

Structure of the Class_defs:

(1) Class_idx describes the specific class type, and the value is an index of type_ids. The value must be a class type and cannot be an array type or base type.

(2) Access_flags describes the type of access for class, such as public, final, static, and so on. In dex-format.html "Access_flags definitions" has a specific description.

(3) Superclass_idx, describes the type of Supperclass, the value of the same form as CLASS_IDX.

(4) Interfaces_off, the value is the offset address, point to class interfaces, the data structure is pointed to type_list. If class has no interfaces, the value is 0.

(5) Source_file_idx, which represents the source code file information, the value is an index of string_ids. If this information is missing, this value is assigned a value of NO_INDEX=0XFFFF FFFF.

(6) Annotions_off, the value is an offset address, the content of the class is the comment, the location in the data area, in the format of Annotations_direcotry_item. If this is not the case, the value is 0.

(7) Class_data_off, the value is an offset address, pointing to the content of the class is used to the data, the location in the data area, in the format of Class_data_item. If this is not the case, the value is 0. The structure has a lot of content, detailed description of the Class field, method, method of execution code and other information, followed by a relatively large space to tell Class_data_item.

(8) Static_value_off, the value is an offset address, pointing to a list in the data area, in the form of Encoded_array_item. If this is not the case, the value is 0.

Focus on the following (5), which represents the name of the source file. Therefore, a feasible solution is to add a project to Dex in the non-use of the class, and then modify source_file_idx, because it is not used, so the runtime will not error, but the compiler tool in static parsing, it will not parse out and error!

Then look at the specific components of the head:

(1) Magic value
These 8 bytes are generally constants, in order for the. dex file to be recognized, it must appear at the very beginning of the. dex file.

(2) Checksum and signature
4 bytes of file checksum, using the ALDER32 algorithm checksum file to remove MAIGC, checksum all the remaining file areas, to check for file errors.
20 bytes of signature, using the SHA-1 algorithm hash to remove magic, checksum, and all remaining file areas outside of signature for uniquely identifying this file.

From the above structure can be seen, if it is modified SOURCE_FILE_IDX, then you need to modify both signature and checksum.

The summary steps are as follows:

(1) After the project source is packaged into a jar package (obfuscation), it is added into a useless class x.x.x.x.x.x.

(2) Convert the new jar package to Dex

(3) Modify the source_file_idx of the x.x.x.x.x.x class in Dex.

(4) Recalculate signature.

(5) Recalculate checksum.

(6) Update Dex.

(7) Normal packaging signature installation.

Android-a way to counter the Anti-compilation tool