Android decompilation (1. apktool + smail2java)

Android decompilation (1. apktool + smail2java)
I. Decompress (obtain images and other resources)

For the rich resources in the apk, if we need to reference some resource files in the apk During the exercise, the simplest way is to use the decompression tool to decompress the apk, find the required resource files in the corresponding directory.

Ii. decompile APK

We can decompress the files to use related multimedia resources and font files in the res/drawable, res/raw, and assets directories of some apks, however, xml resources such as animations and la s cannot be copied at the same time, because the res/raw and assets folders do not need to be compiled into binary files by the system, other files are compiled into binary files during packaging. What should we do now?

Google Code provides us with a decompilation toolkit for apk-Apktool, The latest version is 2.0.0 RC4, uploaded by iBotPeaches in the https://bitbucket.org/iBotPeaches/apktool/downloads (since google is about to close the google code Service, all versions of apktool will be released on Bitbucket ), of course, we can also search for this entry from Google Code.

We use apktool to decompile the apk to obtain the source code and images, XML configuration, language resources, and other files in the apk application. So how to use apktool, we will briefly introduce the following (here refer to the documentation provided on Google Code, view the original documentation, please move to the https://code.google.com/p/android-apktool/wiki/ApktoolOptions ):

1.apk tool download

Through the download link above, we can get the jar package named apktool_2.0.0rc4.jar. How can we use it?

1> rename

Change apktool_2.0.0rc4.jar to apktool. jar;

2> adapt to different operating systems

Windows

Save the following script content in the apktool. bat file.

 

@echo offset PATH=%CD%;%PATH%;java -jar -Duser.language=en %~dp0apktool.jar %1 %2 %3 %4 %5 %6 %7 %8 %9

In linux:

 

Save the following script content as an apktool File

 

#!/bin/bash## Copyright (C) 2007 The Android Open Source Project## Licensed under the Apache License, Version 2.0 (the License);# you may not use this file except in compliance with the License.# You may obtain a copy of the License at##     http://www.apache.org/licenses/LICENSE-2.0## Unless required by applicable law or agreed to in writing, software# distributed under the License is distributed on an AS IS BASIS,# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.# See the License for the specific language governing permissions and# limitations under the License.# This script is a wrapper for smali.jar, so you can simply call smali,# instead of java -jar smali.jar. It is heavily based on the dx script# from the Android SDK# Set up prog to be the path of this script, including following symlinks,# and set up progdir to be the fully-qualified pathname of its directory.prog=$0while [ -h ${prog} ]; do    newProg=`/bin/ls -ld ${prog}`    echo ${newProg}    newProg=`expr ${newProg} : .* -> (.*)$`    if expr x${newProg} : 'x/' >/dev/null; then        prog=${newProg}    else        progdir=`dirname ${prog}`        prog=${progdir}/${newProg}    fidoneoldwd=`pwd`progdir=`dirname ${prog}`cd ${progdir}progdir=`pwd`prog=${progdir}/`basename ${prog}`cd ${oldwd}jarfile=apktool.jarlibdir=$progdirif [ ! -r $libdir/$jarfile ]then    echo `basename $prog`: can't find $jarfile    exit 1fijavaOpts=# If you want DX to have more memory when executing, uncomment the following# line and adjust the value accordingly. Use java -X for a list of options# you can pass here.# javaOpts=-Xmx512M# Alternatively, this will extract any parameter -Jxxx from the command line# and pass them to Java (instead of to dx). This makes it possible for you to# add a command-line parameter such as -JXmx256M in your ant scripts, for# example.while expr x$1 : 'x-J' >/dev/null; do    opt=`expr $1 : '-J(.*)'`    javaOpts=${javaOpts} -${opt}    shiftdoneif [ $OSTYPE = cygwin ] ; thenjarpath=`cygpath -w  $libdir/$jarfile`elsejarpath=$libdir/$jarfilefi# add current location to path for aaptPATH=$PATH:`pwd`;export PATH;exec java $javaOpts -jar $jarpath $@

3> set Environment Variables

 

Add the folders of apktool. jar and apktoo. bat to the system environment variables or copy them to the system folder.C: // copy the file to/usr/local/bin (root needed) in Windows and Linux, and remember to modify the File Permission (chmod + x)

 

Practical options

 

 

-version, --version

 

 

Output the current version.

 

 

-v, --verbose

 

 

Detailed output. This command is prior to all other commands.

 

 

-q, --quiet

 

 

Static output. This command is before all other commands.

 

 

-advance, --advanced

 

 

Print advanced options.

 

 

Decompilation options

 

 

--api 

 

 

Generate the api version of The smali file. (Eg 14 for ICS ).

 

 

-b, --no-debug-info

 

 

Log information is not printed.

 

 

-d, --debug

 

 

Start debug mode

 

 

-- Debug-line-prefix
 
 
Smali line prefix when decoding in debug mode. Default a=0;//
 
 
-f, --force
 
 
If the file directory generated after decompilation already exists, overwrite it forcibly.
 
 
--keep-broken-res
 
 
If an error occurs during the decompilation process, you must manually fix it.
 
 
-m, --match-original
 
 
It is possible to keep the file close to the original file to prevent reconstruction, which is usually used for analysis.
 
 
-o, --output 
  
 
 
Specify the output path.
 
 
-p, --frame-path 
  
 
 
Specify the framework path.
 
 
-r, --no-res
 
 
Prevent re-Compilation of resource files.
 
 
-s, --no src
 
 
Prevent source files from being recompiled.
 
 
-t, --frame-tag 
   
 
 
Use the framework file tag.
 
 
How to decompile?
 
 
Before decompiling, you must ensure that frameworks has been installed. For Frameworks, visit https://code.google.com/p/android-apktool/wiki/frameworkfiles. If frameworks has been installed, run the following command for decompilation:
 
 
apktool d name_of_apk.apk
 
 
Rebuilding options
 
 
-a, --aapt 
   
 
 
Load aapt from the specified path. If the relevant directory cannot be found, the system will perform the rollback operation.
 
 
-c, --copy-original
 
 
Copy AndroidManifest. xml and the META-INF folder to the rebuilt apk.
 
 
-d, --debug
 
 
Start the debug mode.
 
 
-f, --force-all
 
 
Overwrite existing files during reconstruction.
 
 
-o, --output 
  
 
 
Specify the output path.
 
 
-p, --frame-path 
  
 
 
Specifies the path of framework files.
 
 
How to recreate a project?
 
 
apktool b folder_of_decoded_apk
 

Through apktool d xx.apk, after decompiling the apk file, we can use the editing tool to view some xml configuration files, but the source files are still unknown to us. Because apktool converts an Android bytecode file to a smali file.

Smali is a language that represents the Android bytecode in the form of readable strings. It can be called the Android bytecode disassembly language. Baksmali or apktool can decompile Android application packages (apk or jar) into smali code.

The next step is to decompile the smali file into a java file.

Iii. decompile smali

Smali2java is a tool for decompiling smali code into java code. It is a smali file generated based on apktool v1.5.0 (baksmali v1.3.4) and depends on the number of lines of code in the smali file (. line keyword) and variable alias (. local keyword) to restore the original java code to the maximum extent. The restored java code has the original variable name, and the code order is consistent with that of the original java code.