Android program decompilation Method

 

APK File Format

 

Android Application Package file. Every application to be installed on the Android platform must be compiled into a single file with the suffix .apk, which contains the binary code, resources, and configuration files of the application.

 

The APK file is actually a zip package and can be unzipped. You can use zip to unbind the *. APK file. The following is a helloword APK sample file.

 

|-Androidmanifest. xml

|-META-INF

|-Cert. RSA

|-Cert. SF

| '-Manifest. MF

|-Classes. Dex

|-Res

|-Drawable

| '-Icon.png

| '-Layout

| '-Main. xml

'-Resources. ARSC

 

1. Manifest file: androidmanifest. XML is defined and contained by each application. It describes the application name, version, permission, referenced library file, and other information. [,], to upload the APK to Google market, you also need to configure the XML. Note: The XML file in the APK is compressed and cannot be opened directly.
2. Res file: All resource files in the res folder.
3. Resources. ARSC file: it is a compiled binary resource file. Many Chinese software developers modify the resources in the file to implement software localization.
4. META-INF Directory: The META-INF directory stores the signature information, used to ensure the integrity of the APK package and system security. When eclipse compiles an API package, it will do a verification calculation for all the files to be packaged, and put the calculation result under the META-INF directory. When the APK package is installed on the ophone platform, the Application Manager checks the file in the package according to the same algorithm. If the verification result is inconsistent with the content in the META-INF, the system will not install this APK. This ensures that the files in the APK package cannot be replaced at will. For example, after obtaining an APK package, if you want to replace an image, a piece of code, or a piece of copyright information, it is basically impossible to directly decompress, replace, and re-package the package. This increases the difficulty of virus infection and malicious modification, and helps protect the security of the system.
5. Classes. Dex is a Java bytecode file generated after Java source code compilation. However, because the Dalvik Virtual Machine Used by Android is incompatible with the standard Java virtual machine, the DEX file is different from the class file, regardless of the file structure or opcode.

 

 

Decompilation of XML files

 

The XML file in the APK is compressed. You can use the axmlprinter2 tool to unbind it. The specific command is:

 

Java-jar axmlprinter2.jar androidmanifest. xml

 

Example of the manifest file in the helloandroid program:

 

<? XML version = "1.0" encoding = "UTF-8"?>

<Manifest

Xmlns: Android = "http://schemas.android.com/apk/res/android"

Android: versioncode = "1"

Android: versionname = "1.0"

Package = "name. feisky. Android. test"

>

<Application

Android: Label = "@ 7f040001"

Android: icon = "@ 7f020000"

>

<Activity

Android: Label = "@ 7f040001"

Android: Name = ". helloandroid"

>

<Intent-Filter

>

<Action

Android: Name = "android. Intent. Action. Main"

>

</Action>

<Category

Android: Name = "android. Intent. Category. launcher"

>

</Category>

</Intent-filter>

</Activity>

</Application>

<Uses-SDK

Android: minsdkversion = "6"

>

</Uses-SDK>

</Manifest>

 

The original file is:

 

<? XML version = "1.0" encoding = "UTF-8"?>

<Manifest xmlns: Android = "http://schemas.android.com/apk/res/android"

Package = "name. feisky. Android. test"

Android: versioncode = "1"

Android: versionname = "1.0" type = "codeph" text = "/codeph">

<Application Android: icon = "@ drawable/icon" Android: Label = "@ string/app_name">

<Activity Android: Name = ". helloandroid"

Android: Label = "@ string/app_name">

<Intent-filter>

<Action Android: Name = "android. Intent. Action. Main"/>

<Category Android: Name = "android. Intent. Category. launcher"/>

</Intent-filter>

</Activity>

 

</Application>

<Uses-SDK Android: minsdkversion = "6"/>

 

</Manifest>

 

 

 

Classes. Dex file Decompilation

 

Classes. Dex is a Java bytecode file generated after Java source code compilation. However, because the Dalvik Virtual Machine Used by Android is incompatible with the standard Java virtual machine, the DEX file is different from the class file, regardless of the file structure or opcode. Currently, common Java decompilers cannot process Dex files.

The android simulator provides dexdump, A decompilation tool for Dex files. First, start the android simulator, and use the ADB push upload simulator to view the DEX file. Then, log on to the simulator using the ADB shell, find the DEX file to be viewed, and execute dexdump XXX. Dex. However, the readability of the result is very poor. The following describes a readable tool.

 

Tool preparation:

1. decompile the DEX file into a jar file. (Dex2jar)

2. decompile jar into a Java tool. JD-GUI)

 

Decompilation steps

1. Extract the classes. Dex file from the APK and decompress the APK file. Put it in the dex2jar directory, open cmd, run dex2jar. Bat classes. Dex, and generate classes. Dex. dex2jar. jar.

2, run the JD-GUI tool, open the jar file above, you can see the source code.

 

Helloandroid instance:

 

Package name. feisky. Android. test;

 

Import Android. App. activity;

Import Android. OS. Bundle;

 

Public class helloandroid extends Activity

{

Public void oncreate (bundle parambundle)

{

Super. oncreate (parambundle );

Setcontentview (2130903040 );

}

}

 

 

The original program is:

 

Package name. feisky. Android. test;

 

Import Android. App. activity;

Import Android. OS. Bundle;

 

Public class helloandroid extends activity {

/** Called when the activity is first created .*/

@ Override

Public void oncreate (bundle savedinstancestate ){

Super. oncreate (savedinstancestate );

Setcontentview (R. layout. Main );

}

}

 

This article participates in the "First Google summer college student blog sharing competition-2010 android ".