Android Reverse Journey---Static analysis of video editing application "vue" watermark problem

I. Background of the story

Now a lot of people like to play literature and art, especially my side of the UI, take a minute to fix the picture half an hour. is in order to be able to appear in the circle of friends, but it is really good-looking, revision of the software too much to say, and generally there is no watermark what. Compared to shorter videos there is a comparison with a grid of editing tools " vue"personal has been used for a long time, the video made with powerful filters really good-looking, appear to force lattice is also high, more importantly, he has my favorite feature is the ability to add video background music, choose their favorite music, and then can also edit this background music, anyway, I personally feel this is my favorite product 。 But good things must have its bad place, because he is really strong so the application of the video with a watermark, in order to better publicity role.

In fact, there are a lot of videos are watermark, such as vibrato video, but here by the way the chattering video is actually uploaded to the server is no watermark, and when we save to the local time there are watermarks. Because the people who have developed the video know, the general is to use the FFmpeg library to add watermarks, the watermark is generally a picture. If the background of the vibrato video watermark on the one hand is the design of copyright issues, because now a lot of original authors a work video will be issued on many platforms, then the same video has a vibrato watermark, watermelon watermark, such as the watermark. Add watermark is a bit of consumption performance, vibrato now upload a large number of video per day, each add Watermark server pressure will be very large. In this two-point vibrato did not choose to add a watermark to the server background video, only the user to save to the local time to add the watermark in the local, so many people on the internet want to remove the vibrato watermark, in fact, it is simple to grab the packet and then get the video original address on it. Do not understand the vibrato data protocol, you can read this article: Android analysis of a certain audio and video protocol data.

Second, reverse analysis application

Said a bit far, and then come back to see our application to the watermark problem, in fact, this app does not have video upload function, that is, the local video editing with filters and background music and then save to the local, and the process of saving the watermark to add, so our purpose is to remove the watermark, Then you can just tamper with it in this process. About the function of adding watermark to video In fact, much of the information on the web, mostly with the help of FFmpeg library operation. Let's take a look at the watermark effect added by this app:

Then let's look at the use of the application process:

He does this by staging and then merging the operations, jumping directly to the back to see where to save:

See here to save the video, then the place to add the watermark is very likely in this place, we use the UI tool to directly extract the ID of the progress bar as a breach information:

See the Resid value of the control, and then go to JADX directly search R.id.video_view, after everyone so search, If you do not find in the go public.xml into a decimal search, the application here is two Dex is not very big, but a lot of resources, you can use the compression tool to open the APK to delete the Res folder, because the JADX card needs to parse the resources under Res. Here we do not look at the res under the east to delete directly, and then open the APK directly, so that no more open JADX more than one dex:

After you find it, click here to view details:

Sure enough to see the use of the most commonly used texturevideoview this is used to deal with the video filter effect combined with ffmpeg, but we are concerned about the progress, because the preservation of certain progress. Online See Custom a rectangle Animation progress control, click to see:

Yes, I see him. There is a way to update the progress, and then right-click to see where this method is called:

Click to view Details:

See here is A.n.a method through callback update progress, but here is a problem is this a method click Jump failed, this said before, because JADX may parse class failure, so we need to manually find this method, look at the N type:

With the package name of the class name is good, go directly to see this kind of information:

Found a method, see here feel the game, save the local video files have, continue to follow:

Here is a fragment, method click Failed, and found that the multi-layer call in accordance with the package name variable lookup too laborious, direct view Smali code comparison directly, here to remember this little trick, when viewing a method in JADX failure can go to see Smali code:

Finally call the H Class A method, and then go to JADX to find this class H:

Here, it began to be enlightened because we have found the most critical place, this is the way to execute the ffmpeg command, because I have done a video application, using FFmpeg to do filter mirror effect. So see this code instantly on the bright front. But you didn't do it, it's OK, here you can hook the operation:

Direct interception method, printing parameters to see the results can, here by the way to me to remove the watermark a few ways to introduce it:

First I think of the first scenario is: Filter the command parameters to add watermarks, because the command to add a watermark online a lot:

Then I'm going to have to delete the four related commands. So see me above the processing command code relatively simple to look at the better. But unfortunately this scheme I failed to execute, I guess which-filter_complex and other uses can not be deleted directly, but the parameter value of this command is too complex to see my headache, so gave up the second solution: is in-filter_ Complex command parameters to modify the location of the watermark picture, let it exceed the phone screen, so you can not see the watermark, this scheme is sure to be reliable, we run this xposed module, and then look at the log:

See the command is printed out, and see the default watermark image, this image address must be remembered, the following will give a more ingenious solution is to use this address. See the watermark XY coordinate value, we directly modify:

Then in the Operation Vue recorded video, found that the video does not have a watermark effect, here is not convenient last video, we can operate their own view of the effect is good.

Third, the solution

So here we have a general understanding of the application to add the watermark process and technology, mainly through the use of FFmpeg Library command to add watermarks, we remove the way the watermark is more rough is to directly modify the watermark image location. But is it over here? Certainly not because we want everyone to be able to use the watermark-free vue, so we have to make a finished apk file. So here are a lot of ideas:

The first idea: Modify the Smali code, modify the XY value, and then compile it back. This is really a thought, but I think it's a little hard to change the Smali code.

The second idea: get a blank watermark picture, put in the phone's SD card, and then modify the Smali code, replace the default watermark image address, this idea is reliable but still need to modify the Smali code inconvenient.

The third idea: from the above command to see that the default watermark image exists in the SD card directory, you can directly replace the image with a blank image of the watermark, this idea can, but unfortunately is not trusted, because we go to view this directory:

I operated three times, resulting in three pictures, it is said that every time you edit the video from a place to get a watermark picture the number behind the change, so this scheme we can not anticipate the picture name cannot complete the early replacement.

The fourth idea: this is on the basis of a third thought, but also the final plan. We can see from the third idea that this watermark image is not generated locally, the possibility of downloading from the Internet is also very low, because it is the same picture, and no need to get from the Internet, so think about this image must be found in the local apk, then not much speculation directly decompression apk to res search:

Emperor is finally I found, but also verified my guess, we compare this and SD card in the default watermark image:

Exactly the same, the naked eye can't tell. Well, here we start to make a bold attempt, to make a blank image, directly replace the watermark image under Res, so that the application of the use of multiple places using the watermark image is our replacement after the blank image, this idea is still very ingenious.

四、二次 Packaging

How do you create a blank image below? This is not difficult, who calls us to PS it? Open PS software, through the above to view the size of the res image is 132*40:

Remember to choose transparent, size is also attention is the pixel units, and then OK:

Then save to PNG format. Replace the original watermark image directly:

Here to replace the successful, start back to compile it, unfortunately, back to the compilation failed. Generally now many will be back to compile the failure problem, such problems I generally avoid, because the resolution of the words are not. So how can we replace this file without recompiling? Some students will think of extracting the APK directly with the decompression tool, and then replace will compress the suffix name apk can be modified. This you can try to find the compression into the apk is problematic, because the path problem is not able to do so, then what should we do? This is going to take advantage of my reverse. Pornography "android Application Security and reverse analysis" in the third chapter of the AAPT command usage, have not purchased the classmate hurriedly start it. The AAPT command can be used to manipulate the APK file, such as viewing the APK's XML file, adding a file to the APK. Use the AAPT command to add no need to unzip the apk file, such as here we replace the file, you can delete the file, the command is as follows: AAPT remove-v vue.apk res\drawable-www.120xh.cn xxhdpi-v4\ Www.taohuayuan178.com Stamp_logo.png, so that the original watermark image is deleted, and then in the command to add our blank watermark Image: Aapt add-v vue.apk res/drawable-xxhdpi-v4/ Stamp_logo. www.jypt178.cn PNG There's a little pit here, that's the command. The path to execute must contain the Res/drawable-xxhdpi-v4/stamp_logo.png file, and the path in the command cannot be changed, otherwise the addition is unsuccessful.

So we used the AAPT command to skillfully replace the watermark image, of course, two times signed, because we replaced the file. Two times the signature is simple not much explanation, so that we install after the application, the operation is successful, this is a bit unexpected to me, the application did not do signature verification to prevent two times packaging? Just when I doubted it, I found the problem, the video filter failed, so the application has been tested. But it doesn't matter, at this time the first thought I wrote the demolition tool Kstools, do not know this tool can be viewed here: Android Explosion signature Verification Problem tool Kstools principle analysis, here to pay attention to the first tool to obtain the correct original signature, or failure, All right, here we go. Install it, this will be happy to operate the high-pressure video editing work without watermarks. Here we put all the process is finished, the content is still a lot of, the following to summarize the knowledge points obtained in this article:

• First, understand the video to add a watermark is generally used ffmpeg Library command way to add a watermark picture
• Second, use PS to create a blank PNG image
• Third, use the AAPT command to implement the original operation of the APK package file

Android Reverse Journey---Static analysis of video editing application "vue" watermark problem