"I'll take you to the high imitation" "Omelette" Android version of High Imitation and optimization (a)--reverse engineering and tcpdump grab Bag primer

Reprint Please specify source: http://blog.csdn.net/zhaokaiqiang1992

Suddenly, the graduation season has come, four years of full and busy university will come to the end, I am looking forward to life after graduation!

First of all, thank you for my blog support, we exchange learning, in return, I put my collection of good articles to share to you, details please poke Android related issues Good article finishing-wen so know new, can for the teacher.

In addition, I have been busy working and preparing my dissertation recently, so the output of this article is less. My bi set of course and Android-related, is the "Fried egg" app reverse engineering, high imitation and optimization, both as a Bishi, but also as a small piece of their own, for the next interview what to prepare ~ So opened this series, record this project bit by bit, and we share experience, By the way, as the material of graduation thesis, there are many ~

PS: The technical, data and interface addresses in this series are for learning and communication only, so be sure not to do bad things! Otherwise the consequences are self-esteem!

• Reverse engineering
• Code Framework Parsing
• Tcpdump Grab Bag
• Wireshake Analysis Packets

Reverse engineering

Since is to do high imitation, of course, need reverse engineering, because Android is based on Java, so the difficulty of anti-compilation is not big, a variety of information is very rich, so here is a brief introduction.

When we decompile, we can follow the following process

• Use Apktool to decompile the APK, get to the layout file in res, picture resource in drawable, component Declaration and permission declaration in Androidmanifest.xml, constant value in values, etc.
• Change the apk to a zip suffix, extract to the Classes.dex file, and then use the Dex2jar tool to decompile it, get to the Classes.jar file, and view it using Jd-gui.

This is the usual anti-compilation process, but I'm going to introduce some other things as well. The first step of the process, there is not much, generally can get to the resources we want, but in the process of converting Dex into a jar, using the above method can be used to view the Java source code, but, Dex2jar on the Android switch statement is not very complete resolution, So it looks like it's going to be a lot of work. Example of a class after the "Fried egg" reverse engineering, the following is a method in the Com.danielstudio.app.wowtu.a.ae class that uses Dex2jar and then Jd-gui view

protected void A (g paramg) {if (iscancelled ());do {return;W. E(). Remove(This. b. A);} while (! ( H. A(paramg));String str1 = (string) paramg. C();String str2 = str1. Split("\\|")[1];if (! ( Str1. Split("\\|")[2]. Trim(). Equals("0")) switch (this. C) {Default:case1: Case0:} while (true) {when (true) {while (true) {This. A. C(This. D);          com. Danielstudio. App. Wowtu. F. E. A(W. C(This. A), STR2);} W. A(This. A). Add(This. b. A);        com. Danielstudio. App. Wowtu. C. ELocale2 = This. b;Locale2. I= (1+ Locale2. I);} W. b(This. A). Add(This. b. A);      com. Danielstudio. App. Wowtu. C. ELocale1 = This. b;Locale1. J= (1+ Locale1. J);}  }

The above code format is very ugly, basically do not see the original running logic, so we will introduce an anti-compilation tool, called Procyon, the usage is very simple,

-jar decompiler.-jar procyon-decompiler-0.5.24.jar AutoCloseableExample.class  -jar procyon-decompiler.-jar myJar.-o

The following is code that uses Procyon to decompile the same class

protected void A (final G g) {if (!this. iscancelled()) {W. G. Remove(This. b. A);if (h. A(g)) {final String s = (String) g. C();Final String s2 = s. Split("\\|")[1];if (!s. Split("\\|")[2]. Trim(). Equals("0") {switch (this. C) {case1: {This. A. E. Add(This. b. A);Final E B = this. b;++b. I;                             Break;} case0: {This. A. F. Add(This. b. A);Final e B2 = this. b;++b2. J;                             Break;}} This. A. C(This. D);}com. Danielstudio. App. Wowtu. F. E. A(This. A. b, S2);}        }    }

Code logic so clear, there is no surprise to AH ~
So, you can't just know the tools that are well known, there are a lot of other tools that are very useful.

Code Framework Parsing

OK, now we get the source code we want, here is the post-compilation directory structure, let's simply analyze

If you have downloaded "fried egg", you should be able to see that the UI is using a very new design style, that is material design style. But the real material design requires the support of the Android L version, so to consider compatibility, it is necessary to use the latest SUPPORT.V7 Compatibility Pack and other compatible components, which is also reflected in the package structure above.

Com.afollestad.materialdialogs this bag, from the name can also see is a material Design style dialog, is to maintain the unity of style.

Com.danielstudio.app.wowtu This bag, it is the core package of the Omelette app, inside is the specific logic code, we need to focus on the analysis of things are in here

Loopj.android.http is this bag familiar? This is android-async-http, a very well-known open source framework for Web requests, which is the core package of network requests for the entire project

Com.nostra13.universalimageloader This bag doesn't have to be a lot of crap. Load the frame of the picture, the function is very powerful

The packages below are third-party SDKs for sharing, such as QQ and Sina, and Umeng is the third-party SDK for channel statistics and upgrades.

The bottom uk.co.senab.phtotview is a powerful picture display control that can be freely retracted according to gestures.

So far, we have been aware of the main framework of the app, below I would like to briefly say the overall framework of high imitation.

In terms of network requests, I tend to use volley because this library is optimized for frequent small data volume requests in complex network situations, so it's more appropriate to have an app for the content category of fried eggs.

In the picture loading aspect, although UIL can be qualified for this work, but I am ready to try the new Facebook fresco picture loading frame, before I translated an official introduction about fresco, For details, please stamp the Android image loading library-fresco Facebook.

Other frameworks, such as butter knife, are also ready to try, although it is not necessary to use the IOC framework in this project, but the previous project uses afinal, so get ready to start, try to use it.

In fact, the main framework of the temporary thought so much, more need to do one side of the introduction, more is the view of open source projects, skilled use of Githun oh ~

Tcpdump Grab Bag

In fact, the above do these work are very simple, more importantly, how we go to get Data interface, no interface, how we high imitation, is not? Since the fried egg app is confusing, most of the core code is hard to read, so I'll show you how to use tcpdump on Android devices to grab a packet.

Tcpdump is a very powerful network data acquisition tool in Linux, that is, we often say that grab bag tool, grab bag can do a lot of bad things, but, we are good children ~

Because the Android system itself is Linux 2.6 kenal as the kernel, so we can use tcpdump to grab the packet.

First of all, we need to upload the tcpdump to our test machine, I use the ENG engineering Mode NEXUS5 Tester, the use of genymotion virtual machine is not successful, probably because Tcpdump can not run on the x86 architecture of the virtual machine, The ADT Native virtual machine is an ARM architecture and should be available, but my open is too slow, there is no test, if you want to use the real machine, make sure it is Eng engineering mode.

After you have the test machine, ADB connects, and then use the following command to see if the connection device is successful

kaiqiangzhaoMacBook:~ zhaokaiqiang$ adb devicesListof16e8718e    device

After the connection is successful, upload the tcpdump to the/data/local/tcpdump path using the following command

kaiqiangzhaoMacBook:~ zhaokaiqiang$ adb push ~/Desktop/tcpdump /data/local/tcpdump4189KB/s (1801155in0.419s)kaiqiangzhaoMacBook:~ zhaokaiqiang$ 

Then use the following command to modify the permissions

kaiqiangzhaoMacBook777 /data/local/tcpdump

So far, our tcpdump has been deployed successfully.

Let's briefly describe a few common commands.

The following command is the simplest command to grab a packet

adb shell /data/local-n-s0

-N means not translating the network address into a name
-S 0 The default fetch length is 68 bytes when fetching packets. Plus-S 0 can catch complete packets

Because we have a lot of network requests, we need to filter, for example, to get all the packets received and sent by all 10.10.10.1 hosts.

kaiqiangzhaoMacBook:~ zhaokaiqiang$ adb shell /data/local-n-s010.10.10.1

Tcpdump also have a lot of powerful usage, I will not explain, in my collection of articles have, we have a message. Good article collation for Android related issues

The commands we use are the following

 adb shell /data/local-n-s0-w /sdcard/jiandan.10.10.10.your ip

So we can get all the packets that are communicating with the current IP and then save it to the/sdcard/jiandan.pcap file and wait for us to analyze it with the wireshake below.

Wireshake Analysis Packets

Through the above step, we have caught the fried egg app and server communication packet, when grasping the package, there are a few points to note:

1. Minimize the number of apps on your test machine and avoid confusing unwanted data
2. Grab the bag as short and effective as possible when the app is requested and stop immediately after the request has been completed

In this way, we can get our Pcap format packet, and the next step is to use Wireshake for data analysis.
Wireshake is also very powerful, but we are just simple to use, more powerful features to explore.

We can use the following command to download the file

adb pull /sdcard/jiandan.pcap ~/Desktop/jiandan.pcap

Below is a grab packet of data, opened with Wireshark, as follows

Notice where the red box is. In general, the information-based app access to data is the interface using the HTTP protocol, and the real-time requirements of the more high-quality apps, such as the stock market class, the use of socket communication, shown here is the use of the TCP protocol. We can see that the local IP and 42.120.48.125 HTTP communication, click on the packet data below, you can see in the request text of our full request URL, this is to get the interface of the joke, using page paging.

In fact, according to this method, we can be basically all the HTTP interface to crawl out, but there is a better way, in general, these addresses are hardcoded in the code, know an address format, we can directly search to find out other similar interfaces, for example, We put the first anti-compiled class file in the Java project in Eclipse, and then the whole project to find the keyword Oxwlxojflwblxbsapi try

Sure enough, there are a lot of interface address, so that we can save a lot of effort, specific interface testing not much to say, to try.

In fact, at first I want to do fried egg client, is through Jsoup parsing Web URL implementation, but also resolved successfully, can normal use, but later whim, want to see the code how to write, on the way to see the next, the successful access to the interface, can be more convenient to use, so it is directly used.

This project of the Satin function module, has been basically completed, the follow-up function is being done, I hope this project can become a beginner's good learning materials
, I am also very attentively in doing, if you read the code, some gains, that is excellent, if you find that I write code performance is not good, or there is a better solution, I hope you can tell me, submit issue or pull request, I want to do this project better than the 9GAG project.

The following are the completed functions

1. Satin Display
2. Comment Quantity Display
3. Comment Details Show
4. Comment Too many hidden floors
5. Loading animations
6. Left Slide exit
7. Vote
8. Other features being perfected ...

GitHub address for this project: Https://github.com/ZhaoKaiQiang/JianDan

Thanks to the fried egg developer Danielwangdev

Follow-up will continue to update ...

Finally, let's warn you: the technology, data, and interface addresses in this series are for learning and communication, so be sure not to do bad things! Otherwise the consequences are self-esteem!

"I'll take you to the high imitation" "Omelette" Android version of High Imitation and optimization (a)--reverse engineering and tcpdump grab Bag primer