Android逆向工程工具

標籤：block   put   github   strong   gic   java虛擬機器   XML   還需要   nali   

Android上的編程主要有兩種，一種是使用Adroid SDK（Software Development Kit），用Java開發；一種是使用Android NDK(Native Development Kit)，用C/C++開發，因為Android核心是基於Linux Kernel的，用C/C++是最便捷的方式但相對複雜。這裡針對的是Java開發的方式。

Adroid上的Java虛擬機器Dalvik虛擬機器和經典java運作模式大致相同，但Dalvik虛擬機器是為Adroid系統最佳化定製過的。

標準的Java開發流程中，編譯時間用Java JDK（Java Development Kit）編譯Java源碼檔案到.class檔案即Java位元組碼檔案（多個.class檔案可以打包成.jar檔案，僅僅是打包），標準Java虛擬機器中啟動並執行是.class位元組碼。
而Adroid上的Java編譯流程中同樣需要先編譯到.class檔案，但還需要Android SDK中的dx工具將.class檔案轉換成.dex檔案（在Dalvik虛擬機器中執行的是dex位元組碼），然後用Android SDK中的打包工具aapt將.dex檔案、資源檔、manifest.xml打包成程式包.apk檔案，.apk檔案就是可以被發布的最終程式。

Mobile移動平台開發中，有種所謂的Native Application原生程式，這是相對Web開發中的Hyrid Application而言的，前面所述的Android上的兩種編程方式都可以算作Android平台上的Native Application，iOS平台的Native開發使用Object-C開發、不過現在又要改用Swift語言。
因為移動平台越來越多樣複雜，所以前端/用戶端Web開發越來越複雜，但通過一個Native Container來提供一個各個平台功能的統一介面是一種趨勢，於是就有Hybrid Application模式。Web開發中的Hyrid Application，是指在用戶端，用客戶機（Android or iOS）上的瀏覽器，比如iOS中的UIWebView、Android中的WebView作為運行載體，Hyrid Application本身用Html5、CSS、Javascript編寫，可用Cordova封裝成Native程式存取運行平台的功能、可以一套代碼多個移動平台運行，相比於每個平台一套Native Application的開發方式大大減少工作量，但缺點是效能較差，PhoneGap是Cordova的一個變種被Javascript庫ExtJS所使用。
https://en.wikipedia.org/wiki/Apache_Cordova#Design_and_rationale

Apache Cordova (formerly PhoneGap) is a mobile application development framework originally created by Nitobi. Adobe Systems purchased Nitobi in 2011, rebranded it as PhoneGap, and later released an open source version of the software called Apache Cordova.^{[3] Apache Cordova enables software programmers to build applications for mobile devices using CSS3, HTML5, and JavaScript instead of relying on platform-specific APIs like those in Android, iOS, or Windows Phone.[4] It enables wrapping up of CSS, HTML, and JavaScript code depending upon the platform of the device. It extends the features of HTML and JavaScript to work with the device. The resulting applications are hybrid, meaning that they are neither truly native mobile application (because all layout rendering is done via Web views instead of the platform‘s native UI framework) nor purely Web-based (because they are not just Web apps, but are packaged as apps for distribution and have access to native device APIs). Mixing native and hybrid code snippets has been possible since version 1.9.
......
The core of Apache Cordova applications use CSS3 and HTML5 for their rendering and JavaScript for their logic. HTML5 provides access to underlying hardware such as the accelerometer, camera, and GPS. However, browsers‘ support for HTML5-based device access is not consistent across mobile browsers, particularly older versions of Android. To overcome these limitations, Apache Cordova embeds the HTML5 code inside a native WebView on the device, using a foreign function interface to access the native resources of it.[26]}

Apache Cordova can be extended with native plug-ins, allowing developers to add more functionalities that can be called from JavaScript, making it communicate directly between the native layer and the HTML5 page. These plugins allow access to the device‘s accelerometer, camera, compass, file system, microphone, and more.

However, the use of Web-based technologies leads some Apache Cordova applications to run slower than native applications with similar functionality.^{[27] Adobe Systems warns that applications may be rejected by Apple for being too slow or not feeling "native" enough (having appearance and functionality consistent with what users have come to expect on the platform). This can be an issue for some Apache Cordova applications.[28][29]}

React前端庫的Native功能與Cordova類似，也是提供一個運行平台與應用app之間的功能緩衝層。
https://facebook.github.io/react-native/

1. APKTool
反編譯android上的app檔案apk到smali代碼。apktool反編譯.apk檔案後會有個smali目錄和目錄中.smali結尾的檔案。
apktool的installation guid:
https://ibotpeaches.github.io/Apktool/install/

smali和dex很容易混淆，因為dalvik虛擬機器啟動並執行是dex位元組碼，從.apk檔案載入到dalvik虛擬機器再啟動並執行流程中，是沒有smali代碼存在的位置的，而.smali檔案和.dex檔案可以互相轉換，之所以如此，是因為.dex位元組碼是不容易閱讀的，而轉換成smali文法的代碼則容易閱讀的多，也容易修改，修改完.smali後可以再轉換成.dex位元組碼，再用aapt工具重新打包、再重新簽名，那麼一個經過纂改的.apk檔案就完工了，但是前提是得有原先.apk檔案的簽名密鑰，不過對於有些廠商來說，他們的.apk檔案的簽名密鑰可以買到。。。
https://www.quora.com/What-is-smali-in-Android

Smali/Baksmali is an assembler/disassembler for the dex format used by dalvik, Android‘s Java VM implementation. The names "Smali" and "Baksmali" are the Icelandic冰島語 equivalents of "assembler" and "disassembler" respectively.

https://stackoverflow.com/questions/30837450/what-is-smali-code-android

When you create an application code, the apk file contains a .dex file, which contains binary Dalvik bytecode. This is the format that the platform actually understands. However, it‘s not easy to read or modify binary code, so there are tools out there to convert to and from a human readable representation. The most common human readable format is known as Smali.

But the platform doesn‘t know anything about smali, it‘s just a tool to make it easier to work with the bytecode.

2. Signapk.jar
signapk.jar是android sdk內建的工具，用Android內建的signapk.jar + .x509.pem + .pk8簽名應用程式。這是一年多前寫的總結，現在找不到了目錄了，暈，得重新找。

3. dex2jar
可以將.dex檔案反編譯成.jar檔案，然後.jar檔案就可以用jd-jui查看，jd-jui本身可以查看標準java編譯成的.jar檔案。
https://github.com/pxb1988/dex2jar

4. jd-jui
jd-jui本身可以查看標準java編譯成的.jar檔案。
http://jd.benow.ca/

5. apkpure.com
是不是煩透了android上的應用程式下載安裝都得經過市集，那就試試在apkpure.com上尋找下載，我自己親自驗證過，apkpure.com可以安全下載apk檔案，apk都是經過校正的，沒有被替換過，因為我用apk作者或廠商的公開的簽名金鑰組apkpure.com上下載的apk校正過，是無誤的。
不過缺點是，程式自動升級一般得經過市集，apkpure.com上下載的apk安裝後升級可能要自己手動。

 

Android逆向工程工具