137_移动应用逆向工程实战指南：从APK/IPA文件分析到代码还原的完整流程

环境准备 → 文件结构分析 → 静态分析 → 动态分析 → 代码还原 → 安全机制绕过

# 解压APK文件查看内部结构
unzip app.apk -d app_unzipped
ls -la app_unzipped/

# 查看关键文件
ls -la app_unzipped/classes.dex  # Dalvik字节码文件
ls -la app_unzipped/lib/         # 原生库目录
ls -la app_unzipped/res/         # 资源文件目录
cat app_unzipped/AndroidManifest.xml  # 应用清单文件

# 安装反编译工具
pip install dex2jar jd-cli

# 1. 使用dex2jar将DEX转换为JAR
d2j-dex2jar.sh classes.dex -o app.jar

# 2. 使用JD-CLI反编译JAR为Java源码
jd-cli app.jar -od app_source

# 3. 使用jadx进行一站式反编译
jadx -d jadx_output app.apk

# 4. 使用apktool反编译获取资源和Smali代码
apktool d app.apk -o apktool_output

# Smali代码示例分析
.class public Lcom/example/app/MainActivity;
.super Landroidx/appcompat/app/AppCompatActivity;

.method public onCreate(Landroid/os/Bundle;)V
    .locals 2

    .line 15
    invoke-super {p0, p1}, Landroidx/appcompat/app/AppCompatActivity;->onCreate(Landroid/os/Bundle;)V

    .line 16
    const v0, 0x7f0a0000

    invoke-virtual {p0, v0}, Lcom/example/app/MainActivity;->setContentView(I)V

    .line 18
    return-void
.end method

// 使用Frida进行动态逆向分析
Java.perform(function() {
    // 找到目标类
    var MainActivity = Java.use('com.example.app.MainActivity');
    
    // 拦截方法调用
    MainActivity.onCreate.implementation = function(savedInstanceState) {
        console.log('[*] MainActivity.onCreate() called');
        
        // 调用原始方法
        this.onCreate(savedInstanceState);
        
        // 注入自定义代码
        console.log('[*] Injecting custom code');
        try {
            var Toast = Java.use('android.widget.Toast');
            Toast.makeText(
                this.getApplicationContext(),
                'Reverse Engineered!',
                Toast.LENGTH_LONG
            ).show();
        } catch (e) {
            console.log('[!] Error: ' + e.message);
        }
    };
    
    // 分析加密方法
    var CryptoUtils = Java.use('com.example.app.utils.CryptoUtils');
    CryptoUtils.encrypt.implementation = function(data, key) {
        console.log('[+] Encrypt called with data: ' + data);
        console.log('[+] Encrypt key: ' + key);
        
        // 调用原始方法并获取结果
        var result = this.encrypt(data, key);
        console.log('[+] Encrypt result: ' + result);
        
        return result;
    };
});

# 解压IPA文件查看内部结构
unzip app.ipa -d ipa_unzipped
ls -la ipa_unzipped/

# 查看关键文件
ls -la ipa_unzipped/Payload/*.app/  # 应用包目录
cat ipa_unzipped/Payload/*.app/Info.plist  # 应用信息文件

# 安装必要的工具
brew install class-dump hopper-disassembler ida-pro

# 1. 使用class-dump提取类信息
class-dump -H Payload/ExampleApp.app/ExampleApp -o class_dump_output

# 2. 使用otool查看二进制信息
otool -l Payload/ExampleApp.app/ExampleApp  # 加载命令

otool -tV Payload/ExampleApp.app/ExampleApp  # 反汇编

otool -L Payload/ExampleApp.app/ExampleApp  # 查看依赖库

# 3. 使用strings查找字符串信息
strings Payload/ExampleApp.app/ExampleApp > strings_output.txt
grep -i "api\|key\|token" strings_output.txt

// 伪代码示例：分析Objective-C方法调用模式

// 典型的Objective-C方法调用模式
// [object method:argument]
// 在汇编中表现为:
// mov x0, #object
// mov x1, #selector
// mov x2, #argument
// bl _objc_msgSend

// 使用Hopper Disassembler或IDA Pro分析
// 查找关键方法调用
// 分析内存布局和对象结构

// 使用Frida对iOS应用进行动态逆向
ObjC.schedule(ObjC.mainQueue, function() {
    // 查找目标类
    var MainViewController = ObjC.classes.MainViewController;
    
    // 拦截viewDidLoad方法
    MainViewController.viewDidLoad.implementation = function() {
        console.log('[*] MainViewController.viewDidLoad() called');
        
        // 调用原始方法
        this.viewDidLoad();
        
        // 注入自定义行为
        var UIAlertView = ObjC.classes.UIAlertView;
        var alert = UIAlertView.alloc().initWithTitle_message_delegate_cancelButtonTitle_otherButtonTitles_("Reverse Engineering", "App has been reverse engineered!", null, "OK", null);
        alert.show();
        
        console.log('[*] Alert shown');
    };
    
    // 分析网络请求
    var URLSession = ObjC.classes.NSURLSession;
    var dataTaskWithURL_completionHandler_ = URLSession.dataTaskWithURL_completionHandler_;
    URLSession.dataTaskWithURL_completionHandler_.implementation = function(url, handler) {
        console.log('[+] URLSession.dataTaskWithURL called');
        console.log('[+] URL: ' + url.toString());
        
        // 调用原始方法并修改回调
        var myHandler = new ObjC.Block({ 
            retType: 'void', 
            argTypes: ['id', 'id', 'id'], 
            implementation: function(data, response, error) {
                console.log('[+] Response data length: ' + data.length());
                // 可以在此处理响应数据
                handler(data, response, error);
            }
        });
        
        return this.dataTaskWithURL_completionHandler_(url, myHandler);
    };
});

# 简单的Java反混淆辅助脚本示例
import re

def deobfuscate_variable_names(smali_code):
    # 简单的变量重命名示例
    var_count = 0
    var_mapping = {}
    
    # 查找混淆的变量名
    for var in re.findall(r'v\\d+', smali_code):
        if var not in var_mapping:
            var_mapping[var] = f'var_{var_count}'
            var_count += 1
    
    # 替换混淆的变量名
    for old_var, new_var in var_mapping.items():
        smali_code = smali_code.replace(old_var, new_var)
    
    return smali_code

# 应用反混淆
def apply_deobfuscation(smali_file):
    with open(smali_file, 'r') as f:
        smali_code = f.read()
    
    deobfuscated_code = deobfuscate_variable_names(smali_code)
    
    with open(f"{smali_file}.deobfuscated", 'w') as f:
        f.write(deobfuscated_code)
    
    print(f"Deobfuscated {smali_file}")

// Android反调试保护绕过示例
Java.perform(function() {
    // 1. 绕过Debug.isDebuggerConnected()
    var Debug = Java.use('android.os.Debug');
    Debug.isDebuggerConnected.implementation = function() {
        console.log('[*] Bypassing isDebuggerConnected()');
        return false;
    };
    
    // 2. 绕过检测ptrace附加
    var Process = Java.use('java.lang.Process');
    var Runtime = Java.use('java.lang.Runtime');
    
    Runtime.getRuntime.implementation = function() {
        var runtime = this.getRuntime();
        
        // 替换exec方法，过滤ptrace检测命令
        var exec_method = runtime.exec.overload('java.lang.String');
        exec_method.implementation = function(command) {
            console.log('[*] Intercepted exec command: ' + command);
            
            if (command.indexOf('ps') >= 0 || command.indexOf('cat /proc') >= 0) {
                // 返回空进程，模拟无调试器
                console.log('[+] Blocked debugger detection command');
                return Java.use('java.lang.ProcessBuilder').newArray(['echo']).start();
            }
            
            return exec_method.call(this, command);
        };
        
        return runtime;
    };
    
    // 3. 绕过应用完整性检查
    var PackageManager = Java.use('android.content.pm.PackageManager');
    PackageManager.getPackageInfo.implementation = function(packageName, flags) {
        var packageInfo = this.getPackageInfo(packageName, flags);
        
        if (packageName === Java.use('android.app.ActivityThread').currentPackageName()) {
            // 修改签名信息，绕过签名校验
            console.log('[+] Modifying package signature info');
            // 实际实现需要根据具体校验方式调整
        }
        
        return packageInfo;
    };
});

# Android内存转储与分析

# 1. 获取应用进程ID
adb shell ps | grep com.example.app

# 2. 使用DDMS或命令行转储内存
adb shell su -c "dd if=/proc/[PID]/mem of=/sdcard/mem_dump bs=1024 count=10240"

# 3. 提取转储文件
adb pull /sdcard/mem_dump .

# 4. 使用Volatility或其他工具分析内存
volatility -f mem_dump --profile=Linuxprofile linux_pslist

# iOS内存取证
# 在越狱设备上使用Cycript获取内存信息
ssh root@<device-ip> 'cycript -p AppName'

# 在Cycript控制台中：
var app = [UIApplication sharedApplication];
var keyWindow = app.keyWindow;
var rootViewController = keyWindow.rootViewController;
# 探索应用对象层次结构

// 使用Frida监控网络请求和响应
Java.perform(function() {
    // Android网络请求监控
    var URLConnection = Java.use('java.net.URLConnection');
    var HttpURLConnection = Java.use('java.net.HttpURLConnection');
    
    URLConnection.connect.implementation = function() {
        console.log('[*] URLConnection.connect called');
        console.log('[*] URL: ' + this.getURL());
        this.connect();
    };
    
    HttpURLConnection.getInputStream.implementation = function() {
        var stream = this.getInputStream();
        
        // 读取响应数据
        var BufferedReader = Java.use('java.io.BufferedReader');
        var InputStreamReader = Java.use('java.io.InputStreamReader');
        var reader = BufferedReader.$new(InputStreamReader.$new(stream));
        
        var line, response = '';
        while ((line = reader.readLine()) !== null) {
            response += line;
        }
        
        console.log('[+] HTTP Response: ' + response);
        
        // 重建输入流以便应用继续使用
        var ByteArrayInputStream = Java.use('java.io.ByteArrayInputStream');
        var bytes = response.getBytes('UTF-8');
        return ByteArrayInputStream.$new(bytes);
    };
});

// 完整的SSL证书验证绕过脚本
Java.perform(function() {
    // 1. 绕过X509TrustManager验证
    var TrustManager = Java.use('javax.net.ssl.X509TrustManager');
    var TrustManagerImpl = Java.registerClass({
        name: 'javax.net.ssl.X509TrustManager',
        implements: [TrustManager],
        methods: {
            checkClientTrusted: function(chain, authType) {},
            checkServerTrusted: function(chain, authType) {},
            getAcceptedIssuers: function() { return []; }
        }
    });
    
    // 2. 绕过HostnameVerifier
    var HostnameVerifier = Java.use('javax.net.ssl.HostnameVerifier');
    var HostnameVerifierImpl = Java.registerClass({
        name: 'javax.net.ssl.HostnameVerifier',
        implements: [HostnameVerifier],
        methods: {
            verify: function(hostname, session) { return true; }
        }
    });
    
    // 3. 修改SSLContext的TrustManager
    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    var context = SSLContext.getInstance('TLS');
    context.init(null, [TrustManagerImpl.$new()], null);
    
    // 4. 替换默认的SSLSocketFactory和HostnameVerifier
    var HttpsURLConnection = Java.use('javax.net.ssl.HttpsURLConnection');
    HttpsURLConnection.setDefaultSSLSocketFactory(context.getSocketFactory());
    HttpsURLConnection.setDefaultHostnameVerifier(HostnameVerifierImpl.$new());
    
    console.log('[+] SSL certificate validation bypassed');
    
    // 5. 监控网络请求以验证绕过是否成功
    HttpsURLConnection.connect.implementation = function() {
        console.log('[*] HTTPS Request to: ' + this.getURL());
        this.connect();
        
        var responseCode = this.getResponseCode();
        console.log('[+] HTTPS Response Code: ' + responseCode);
    };
});

// iOS应用功能解锁脚本
ObjC.schedule(ObjC.mainQueue, function() {
    try {
        // 1. 查找处理付费状态的类
        var PurchasesManager = ObjC.classes.PurchasesManager;
        console.log('[*] Found PurchasesManager class');
        
        // 2. 查找检查付费状态的方法
        var isPremiumMethod = PurchasesManager['- isPremiumUser'];
        console.log('[*] Found isPremiumUser method');
        
        // 3. 替换方法实现，始终返回true
        Interceptor.attach(isPremiumMethod.implementation, {
            onLeave: function(retval) {
                console.log('[+] Original isPremiumUser result: ' + (retval.readU8() === 1 ? 'true' : 'false'));
                console.log('[+] Modifying result to: true');
                retval.replace(ObjC.ptr(1));
                return retval;
            }
        });
        
        // 4. 查找解锁功能的方法并调用
        if (PurchasesManager['- unlockPremiumFeatures']) {
            var unlockMethod = PurchasesManager['- unlockPremiumFeatures'];
            console.log('[*] Calling unlockPremiumFeatures method');
            
            // 获取单例实例并调用方法
            var sharedInstance = PurchasesManager.sharedInstance();
            if (sharedInstance) {
                sharedInstance['- unlockPremiumFeatures']();
                console.log('[+] Premium features unlocked');
            }
        }
        
        // 5. 监控购买请求
        var purchaseProductMethod = PurchasesManager['- purchaseProduct:'];
        if (purchaseProductMethod) {
            Interceptor.attach(purchaseProductMethod.implementation, {
                onEnter: function(args) {
                    var productId = new ObjC.Object(args[2]);
                    console.log('[*] Intercepted purchase attempt for product: ' + productId);
                },
                onLeave: function(retval) {
                    console.log('[+] Simulating successful purchase');
                    // 可以在这里修改返回值或触发成功回调
                }
            });
        }
        
    } catch (e) {
        console.log('[!] Error: ' + e.message);
    }
});