Android二代壳对方法体的静态抽取和动态回填过程

1
2
3
4
5
6
7
8
9

package dev.svip.dextest;

import android.util.Log;

public class test {
    public void testFunc(){
        Log.i("sviplog", "hi, I'm from testFunc");
    }
}

1

java -jar /root/Android/Sdk/build-tools/30.0.2/lib/dx.jar --dex --output=test.dex dev/svip/dextest/test.class

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

#! /usr/bin/python
# -*- coding: utf8 -*-
import binascii

def CalculationVar(srcByte,vara,varb):
    varA = vara
    varB = varb
    icount = 0
    listAB = []

    while icount < len(srcByte):
        varA = (varA + srcByte[icount]) % 65521
        varB = (varB + varA) % 65521
        icount += 1

    listAB.append(varA)
    listAB.append(varB)

    return listAB

def getCheckSum(varA,varB):
    Output = (varB << 16) + varA
    return Output

if __name__ == '__main__':
    filename = 'new.dex'
    f = open(filename, 'rb', True)
    f.seek(0x0c)
    VarA = 1
    VarB = 0
    flag = 0
    CheckSum = 0
    while True:
        srcBytes = []
        for i in range(1024):               #一次只读1024个字节，防止内存占用过大
            ch = f.read(1)
            if not ch:                      #如果读取到末尾，设置标识符，然后退出读取循环
                flag = 1
                break
            else:
                ch = binascii.b2a_hex(ch)   #将字节转为int类型，然后添加到数组中
                ch = str(ch)
                ch = int(ch,16)
                srcBytes.append(ch)
        varList = CalculationVar(srcBytes,VarA,VarB)
        VarA = varList[0]
        VarB = varList[1]
        if flag == 1:
            CheckSum = getCheckSum(VarA,VarB)
            break
    print('[*] DEX FILENAME: '+filename)
    print('[+] CheckSum = '+hex(CheckSum))