0x00 简单介绍
目前我己知的APK加固主要有以下两种方式（或有其它的方式有待发现）
隐藏dex文件：通过对目标DEX文件进行整体加密或压缩方式把整个dex转换为另外一个文件存放在assets文件夹中或者其它地方，然后利用类加载器技术进行内存解密并加载运行。
修改dex结构：抽取DexCode中的字节码指令后用零去填充，或者修改方法属性等操作，运行时在内存中做修正、修复等处理工作。
0x01 APK加固前后对比
整体来看一下原始APK包和加固后的APK包结构相关变化
图1
图1所示加固后的APK包变化如下:
新增2个文件夹：
assets文件夹中增加3个文件
data
dx
pk
lib文件夹中增加了2个so文件
libedog.so
libfdog.so
被修改的文件:
AndroidManifest.xml
classes.dex
0x02 壳流程分析
我们用AndroidKiller反编译加固后的APK, 反编译出错，错误日志如下:
图2
从图2可以看出反编译时出现了很多错误，我们用IDA对DEX进行反编译查看代码，发现方法指令都被零填充了，反编译后代码显示为nop样式，如图3所示。
图3
我们再来看看APK中的AndroidManifest.xml文件被修改了什么地方？
图4
从图4看到AndroidManifest.xml中的application新增了如下项做为壳的入口
android:name="com.edog.AppWrapper"该类为壳的入口，继续分析AppWrapper都做了些什么？
图5
图6
图7
从图5-7可以看出最终会调用到libedog.so中的dl函数，下面就开始动态调试分析该so的功能流程（如何动态调试就不说了，网上己经有很多的教程了）。
通过动态分析libedog.so中的dl函数主要功能是: 获得系统版本号->验证加固前后的签名是否一致->反调试->将抽走的指令映射到内存中还原指令时用到->HOOK函数dvmResolveClass->结束
代码流程如下：
1 libedog.so:5D692C18 Java_com_edog_ELibrary_d1
2 libedog.so:5D692C18
3 libedog.so:5D692C18 var_F0= -0xF0
4 libedog.so:5D692C18 var_EC= -0xEC
5 libedog.so:5D692C18 var_E4= -0xE4
6 libedog.so:5D692C18 var_1C= -0x1C
7 libedog.so:5D692C18 arg_0= 0
8 libedog.so:5D692C18
9 libedog.so:5D692C18 F0 B5 PUSH {R4-R7,LR}
10 libedog.so:5D692C1A 28 4F LDR R7, =(dword_5D6A5E60 - 0x5D692C24)
11 libedog.so:5D692C1C B7 B0 SUB SP, SP, #0xDC
12 libedog.so:5D692C1E 00 93 STR R3, [SP,#0xF0+var_F0]
13 libedog.so:5D692C20 7F 44 ADD R7, PC ; dword_5D6A5E60
14 libedog.so:5D692C22 3F 68 LDR R7, [R7]
15 libedog.so:5D692C24 3C 99 LDR R1, [SP,#0xF0+arg_0]
16 libedog.so:5D692C26 04 1C MOVS R4, R0
17 libedog.so:5D692C28 3B 68 LDR R3, [R7]
18 libedog.so:5D692C2A 01 91 STR R1, [SP,#0xF0+var_EC]
19 libedog.so:5D692C2C A9 21 MOVS R1, #0xA9
20 libedog.so:5D692C2E 35 93 STR R3, [SP,#0xF0+var_1C]
21 libedog.so:5D692C30 03 68 LDR R3, [R0]
22 libedog.so:5D692C32 89 00 LSLS R1, R1, #2
23 libedog.so:5D692C34 22 4D LDR R5, =(aFjFj0fjFjFj4fj - 0x5D692C42)
24 libedog.so:5D692C36 5B 58 LDR R3, [R3,R1]
25 libedog.so:5D692C38 11 1C MOVS R1, R2
26 libedog.so:5D692C3A 00 22 MOVS R2, #0
27 libedog.so:5D692C3C 98 47 BLX R3
28 libedog.so:5D692C3E 7D 44 ADD R5, PC ; "$fj] fj]0fj](fj],fj]4fj]i]"
29 libedog.so:5D692C40 2D 68 LDR R5, [R5] ; "$fj] fj]0fj](fj],fj]4fj]i]"
30 libedog.so:5D692C42 20 4E LDR R6, =(aFjFj0fjFjFj4fj+4 - 0x5D692C50)
31 libedog.so:5D692C44 28 60 STR R0, [R5]
32 libedog.so:5D692C46 20 1C MOVS R0, R4
33 libedog.so:5D692C48 00 F0 5C F8 BL _Z17ANDROID_API_LEVELP7_JNIEnv
34 libedog.so:5D692C4C 7E 44 ADD R6, PC ; " fj]0fj](fj],fj]4fj]i]"
35 libedog.so:5D692C4E 36 68 LDR R6, [R6] ; " fj]0fj](fj],fj]4fj]i]"
36 libedog.so:5D692C50 30 60 STR R0, [R6]
37 libedog.so:5D692C52 20 1C MOVS R0, R4
38 libedog.so:5D692C54 00 F0 82 F8 BL _Z24ANDROID_PLATFORM_VERSIONP7_JNIEnv
39 libedog.so:5D692C58 20 1C MOVS R0, R4
40 libedog.so:5D692C5A 00 F0 A9 F8 BL _Z22ANDROID_PLATFORM_MODELP7_JNIEnv
41 libedog.so:5D692C5E 20 1C MOVS R0, R4
42 libedog.so:5D692C60 00 F0 D0 F8 BL _Z22ANDROID_PLATFORM_BRANDP7_JNIEnv
43 libedog.so:5D692C64 20 1C MOVS R0, R4
44 libedog.so:5D692C66 01 99 LDR R1, [SP,#0xF0+var_EC]
45 libedog.so:5D692C68 00 F0 8A FC BL _Z6verifyP7_JNIEnvP8_jobject ; 比较加固前后的签名是否一致
46 libedog.so:5D692C6C 16 49 LDR R1, =(aDataDataSLibLi - 0x5D692C76)
47 libedog.so:5D692C6E 2A 68 LDR R2, [R5]
48 libedog.so:5D692C70 03 A8 ADD R0, SP, #0xF0+var_E4
49 libedog.so:5D692C72 79 44 ADD R1, PC ; "/data/data/%s/lib/libfdog.so"
50 libedog.so:5D692C74 FF F7 B0 EE BLX sprintf
51 libedog.so:5D692C78 03 A8 ADD R0, SP, #0xF0+var_E4
52 libedog.so:5D692C7A 01 1C MOVS R1, R0
53 libedog.so:5D692C7C 00 F0 02 FD BL _Z4antiPKcS0_ ; 反调试
54 libedog.so:5D692C80 00 F0 3E F9 BL _Z10openMemoryv ; 将抽走的指令映射到内存中来
55 libedog.so:5D692C80 ; assets中的data文件
56 libedog.so:5D692C84 23 68 LDR R3, [R4]
57 libedog.so:5D692C86 A9 22 92 00 MOVS R2, #0x2A4
58 libedog.so:5D692C8A 9B 58 LDR R3, [R3,R2]
59 libedog.so:5D692C8C 00 99 LDR R1, [SP,#0xF0+var_F0]
60 libedog.so:5D692C8E 20 1C MOVS R0, R4
61 libedog.so:5D692C90 00 22 MOVS R2, #0
62 libedog.so:5D692C92 98 47 BLX R3
63 libedog.so:5D692C94 0D 49 LDR R1, =(unk_5D6A2A0D - 0x5D692C9A)
64 libedog.so:5D692C96 79 44 ADD R1, PC
65 libedog.so:5D692C98 FF F7 A4 EE BLX strstr
66 libedog.so:5D692C9C 00 28 CMP R0, #0
67 libedog.so:5D692C9E 02 D1 BNE loc_5D692CA6
68 libedog.so:5D692CA0 33 68 LDR R3, [R6]
69 libedog.so:5D692CA2 14 2B CMP R3, #0x14 ; 判断版本
70 libedog.so:5D692CA4 00 DD BLE loc_5D692CA8 ; 根据操作系统的版本
71 libedog.so:5D692CA4 ; hook对应的dvmResolveClass函数
72 libedog.so:5D692CA6
73 libedog.so:5D692CA6 loc_5D692CA6 ; CODE XREF: Java_com_edog_ELibrary_d1+86j
74 libedog.so:5D692CA6 01 20 MOVS R0, #1
75 libedog.so:5D692CA8
76 libedog.so:5D692CA8 loc_5D692CA8 ; CODE XREF: Java_com_edog_ELibrary_d1+8Cj
77 libedog.so:5D692CA8 00 F0 E8 FB BL _Z7restorei ; 根据操作系统的版本
78 libedog.so:5D692CA8 ; hook对应的dvmResolveClass函数
79 libedog.so:5D692CAC 35 9A LDR R2, [SP,#0xF0+var_1C]
80 libedog.so:5D692CAE 3B 68 LDR R3, [R7]
81 libedog.so:5D692CB0 9A 42 CMP R2, R3
82 libedog.so:5D692CB2 01 D0 BEQ loc_5D692CB8
83 libedog.so:5D692CB4 FF F7 9C EE BLX sub_5D6929F0
84 libedog.so:5D692CB8 ; ---------------------------------------------------------------------------
85 libedog.so:5D692CB8
86 libedog.so:5D692CB8 loc_5D692CB8 ; CODE XREF: Java_com_edog_ELibrary_d1+9Aj
87 libedog.so:5D692CB8 37 B0 ADD SP, SP, #0xDC
88 libedog.so:5D692CBA F0 BD POP {R4-R7,PC}
89 libedog.so:5D692CBA ; End of function Java_com_edog_ELibrary_d1
90 libedog.so:5D692CBA
91 libedog.so:5D692CBA ; -------------------------------------
0x03 指令还原算法分析
原始指令还原时机就是在dvmResolveClass的hook函数中对对指令进行解密还原，以下结构的中的几个值会用到，因为被保护后的方法中的 debugInfoOff的值被修改成从0x20000000开始的一个值，该值在指令还原时起到重要作用。
1 struct DexCode {
2 u2 registersSize;
3 u2 insSize;
4 u2 outsSize;
5 u2 triesSize;
6 u4 debugInfoOff; /* file offset to debug info stream */
7 u4 insnsSize; /* size of the insns array, in u2 units */
8 u2 insns[1];
9 };
指令还原大致流程如下：
判断是否为保护的类->判断debuginfo值大于0x1FFFFFFF->将debuginfo值左移8位再右移6位->将移位后的值加上加密指令在内存中的开始址取4字节做为偏移->将偏移加上加密指令在内存中的开始地址定位到对应方法的指令->解密指令并还原->清零debuginfo值->结束。
解密指令算法流程如下：(每4字节进行xor)
XorArray函数中进行解密操作->将方法debuginfo值进行crc32计算得到一个值->crc32计算得到的值与指令每4字节进行xor->4字节结束后再将crc32值用PolyXorKey函数生成一个新的4字节数做为密钥,一直循环到解密完成。
代码流程如下
1 libedog.so:5D693144
2 libedog.so:5D693144 _Z13restoreMethodP11ClassObjectP6Method ; CODE XREF: _Z10replaceFunP11ClassObjectjb+22p
3 libedog.so:5D693144 ; _Z10replaceFunP11ClassObjectjb+3Ap
4 libedog.so:5D693144
5 libedog.so:5D693144 var_34= -0x34
6 libedog.so:5D693144 Debug_info= -0x30
7 libedog.so:5D693144 var_2C= -0x2C
8 libedog.so:5D693144 codeSize= -0x28
9 libedog.so:5D693144 data= -0x24
10 libedog.so:5D693144 codeoffset= -0x1C
11 libedog.so:5D693144
12 libedog.so:5D693144 F0 B5 PUSH {R4-R7,LR}
13 libedog.so:5D693146 89 B0 SUB SP, SP, #0x24
14 libedog.so:5D693148 0F 1E SUBS R7, R1, #0
15 libedog.so:5D69314A 5C D0 BEQ loc_5D693206
16 libedog.so:5D69314C 84 69 LDR R4, [R0,#0x18]
17 libedog.so:5D69314E 00 2C CMP R4, #0
18 libedog.so:5D693150 59 D0 BEQ loc_5D693206
19 libedog.so:5D693152 20 1C MOVS R0, R4
20 libedog.so:5D693154 4C 21 MOVS R1, #'L'
21 libedog.so:5D693156 FF F7 A0 EC BLX strchr
22 libedog.so:5D69315A 00 28 CMP R0, #0
23 libedog.so:5D69315C 53 D0 BEQ loc_5D693206
24 libedog.so:5D69315E 3E 6A LDR R6, [R7,#0x20]
25 libedog.so:5D693160 00 2E CMP R6, #0
26 libedog.so:5D693162 50 D0 BEQ loc_5D693206
27 libedog.so:5D693164 35 1C MOVS R5, R6
28 libedog.so:5D693166 10 3D SUBS R5, #0x10
29 libedog.so:5D693168 AA 68 LDR R2, [R5,#8]
30 libedog.so:5D69316A 02 92 STR R2, [SP,#0x38+Debug_info]
31 libedog.so:5D69316C EB 88 LDRH R3, [R5,#6]
32 libedog.so:5D69316E EA 68 LDR R2, [R5,#0xC]
33 libedog.so:5D693170 03 93 STR R3, [SP,#0x38+var_2C]
34 libedog.so:5D693172 04 92 STR R2, [SP,#0x38+codeSize]
35 libedog.so:5D693174 25 4B LDR R3, =0x1FFFFFFF
36 libedog.so:5D693176 02 9A LDR R2, [SP,#0x38+Debug_info]
37 libedog.so:5D693178 9A 42 CMP R2, R3 ; 判断debuginfo值大于 0x1FFFFFFF (因为被保护的方法debuginfo从0X20000000开始)
38 libedog.so:5D69317A 44 D9 BLS loc_5D693206
39 libedog.so:5D69317C 24 49 LDR R1, =(aLandroid - 0x5D693184)
40 libedog.so:5D69317E 20 1C MOVS R0, R4
41 libedog.so:5D693180 79 44 ADD R1, PC ; "Landroid/"
42 libedog.so:5D693182 FF F7 30 EC BLX strstr ; 是系统的类就跳过
43 libedog.so:5D693186 00 28 CMP R0, #0
44 libedog.so:5D693188 3D D1 BNE loc_5D693206
45 libedog.so:5D69318A 36 78 LDRB R6, [R6]
46 libedog.so:5D69318C 01 96 STR R6, [SP,#0x38+var_34]
47 libedog.so:5D69318E 00 2E CMP R6, #0
48 libedog.so:5D693190 39 D1 BNE loc_5D693206
49 libedog.so:5D693192 20 4B LDR R3, =(aFjFj0fjFjFj4fj+0xC - 0x5D69319C)
50 libedog.so:5D693194 07 A8 ADD R0, SP, #0x38+codeoffset
51 libedog.so:5D693196 07 96 STR R6, [SP,#0x38+codeoffset]
52 libedog.so:5D693198 7B 44 ADD R3, PC ; "(fj],fj]4fj]i]"
53 libedog.so:5D69319A 1B 68 LDR R3, [R3] ; "(fj],fj]4fj]i]"
54 libedog.so:5D69319C 1B 68 LDR R3, [R3] ; data数据
55 libedog.so:5D69319E 05 93 STR R3, [SP,#0x38+data]
56 libedog.so:5D6931A0 02 9B LDR R3, [SP,#0x38+Debug_info]
57 libedog.so:5D6931A2 05 9A LDR R2, [SP,#0x38+data]
58 libedog.so:5D6931A4 19 02 LSLS R1, R3, #8
59 libedog.so:5D6931A6 89 09 LSRS R1, R1, #6
60 libedog.so:5D6931A8 89 18 ADDS R1, R1, R2
61 libedog.so:5D6931AA 04 22 MOVS R2, #4
62 libedog.so:5D6931AC FF F7 68 EC BLX memcpy_0
63 libedog.so:5D6931B0 03 9A LDR R2, [SP,#0x38+var_2C]
64 libedog.so:5D6931B2 04 9C LDR R4, [SP,#0x38+codeSize]
65 libedog.so:5D6931B4 93 00 LSLS R3, R2, #2
66 libedog.so:5D6931B6 08 34 ADDS R4, #8
67 libedog.so:5D6931B8 E4 18 ADDS R4, R4, R3
68 libedog.so:5D6931BA 13 1C MOVS R3, R2
69 libedog.so:5D6931BC 01 33 ADDS R3, #1
70 libedog.so:5D6931BE 9B 00 LSLS R3, R3, #2
71 libedog.so:5D6931C0 E4 18 ADDS R4, R4, R3
72 libedog.so:5D6931C2 64 00 LSLS R4, R4, #1
73 libedog.so:5D6931C4 20 1C MOVS R0, R4
74 libedog.so:5D6931C6 FF F7 26 EC BLX malloc
75 libedog.so:5D6931CA 22 1C MOVS R2, R4
76 libedog.so:5D6931CC 06 1C MOVS R6, R0
77 libedog.so:5D6931CE 01 99 LDR R1, [SP,#0x38+var_34]
78 libedog.so:5D6931D0 FF F7 5C EC BLX memset_0
79 libedog.so:5D6931D4 29 1C MOVS R1, R5
80 libedog.so:5D6931D6 22 1C MOVS R2, R4
81 libedog.so:5D6931D8 30 1C MOVS R0, R6
82 libedog.so:5D6931DA FF F7 52 EC BLX memcpy_0
83 libedog.so:5D6931DE 04 9B LDR R3, [SP,#0x38+codeSize]
84 libedog.so:5D6931E0 05 9A LDR R2, [SP,#0x38+data]
85 libedog.so:5D6931E2 07 99 LDR R1, [SP,#0x38+codeoffset]
86 libedog.so:5D6931E4 5D 00 LSLS R5, R3, #1
87 libedog.so:5D6931E6 02 98 LDR R0, [SP,#0x38+Debug_info]
88 libedog.so:5D6931E8 51 18 ADDS R1, R2, R1
89 libedog.so:5D6931EA 01 23 MOVS R3, #1
90 libedog.so:5D6931EC 2A 1C MOVS R2, R5
91 libedog.so:5D6931EE 01 F0 1E EF BLX dbone_crypt_ins ; 解密指令
92 libedog.so:5D6931F2 01 9B LDR R3, [SP,#0x38+var_34]
93 libedog.so:5D6931F4 34 1C MOVS R4, R6
94 libedog.so:5D6931F6 10 34 ADDS R4, #0x10
95 libedog.so:5D6931F8 01 1C MOVS R1, R0
96 libedog.so:5D6931FA B3 60 STR R3, [R6,#8] ; 清空Debug_info
97 libedog.so:5D6931FC 20 1C MOVS R0, R4
98 libedog.so:5D6931FE 2A 1C MOVS R2, R5
99 libedog.so:5D693200 FF F7 3E EC BLX memcpy_0 ; 还原指令
100 libedog.so:5D693204 3C 62 STR R4, [R7,#0x20]
101 libedog.so:5D693206
102 libedog.so:5D693206 loc_5D693206 ; CODE XREF: _Z13restoreMethodP11ClassObjectP6Method+6j
103 libedog.so:5D693206 ; _Z13restoreMethodP11ClassObjectP6Method+Cj ...
104 libedog.so:5D693206 09 B0 ADD SP, SP, #0x24
105 libedog.so:5D693208 F0 BD POP {R4-R7,PC}
106 libedog.so:5D693208 ; End of function _Z13restoreMethodP1
107 解密指令
108 libedog.so:5D69502C
109 libedog.so:5D69502C dbone_crypt_ins ; CODE XREF: _Z13restoreMethodP11ClassObjectP6Method+AAp
110 libedog.so:5D69502C
111 libedog.so:5D69502C DecMode= -0x1C
112 libedog.so:5D69502C codeSize= -0x18
113 libedog.so:5D69502C codedata= -0x14
114 libedog.so:5D69502C key= -0x10
115 libedog.so:5D69502C crckey= -8
116 libedog.so:5D69502C
117 libedog.so:5D69502C 00 48 2D E9 STMFD SP!, {R11,LR}
118 libedog.so:5D695030 04 B0 8D E2 ADD R11, SP, #4
119 libedog.so:5D695034 18 D0 4D E2 SUB SP, SP, #0x18
120 libedog.so:5D695038 10 00 0B E5 STR R0, [R11,#key]
121 libedog.so:5D69503C 14 10 0B E5 STR R1, [R11,#codedata]
122 libedog.so:5D695040 18 20 0B E5 STR R2, [R11,#codeSize]
123 libedog.so:5D695044 1C 30 0B E5 STR R3, [R11,#DecMode] ; 1
124 libedog.so:5D695048 10 30 4B E2 SUB R3, R11, #-key
125 libedog.so:5D69504C 03 00 A0 E1 MOV R0, R3
126 libedog.so:5D695050 04 10 A0 E3 MOV R1, #4
127 libedog.so:5D695054 47 01 00 EB BL _Z5crc32Phj
128 libedog.so:5D695058 00 30 A0 E1 MOV R3, R0
129 libedog.so:5D69505C 08 30 0B E5 STR R3, [R11,#crckey]
130 libedog.so:5D695060 1C 30 1B E5 LDR R3, [R11,#DecMode]
131 libedog.so:5D695064 01 00 53 E3 CMP R3, #1
132 libedog.so:5D695068 06 00 00 1A BNE loc_5D695088
133 libedog.so:5D69506C 08 20 1B E5 LDR R2, [R11,#crckey]
134 libedog.so:5D695070 18 30 1B E5 LDR R3, [R11,#codeSize]
135 libedog.so:5D695074 02 00 A0 E1 MOV R0, R2
136 libedog.so:5D695078 14 10 1B E5 LDR R1, [R11,#codedata]
137 libedog.so:5D69507C 14 20 1B E5 LDR R2, [R11,#codedata]
138 libedog.so:5D695080 80 00 00 EB BL _Z8XorArrayjPhS_j
139 libedog.so:5D695084 0D 00 00 EA B loc_5D6950C0
140 libedog.so:5D695088 ; ---------------------------------------------------------------------------
141 libedog.so:5D695088
142 libedog.so:5D695088 loc_5D695088 ; CODE XREF: dbone_crypt_ins+3Cj
143 libedog.so:5D695088 1C 30 1B E5 LDR R3, [R11,#DecMode]
144 libedog.so:5D69508C 00 00 53 E3 CMP R3, #0
145 libedog.so:5D695090 06 00 00 1A BNE loc_5D6950B0
146 libedog.so:5D695094 10 20 1B E5 LDR R2, [R11,#key]
147 libedog.so:5D695098 18 30 1B E5 LDR R3, [R11,#codeSize]
148 libedog.so:5D69509C 02 00 A0 E1 MOV R0, R2
149 libedog.so:5D6950A0 14 10 1B E5 LDR R1, [R11,#codedata]
150 libedog.so:5D6950A4 14 20 1B E5 LDR R2, [R11,#codedata]
151 libedog.so:5D6950A8 B1 00 00 EB BL _Z13XorArray_0x99jPhS_j
152 libedog.so:5D6950AC 03 00 00 EA B loc_5D6950C0
153 libedog.so:5D6950B0 ; ---------------------------------------------------------------------------
154 libedog.so:5D6950B0
155 libedog.so:5D6950B0 loc_5D6950B0 ; CODE XREF: dbone_crypt_ins+64j
156 libedog.so:5D6950B0 18 30 9F E5 LDR R3, =(aUsageDbone_cry - 0x5D6950BC)
157 libedog.so:5D6950B4 03 30 8F E0 ADD R3, PC, R3 ; "USAGE:dbone_crypt_ins(key,ins,ins_lenth"...
158 libedog.so:5D6950B8 03 00 A0 E1 MOV R0, R3
159 libedog.so:5D6950BC 99 F6 FF EB BL puts
160 libedog.so:5D6950C0
161 libedog.so:5D6950C0 loc_5D6950C0 ; CODE XREF: dbone_crypt_ins+58j
162 libedog.so:5D6950C0 ; dbone_crypt_ins+80j
163 libedog.so:5D6950C0 14 30 1B E5 LDR R3, [R11,#codedata]
164 libedog.so:5D6950C4 03 00 A0 E1 MOV R0, R3
165 libedog.so:5D6950C8 04 D0 4B E2 SUB SP, R11, #4
166 libedog.so:5D6950CC 00 88 BD E8 LDMFD SP!, {R11,PC}
167 libedog.so:5D6950CC ; End of function dbone_crypt_ins
168 libedog.so:5D6950CC
169 libedog.so:5D6950CC ; -------------
170
171 //循环解密
172
173 libedog.so:5D695288 _Z8XorArrayjPhS_j ; CODE XREF: dbone_crypt_file+180p
174 libedog.so:5D695288 ; dbone_crypt_ins+54p
175 libedog.so:5D695288
176 libedog.so:5D695288 codeSize= -0x24
177 libedog.so:5D695288 codedata1= -0x20
178 libedog.so:5D695288 codedata= -0x1C
179 libedog.so:5D695288 crckey= -0x18
180 libedog.so:5D695288 crckey1= -0x14
181 libedog.so:5D695288 crckeyaddr= -0x10
182 libedog.so:5D695288 crckeyindex= -0xC
183 libedog.so:5D695288 index= -8
184 libedog.so:5D695288
185 libedog.so:5D695288 00 48 2D E9 STMFD SP!, {R11,LR}
186 libedog.so:5D69528C 04 B0 8D E2 ADD R11, SP, #4
187 libedog.so:5D695290 20 D0 4D E2 SUB SP, SP, #0x20
188 libedog.so:5D695294 18 00 0B E5 STR R0, [R11,#crckey]
189 libedog.so:5D695298 1C 10 0B E5 STR R1, [R11,#codedata]
190 libedog.so:5D69529C 20 20 0B E5 STR R2, [R11,#codedata1]
191 libedog.so:5D6952A0 24 30 0B E5 STR R3, [R11,#codeSize]
192 libedog.so:5D6952A4 18 30 1B E5 LDR R3, [R11,#crckey]
193 libedog.so:5D6952A8 14 30 0B E5 STR R3, [R11,#crckey1]
194 libedog.so:5D6952AC 14 30 4B E2 SUB R3, R11, #-crckey1
195 libedog.so:5D6952B0 10 30 0B E5 STR R3, [R11,#crckeyaddr]
196 libedog.so:5D6952B4 00 30 A0 E3 MOV R3, #0
197 libedog.so:5D6952B8 08 30 0B E5 STR R3, [R11,#index]
198 libedog.so:5D6952BC 00 30 A0 E3 MOV R3, #0
199 libedog.so:5D6952C0 0C 30 0B E5 STR R3, [R11,#crckeyindex]
200 libedog.so:5D6952C4 00 30 A0 E3 MOV R3, #0
201 libedog.so:5D6952C8 08 30 0B E5 STR R3, [R11,#index]
202 libedog.so:5D6952CC 1E 00 00 EA B loc_5D69534C
203 libedog.so:5D6952D0 ; ---------------------------------------------------------------------------
204 libedog.so:5D6952D0
205 libedog.so:5D6952D0 loc_5D6952D0 ; CODE XREF: _Z8XorArrayjPhS_j+E0j
206 libedog.so:5D6952D0 08 30 1B E5 LDR R3, [R11,#index]
207 libedog.so:5D6952D4 20 20 1B E5 LDR R2, [R11,#codedata1]
208 libedog.so:5D6952D8 03 30 82 E0 ADD R3, R2, R3
209 libedog.so:5D6952DC 08 20 1B E5 LDR R2, [R11,#index]
210 libedog.so:5D6952E0 1C 10 1B E5 LDR R1, [R11,#codedata]
211 libedog.so:5D6952E4 02 20 81 E0 ADD R2, R1, R2
212 libedog.so:5D6952E8 00 10 D2 E5 LDRB R1, [R2]
213 libedog.so:5D6952EC 0C 20 1B E5 LDR R2, [R11,#crckeyindex]
214 libedog.so:5D6952F0 10 00 1B E5 LDR R0, [R11,#crckeyaddr]
215 libedog.so:5D6952F4 02 20 80 E0 ADD R2, R0, R2
216 libedog.so:5D6952F8 00 20 D2 E5 LDRB R2, [R2]
217 libedog.so:5D6952FC 02 20 21 E0 EOR R2, R1, R2
218 libedog.so:5D695300 FF 20 02 E2 AND R2, R2, #0xFF
219 libedog.so:5D695304 00 20 C3 E5 STRB R2, [R3]
220 libedog.so:5D695308 0C 30 1B E5 LDR R3, [R11,#crckeyindex]
221 libedog.so:5D69530C 03 00 53 E3 CMP R3, #3 ; 比较key是否结束
222 libedog.so:5D695310 07 00 00 1A BNE loc_5D695334
223 libedog.so:5D695314 14 30 1B E5 LDR R3, [R11,#crckey1]
224 libedog.so:5D695318 03 00 A0 E1 MOV R0, R3
225 libedog.so:5D69531C 6C FF FF EB BL _Z10PolyXorKeyj
226 libedog.so:5D695320 00 30 A0 E1 MOV R3, R0
227 libedog.so:5D695324 14 30 0B E5 STR R3, [R11,#crckey1]
228 libedog.so:5D695328 00 30 A0 E3 MOV R3, #0
229 libedog.so:5D69532C 0C 30 0B E5 STR R3, [R11,#crckeyindex]
230 libedog.so:5D695330 02 00 00 EA B loc_5D695340
231 libedog.so:5D695334 ; ---------------------------------------------------------------------------
232 libedog.so:5D695334
233 libedog.so:5D695334 loc_5D695334 ; CODE XREF: _Z8XorArrayjPhS_j+88j
234 libedog.so:5D695334 0C 30 1B E5 LDR R3, [R11,#crckeyindex]
235 libedog.so:5D695338 01 30 83 E2 ADD R3, R3, #1
236 libedog.so:5D69533C 0C 30 0B E5 STR R3, [R11,#crckeyindex]
237 libedog.so:5D695340
238 libedog.so:5D695340 loc_5D695340 ; CODE XREF: _Z8XorArrayjPhS_j+A8j
239 libedog.so:5D695340 08 30 1B E5 LDR R3, [R11,#index]
240 libedog.so:5D695344 01 30 83 E2 ADD R3, R3, #1
241 libedog.so:5D695348 08 30 0B E5 STR R3, [R11,#index]
242 libedog.so:5D69534C
243 libedog.so:5D69534C loc_5D69534C ; CODE XREF: _Z8XorArrayjPhS_j+44j
244 libedog.so:5D69534C 24 20 1B E5 LDR R2, [R11,#codeSize]
245 libedog.so:5D695350 08 30 1B E5 LDR R3, [R11,#index]
246 libedog.so:5D695354 03 00 52 E1 CMP R2, R3
247 libedog.so:5D695358 00 30 A0 D3 MOVLE R3, #0
248 libedog.so:5D69535C 01 30 A0 C3 MOVGT R3, #1
249 libedog.so:5D695360 FF 30 03 E2 AND R3, R3, #0xFF
250 libedog.so:5D695364 00 00 53 E3 CMP R3, #0
251 libedog.so:5D695368 D8 FF FF 1A BNE loc_5D6952D0
252 libedog.so:5D69536C 04 D0 4B E2 SUB SP, R11, #4
253 libedog.so:5D695370 00 88 BD E8 LDMFD SP!, {R11,PC}
254 libedog.so:5D695370 ; End of function _Z8XorArrayjPhS_j
255 libedog.so:5D695370
256 libedog.so:5D695374
257 libedog.so:5D695374 ; =============== S U B R O U T
0x04 编写修复程序
修复程序主要分为解析dex与解密两个步骤来完成，这里只贴出部分代码详细的请看工程，代码写得比较粗操，看下思路就行了，有性趣的就慢慢撸吧！
1 void fixdexClassData()
2 {
3
4 DexFile *dexFile = &gDexFile;
5
6 char * Tag = "L";
7 char * ClassTag = "Landroid/";
8
9 const DexClassDef* classdef;
10 u4 count = dexFile->pHeader->classDefsSize;
11
12 printf("该DEX共有%d 个类\n", count);
13
14 const u1* pEncodedData = NULL;
15 DexClassData* pClassData = NULL;
16 const char *descriptor = NULL;
17
18
19 int FileSize = file_size();
20
21 gCodeData = (u1*)malloc(FileSize);
22 if (NULL == gCodeData)
23 {
24 printf("分配内存失败！\n");
25 return;
26 }
27 memset(gCodeData, 0, FileSize);
28
29 //获得加密指令数据
30 GetCodeData(gCodeData, FileSize);
31
32 if (NULL == gCodeData)
33 {
34 printf("获取加密指令数据出错！\n");
35 return;
36 }
37
38 for(u4 i=0; i<count; i++){
39 classdef = dexGetClassDef(dexFile, i);
40
41 descriptor = getTpyeIdString(dexFile, classdef->classIdx);
42
43 if (strstr(descriptor,Tag) == NULL)
44 {
45 continue;
46 }
47
48 //跳过一些系统的类
49 if (strstr(descriptor, ClassTag) != NULL)
50 {
51 continue;
52 }
53
54 pEncodedData = dexFile->baseAddr + classdef->classDataOff;
55 pClassData = dexReadAndVerifyClassData(&pEncodedData, NULL);
56
57 if (pClassData == NULL) {
58 continue;
59 }
60
61 FixdexMethodInsns(dexFile, pClassData, descriptor);
62
63 }
64
65 }
66
67 void FixdexMethodInsns(DexFile *dexFile, const DexClassData*classData ,const char* className)
68 {
69 int idx = 0;
70 DexMethod *method = NULL;
71 const DexMethodId* methodId = NULL;
72 DexCode* code = NULL;
73 const char* methodName;
74 method = classData->directMethods;
75 methodId = dexFile->pMethodIds;
76 unsigned int CodeDataOffset = 0;
77 u1 * tempCode = NULL;
78 for (int i = 0; i < (int) classData->header.directMethodsSize; i++) {
79 idx = classData->directMethods[i].methodIdx;
80
81 methodId = dexGetMethodId(dexFile, idx);
82 methodName = dexStringById(dexFile, methodId->nameIdx);
83
84 DexCode* pCode = dexGetCode(dexFile, &classData->directMethods[i]);
85 if (NULL == pCode)
86 {
87 continue;
88 }
89 //判断是否为保护后的方法，如果是就修复指令
90 if ( (pCode->debugInfoOff > 0x1FFFFFFF) && (pCode->insns[0] == 0X00))
91 {
92 //求加密指令的偏移
93 CodeDataOffset = pCode->debugInfoOff << 0x8;
94 CodeDataOffset >>= 0x6;
95 //解密指令
96 tempCode = DecCode(gCodeData+CodeDataOffset, pCode->insnsSize*sizeof(u2), pCode->debugInfoOff, gCodeData);
97 //修复指令
98 memcpy(pCode->insns, tempCode, (pCode->insnsSize)*sizeof(u2));
99 pCode->debugInfoOff = 0x00;
100 printf("修复%s 类中的%s 方法成功! 大小%X\n",className, methodName,pCode->insnsSize);
101 if (NULL != tempCode)
102 {
103 free(tempCode);
104 tempCode = NULL;
105 }
106 }
107 }
108
109 for (int i = 0; i < (int) classData->header.virtualMethodsSize; i++) {
110 idx = classData->virtualMethods[i].methodIdx;
111
112 methodId = dexGetMethodId(dexFile, idx);
113 methodName = dexStringById(dexFile, methodId->nameIdx);
114
115 DexCode* pCode = dexGetCode(dexFile, &classData->virtualMethods[i]);
116 if (NULL == pCode)
117 {
118 continue;
119 }
120 //判断是否为保护后的方法，如果是就修复指令
121 if ( (pCode->debugInfoOff > 0x1FFFFFFF) && (pCode->insns[0] == 0X00))
122 {
123 //求加密指令的偏移
124 CodeDataOffset = pCode->debugInfoOff << 0x8;
125 CodeDataOffset >>= 0x6;
126 //解密指令
127 tempCode = DecCode(gCodeData+CodeDataOffset, pCode->insnsSize*sizeof(u2), pCode->debugInfoOff, gCodeData);
128 //修复指令
129 memcpy(pCode->insns, tempCode, (pCode->insnsSize)*sizeof(u2));
130 pCode->debugInfoOff = 0x00;
131 printf("修复%s 类中的%s 方法成功! 大小%X\n",className, methodName,pCode->insnsSize);
132 if (NULL != tempCode)
133 {
134 free(tempCode);
135 tempCode = NULL;
136 }
137 }
138 }
139 return;
140 }
141 unsigned int PolyXorKey(DWORD crckey)
142 {
143 unsigned int dwKey;
144 char temp;
145 unsigned __int8 temp1;
146 unsigned __int8 temp2;
147 char *pKey;
148 int temp3;
149 int j;
150 int i;
151
152 j = 0;
153 temp3 = 0;
154 pKey = (char *)&dwKey;
155 temp2 = 0;
156 temp1 = 0;
157 temp = 0;
158 dwKey = crckey ^ 0xDF138530;
159 i = 0;
160 while ( i <= 3 )
161 {
162 temp2 = *pKey;
163 j = 128;
164 temp3 = 7;
165 while ( j > 1 )
166 {
167 temp = (temp2 & j / 2) >> (temp3 - 1);
168 temp1 = ((signed int)(unsigned __int8)(temp2 & j) >> temp3) ^ temp;
169 temp1 <<= temp3;
170 temp2 |= temp1;
171 j /= 2;
172 --temp3;
173 }
174 temp = temp2 & 1;
175 temp1 = temp2 & 1 ^ temp2 & 1;
176 *pKey = temp2;
177 ++i;
178 ++pKey;
179 }
180 return dwKey;
181 }
0x05 测试与总结
将加固后的 APK中assets文件夹中的data文件与classes.dex放在修复程序同一个目录中，然后运行修复程序。
图8
去掉AndroidManifest.xml中的壳入口，将修复后的classes.dex重新打包反编译，成功运行，如图9所示能正常反编译源码，至此，分析完毕。
图9
壳流程总结:
AndroidManifest.xml中的壳入口->com.edog.AppWrapper->
so中Java_com_edog_ELibrary_d1->hook dvmResolveClass函数->在dvmResolveClass hook函数中修复指令->结束。
语言表达不行,说的很杂，自己都觉得文章没有任何逻辑可言，如果大家能从中获得一些思路那也是好的, 不过这次分析让自己学到了很多，感谢APK加固作者。
样本及pdf文档下载
http://yunpan.cn/cmApFwTesyPGk （提取码：b37f）
本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。
