NativeCode中通过JNI反射调用Java层的代码，以获取IMEI为例

简单说，就是在NativeCode中做一些正常情况下可以在Java code中做的事儿，比如获取IMEI。

这种做法会使得静态分析Java层代码的方法失效。

 

JNIEXPORT jstring JNICALL Java_com_xxx_yyy_MainActivity_GetIMEI
  (JNIEnv* env, jobject mContext){

    if(mContext == 0){
        return env->NewStringUTF("[+] Error: Context is 0");
    }
    jclass cls_context = env->FindClass("android/content/Context");
    if(cls_context == 0){
        return env->NewStringUTF("[+] Error: FindClass <android/content/Context> Error");
    }

    jmethodID getSystemService = (env)->GetMethodID(cls_context, "getSystemService", "(Ljava/lang/String;)Ljava/lang/Object;");
    if(getSystemService == 0){
        return env->NewStringUTF("[+] Error: GetMethodID failed");
    }

    jfieldID TELEPHONY_SERVICE = (env)->GetStaticFieldID(cls_context, "TELEPHONY_SERVICE", "Ljava/lang/String;");
    if(TELEPHONY_SERVICE == 0){
        return env->NewStringUTF("[+] Error: GetStaticFieldID Failed");
    }

    jstring str = (jstring)(env)->GetStaticObjectField(cls_context, TELEPHONY_SERVICE);
    jobject telephonymanager = ((env)->CallObjectMethod(mContext, getSystemService, str));
    if(telephonymanager == 0){
        return env->NewStringUTF("[+] Error: CallObjectMethod failed");
    }

    jclass cls_TelephoneManager = (env)->FindClass( "android/telephony/TelephonyManager");
    if(cls_TelephoneManager == 0){
        return env->NewStringUTF("[+] Error: FindClass TelephoneManager failed");
    }

    jmethodID getDeviceId = ((env)->GetMethodID(cls_TelephoneManager, "getDeviceId", "()Ljava/lang/String;"));
    if(getDeviceId == 0){
        return env->NewStringUTF("[+] Error: GetMethodID getDeviceID failed");
    }

    jobject DeviceID = (env)->CallObjectMethod(telephonymanager,
            getDeviceId);

    //char DP_IMIE[128]={0};

    //DP_IMIE = (env)->GetStringUTFChars( DeviceID, 0);
    return (jstring)DeviceID;

 

参考：

http://www.cnblogs.com/luxiaofeng54/archive/2011/03/01/1968063.html

http://www.cnblogs.com/273809717/archive/2013/02/21/2921058.html