强大的dex反编译器
APK反编译、重打包。这都是老话题了，现在也有不少工具来实现apk反编译，比如apktool-gui。Virtuous Ten Studio等。尤其后者还是很强大的。
大家可以自己去体验。今天给大家介绍的这是一个商业产品，也即不是免费的，不过自然有其特点。
那就是来自于http://www.android-decompiler.com/的JEB
JEB是一个功能强大的为安全专业人士设计的Android应用程序的反编译。反向工程或审计APK文件，并减少许多工程师的分析时间。
1、dextojar
目前的工具在转化到jar都存在不少问题。
EB的独特功能是，其Dalvik字节码反编译为Java源代码的能力
比如这是常规工具的结果：
下图是JEB的结果：
如果说转化jar效果有明显提升的话，对于工程师读懂代码的效率还是有很大提升的。
2、可编辑性：
特别是当他们处理混淆的或受保护的代码块。 JEB的强大的用户界面，可以检查交叉引用，重命名的方法，字段，类，代码和数据之间导航，做笔记，添加注释，以及更多。
3、APK全浏览
Full APK view. Take advantage of the full APK view, including decompressed manifest, resources, certificates, strings, constants, etc. Again, flexibility is key.
也可以直接看到证书内容：
各类资源信息：
4、API for Automation. Use JEB's Application Programming Interface (API) to write Python scripts and plugins, and automate your analysis needs.
可以根据需要程序猿自己定制。比如下面的示例：
JEBReplaceStrings.py
# Sample JEB script (UI:yes, Automation:yes)
# Replace code strings by the string 'foobar'
# This script shows how to navigate the DEX file
# and how to modify strings in the string pool
import os
from jeb.api import IScript
from jeb.api import EngineOption
class JEBReplaceStrings(IScript):
def run(self, jeb):
self.jeb = jeb
self.dex = jeb.getDex()
if not self.dex:
print 'Error! Please provide an input file.'
sef.jeb.exit()
for msig in self.dex.getMethodSignatures(True):
#print msig
md = self.dex.getMethodData(msig)
if not md:
continue
code = md.getCodeItem()
if not code:
continue
for insn in code.getInstructions():
if not insn.getMnemonic() in ('const-string', 'const-string/jumbo'):
continue
stringindex = insn.getParameters()[1].getValue()
s = self.dex.getString(stringindex)
if s:
s2 = self.modifyString(s)
if s2 and s2 != s:
self.dex.setString(stringindex, s2)
def modifyString(self, s):
# totally useless: alphanumeric string are replaced by 'foobar'
# could be the base script for something more useful, like
# string language identification and translation into English
if not s.isalnum():
return None
return 'foobar'
5、火拼：
JEB和dex2jar+JD-GUI and dex2jar+JAD.开始PK
这是一个标准的RC4加密算法代码。RC4不懂的请百度。
/** * RC4 encryption/decryption routine. * @param key * @param data input/output buffer */ public static void rc4_crypt(byte[] key, byte[] data) { int keylen = key.length; int datalen = data.length; int i; int j; // key scheduling byte[] sbox = new byte[256]; for(i = 0; i < 256; i++) { sbox[i] = (byte)i; } j = 0; for(i = 0; i < 256; i++) { j = ((j + sbox[i] + key[i % keylen]) % 256) & 0xFF; byte tmp = sbox[i]; sbox[i] = sbox[j]; sbox[j] = tmp; } // generate output i = 0; j = 0; int index = 0; while(index < datalen) { i = ((i + 1) % 256) & 0xFF; j = ((j + sbox[i]) % 256) & 0xFF; byte tmp = sbox[i]; sbox[i] = sbox[j]; sbox[j] = tmp; byte k = (byte)(sbox[((sbox[i] + sbox[j]) % 256) & 0xFF]); data[index] ^= k; index++; } }
这是JEB的输出：
// Decompiled by JEB v0.9.0 alpha public static void rc4_crypt(byte[] arg11, byte[] arg12) { int v10 = 0x100; int v5 = arg11.length; int v0 = arg12.length; byte[] v6 = new byte[v10]; int v1 = 0; while(v1 < v10) { v6[v1] = ((byte)v1); ++v1; } int v3 = 0; v1 = 0; while(v1 < v10) { v3 = (v6[v1] + v3 + arg11[v1 % v5]) % 0x100 & 0xFF; byte v7 = v6[v1]; v6[v1] = v6[v3]; v6[v3] = v7; ++v1; } v1 = 0; v3 = 0; int v2 = 0; while(v2 < v0) { v1 = (v1 + 1) % 0x100 & 0xFF; v3 = (v6[v1] + v3) % 0x100 & 0xFF; v7 = v6[v1]; v6[v1] = v6[v3]; v6[v3] = v7; arg12[v2] = ((byte)(arg12[v2] ^ v6[(v6[v1] + v6[v3]) % 0x100 & 0xFF])); ++v2; } }
这是的JD-GUI输出：
// Decompiled by JD-GUI v0.3.5 public static void rc4_crypt(byte[] paramArrayOfByte1, byte[] paramArrayOfByte2) { int i = paramArrayOfByte1.length; int j = paramArrayOfByte2.length; byte[] arrayOfByte = new byte[256]; int k = 0; int m; int n; label30: int i2; int i3; if (k >= 256) { m = 0; n = 0; if (n < 256) break label68; i2 = 0; i3 = 0; } for (int i4 = 0; ; i4++) { if (i4 >= j) { return; arrayOfByte[k] = ((byte)k); k++; break; label68: m = 0xFF & (m + arrayOfByte[n] + paramArrayOfByte1[(n % i)]) % 256; int i1 = arrayOfByte[n]; arrayOfByte[n] = arrayOfByte[m]; arrayOfByte[m] = i1; n++; break label30; } i2 = 0xFF & (i2 + 1) % 256; i3 = 0xFF & (i3 + arrayOfByte[i2]) % 256; int i5 = arrayOfByte[i2]; arrayOfByte[i2] = arrayOfByte[i3]; arrayOfByte[i3] = i5; paramArrayOfByte2[i4] = ((byte)(arrayOfByte[(0xFF & (arrayOfByte[i2] + arrayOfByte[i3]) % 256)] ^ paramArrayOfByte2[i4])); } }
http://www.android-decompiler.com/comp.php
另外现在很多给dex加点料，让工具崩了的手法。
$ dex2jar obfuscated.dex dex2jar obfuscated.dex -> obfuscated-dex2jar.jar com.googlecode.dex2jar.DexException: while accept method:[LA;.f(I)I] at com.googlecode.dex2jar.reader.DexFileReader.acceptMethod(DexFileReader.java:699) at com.googlecode.dex2jar.reader.DexFileReader.acceptClass(DexFileReader.java:446) at com.googlecode.dex2jar.reader.DexFileReader.accept(DexFileReader.java:328) at com.googlecode.dex2jar.v3.Dex2jar.doTranslate(Dex2jar.java:84) at com.googlecode.dex2jar.v3.Dex2jar.to(Dex2jar.java:239) at com.googlecode.dex2jar.v3.Dex2jar.to(Dex2jar.java:230) at com.googlecode.dex2jar.tools.Dex2jarCmd.doCommandLine(Dex2jarCmd.java:107) at com.googlecode.dex2jar.tools.BaseCmd.doMain(BaseCmd.java:168) at com.googlecode.dex2jar.tools.Dex2jarCmd.main(Dex2jarCmd.java:34) Caused by: com.googlecode.dex2jar.DexException: while accept code in method:[LA;.f(I)I] at com.googlecode.dex2jar.reader.DexFileReader.acceptMethod(DexFileReader.java:689) ... 8 more Caused by: java.lang.ArrayIndexOutOfBoundsException: 15 at com.googlecode.dex2jar.v3.V3CodeAdapter.visitConstStmt(V3CodeAdapter.java:326) at com.googlecode.dex2jar.reader.DexOpcodeAdapter.x1n(DexOpcodeAdapter.java:262) at com.googlecode.dex2jar.reader.DexCodeReader.acceptInsn(DexCodeReader.java:411) at com.googlecode.dex2jar.reader.DexCodeReader.accept(DexCodeReader.java:330) at com.googlecode.dex2jar.reader.DexFileReader.acceptMethod(DexFileReader.java:686) ... 8 more
一个简单的例子混淆一下，里面再加点料。 如何加料从而和各类工具作斗争也是个大学问！！
This example is a very simple piece of code that was run through a flow obfuscator and junk insertion program.
.method public f(I)I const/4 v15, 0x7 move/from16 v6, v15 move v7, v15 and-int/lit8 v6, v15, 0x4 move/from16 v9, v7 const v14, 0x5 add-int v9, v9, v15 mul-int/2addr v7, v9 const v7, 0x5 sub-int/2addr v9, v6 move v11, v7 move/16 v13, v6 goto/16 :180 :30 return v0 :36 goto :38 :38 const v7, 0x6 move v15, v7 const/4 v8, 0x3 move v0, v2 const v15, 0x2 const v3, 0x1 div-int/lit8 v3, v8, 0x3 mul-int/lit8 v8, v3, 0x2 div-int/lit8 v8, v3, 0x2 div-int/2addr v7, v8 const/4 v5, 0x2 and-int v8, v8, v5 const v5, 0x6 goto :6C :6C const v9, 0x1 const/16 v6, 0x2 add-int/lit8 v9, v6, 0x2 move/from16 v10, v9 move/from16 v14, v10 move/16 v5, v6 const/16 v3, 0x0 move/from16 v6, v9 add-int v6, v6, v14 add-int/lit8 v0, v0, 0x1 const v14, 0x6 rem-int v5, v5, v6 const/4 v10, 0x6 shr-int/lit8 v10, v14, 0x5 goto/16 :1EC :AC const v13, 0x2 const/4 v9, 0x7 const/4 v15, 0x1 const/4 v10, 0x2 rem-int/lit16 v9, v13, 0x7 move/from16 v4, v15 ushr-int/2addr v15, v10 const v5, 0x6 shl-int v5, v5, v13 div-int/lit8 v4, v5, 0x1 const v14, 0x6 xor-int v15, v15, v14 const v7, 0x6 move v15, v5 if-ltz v15, :12E :E6 const/16 v7, 0x4 const/16 v4, 0x7 move/16 v14, v5 xor-int/lit16 v7, v14, 0x2 move/from16 v9, v15 div-int v4, v4, v10 move v8, v15 and-int v9, v9, v4 const/16 v4, 0x0 move/from16 v14, v9 const v12, 0x1 move/16 v4, v12 mul-int/lit16 v14, v10, 0x0 move v7, v10 div-int v10, v10, v7 or-int/lit16 v4, v8, 0x6 mul-int v5, v5, v15 goto :12E :12E const v3, 0x7 move/16 v10, v3 ushr-int/lit8 v10, v3, 0x0 and-int/lit8 v10, v3, 0x0 const/4 v4, 0x4 xor-int/lit16 v3, v4, 0x3 move/from16 v6, v4 xor-int/lit8 v3, v6, 0x3 sub-int v10, v10, v4 goto :156 :156 const v4, 0x2 const v6, 0x4 add-int/lit16 v6, v4, 0x6 move v11, v4 const v6, 0x5 move/from16 v10, v11 move/from16 v3, v4 and-int v10, v10, v4 shr-int v4, v4, v6 goto :1E2 :180 const v13, 0x0 move/from16 v7, v13 add-int/lit8 v13, v7, 0x1 const/16 v11, 0x3 div-int v7, v7, v11 xor-int v13, v13, v11 if-ge v7, v13, :36 :19E xor-int/2addr v7, v13 move v10, v13 and-int/lit16 v11, v13, 0x6 const v7, 0x5 const/16 v8, 0x6 rsub-int v10, v11, 0x6 const v13, 0x5 const v5, 0x0 const v5, 0x1 and-int v10, v10, v5 rem-int/lit16 v11, v8, 0x7 move/16 v4, v10 move v10, v13 or-int/2addr v7, v13 rem-int/lit16 v5, v13, 0x0 div-int/2addr v10, v11 goto/16 :36 :1E2 const v11, 0x1 goto/16 :30 :1EC const v8, 0x0 move v9, v8 move/from16 v8, v9 goto/16 :AC .end method
上面的程序看起来好好负责吆！JEB's deobfuscator chimes in and decompiles it to a simple:
你妹，原来就是这么简单的程序呀：
// Decompiled by JEB v0.9.0 alpha public int f(int arg2) { int v0 = arg2 + 1; return v0; }