Android逆向分析大全

aapt d xmltree 1.apk AndroidManifest.xml
N: android=http://schemas.android.com/apk/res/android
  E: manifest (line=2)
    A: android:versionCode(0x0101021b)=(type 0x10)0x1
    A: android:versionName(0x0101021c)="1.0" (Raw: "1.0")
    A: package="com.ibotpeaches.issue767" (Raw: "com.ibotpeaches.issue767")
    A: platformBuildVersionCode=(type 0x10)0x17 (Raw: "23")
    A: platformBuildVersionName="6.0-2438415" (Raw: "6.0-2438415")
    E: uses-sdk (line=0)
      A: android:minSdkVersion(0x0101020c)=(type 0x10)0x16
      A: android:targetSdkVersion(0x01010270)=(type 0x10)0x17
    E: application (line=3)
      A: android:theme(0x01010000)=@0x7f090083
      A: android:label(0x01010001)=@0x7f060015
      A: android:icon(0x01010002)=@0x7f030000
      A: android:debuggable(0x0101000f)=(type 0x12)0xffffffff
      A: android:allowBackup(0x01010280)=(type 0x12)0xffffffff
      A: android:supportsRtl(0x010103af)=(type 0x12)0xffffffff
      E: activity (line=4)
        A: android:theme(0x01010000)=@0x7f090030
        A: android:label(0x01010001)=@0x7f060015
        A: android:name(0x01010003)="com.ibotpeaches.issue767.MainActivity" (Raw
: "com.ibotpeaches.issue767.MainActivity")
        E: intent-filter (line=5)
          E: action (line=6)
            A: android:name(0x01010003)="android.intent.action.MAIN" (Raw: "andr
oid.intent.action.MAIN")
          E: category (line=7)
            A: android:name(0x01010003)="android.intent.category.LAUNCHER" (Raw:
 "android.intent.category.LAUNCHER")
      E: meta-data (line=10)
        A: android:name(0x01010003)="large.int.value" (Raw: "large.int.value")
        A: android:value(0x01010024)="9999999999999999999999" (Raw: "99999999999
99999999999")

adb devices 列出当前设备
adb –s d24eb3ab [命令]      指定设备执行命令
adb push 源 目标            非root机器可以设置路径为/data/local/tmp
adb pull 源 目标
adb shell                   执行终端
adb logcat                  查看日志(/system/logcat为服务器)
adb jdwp                    查看远程jdwp进程
adb forward tcp:主机端口     tcp:远程端口       把主机端口消息转发手机端口(端口对应进程)   用于ida调试
adb forward tcp:主机端口     jdwp:远程进程ID    把主机端口消息转发手机jdwp进程   用于jdb调试 
adb install [apkpath]       安装apk
adb uninstall [packagename] 卸载apk 注意会彻底清理，删除/data/app下的备份apk
adb remount                 将/system重新映射为读写，以便进行系统区文件操作
adb root                    使adb以root方式启动，便于push/pull/remount

打印xml树 aapt d xmltree 1.apk AndroidManifest.xml
打印资源    aapt d resources 1.apk
添加文件    aapt a 1.apk AndroidManifest.xml
删除文件    aapt r 1.apk AndroidManifest.xml

C:\Users\Administrator>adb connect 192.168.0.103:5555
connected to 192.168.0.103:5555
此时可以用adt调试

反编译apk：apktool d file.apk –o path  
回编译apk：apktool b path –o file.apk

<1> main[1] print intent
 intent = "Intent { act=android.intent.action.VIEW dat=http://www.b.com cmp=
com.android.browser/.BrowserActivity }"

<1> main[1] use D:\Android\sdk\sources\android-18       //参考设备android版本
<1> main[1] use D:\test\MyApplication\app\src\main\java
<1> main[1] list
3,421         * @hide Implement to provide correct calling token.
3,422         */
3,423        public void startActivityAsUser(Intent intent, UserHandle user) {
3,424            startActivityAsUser(intent, null, user);
3,425 =>     }
3,426
3,427        /**
3,428         * @hide Implement to provide correct calling token.
3,429         */
3,430        public void startActivityAsUser(Intent intent, Bundle options, User
Handle user) {

> use D:\test\MyApplication\app\src\main\java
stop at b.myapp.MainActivity:18
正在延迟断点b.myapp.MainActivity:18。
将在加载类后设置。
> resume
已恢复所有线程。
> 设置延迟的断点b.myapp.MainActivity:18
断点命中: "线程=<1> main", b.myapp.MainActivity.onCreate(), 行=18 bci=12
18            int j = 0;

> > stop in b.myapp.MainActivity.onCreate(android.os.Bundle)
正在延迟断点b.myapp.MainActivity.onCreate(android.os.Bundle)。
将在加载类后设置。
>resume
已恢复所有线程。
断点命中: "线程=<1> main", b.myapp.MainActivity.onCreate(), 行=13 bci=0

<1> main[1] where
  [1] b.myapp.MainActivity.onCreate (MainActivity.java:13)
  [2] android.app.Activity.performCreate (Activity.java:5,372)
  [3] android.app.Instrumentation.callActivityOnCreate (Instrumentation.java:1,1
04)
  [4] android.app.ActivityThread.performLaunchActivity (ActivityThread.java:2,25
8)
  [5] android.app.ActivityThread.handleLaunchActivity (ActivityThread.java:2,350
)
  [6] android.app.ActivityThread.access$700 (ActivityThread.java:160)
  [7] android.app.ActivityThread$H.handleMessage (ActivityThread.java:1,317)
  [8] android.os.Handler.dispatchMessage (Handler.java:99)
  [9] android.os.Looper.loop (Looper.java:137)
  [10] android.app.ActivityThread.main (ActivityThread.java:5,454)

stop in:断点
    step:步入(源码行)
    stepi:单入(指令)
    step up:执行到返回
    cont:恢复运行
    next:步过
    输出表达式:print/eval

Usage:  gdbserver [OPTIONS] COMM PROG [ARGS ...]
        gdbserver [OPTIONS] --attach COMM PID
        gdbserver [OPTIONS] --multi COMM
        隐藏用法：gdbserver [OPTIONS] +SOCKETFILE --attach PID           会在本地建立socket文件通信
Options:
  --debug               Enable general debugging output.
  --remote-debug        Enable remote protocol debugging output.
  --version             Display version information and exit.
  --wrapper WRAPPER --  Run WRAPPER to start new programs.
  --once                Exit after the first connection has closed.
使用方式：
启动模式远程调试：gdbserver --debug --remote-debug  :23946 /system/test.out [参数]     
附加模式远程：gdbserver –debug –remote-debug –attach  :23946 1234
    Adb forward tcp:23946 tcp:23946 转发端口
IDA中选择Remote GDB Debugger附加即可

usage: strace [-CdDffhiqrtttTvVxx] [-a column] [-e expr] ... [-o file]
              [-p pid] ... [-s strsize] [-u username] [-E var=val] ...
              [command [arg ...]]
or: strace -c [-D] [-e expr] ... [-O overhead] [-S sortby] [-E var=val] ...
              [command [arg ...]]
-c --统计每一系统调用的所执行的时间,次数和出错的次数等.
-C -- like -c but also print regular output while processes are running
-f --跟踪由fork调用所产生的子进程.
-F --尝试跟踪vfork调用.在-f时,vfork不被跟踪.
-i --输出系统调用的入口指针
-q --禁止输出关于脱离的消息
-r --打印出相对时间关于,,每一个系统调用
-T --显示每一调用所耗的时间
-v --输出所有的系统调用.一些调用关于环境变量,状态,输入输出等调用由于使用频繁,默认不输出
-x --以十六进制形式输出非标准字符串
-a设置返回值的输出位置.默认 为40.
-e expr -指定一个表达式,用来控制如何跟踪.: option=[!]all or option=[!]val1[,val2]...
   options: trace, abbrev, verbose, raw, signal, read, or write
-o file --将strace的输出写入文件filename
-O overhead -- set overhead for tracing syscalls to OVERHEAD usecs
-p pid --跟踪指定的进程pid.
-D -- run tracer process as a detached grandchild, not as parent
-s strsize --指定输出的字符串的最大长度.默认为32.文件名一直全部输出
-S sortby -- sort syscall counts by: time, calls, name, nothing (default time)
-u username --以username 的UID和GID执行被跟踪的命令
-E var=val -- put var=val in the environment for command
-E var -- remove var from the environment for command

使用方式：
Strace –f ProcessA      启动跟踪
Strace –f –p 234        附加跟踪
    -e trace=file       -e trace=process    -e trace=network

adb shell am start -D -n com.example.hellojni/.HelloJni     启动app并等待调试器
    ps | grep hellojni                                  得到PID 3569
adb shell run-as com.example.hellojni /data/data/com.example.hellojni/lib/gdbserver +debug-socket --attach (3569)PID
    将PID与文件映射建立调试链接(c层)
adb forward tcp:5039 localfilesystem:/data/data/com.example.hellojni/debug-socket将调试链接和本地端口建立链接(c层)
adb forward tcp:65534 jdwp:(3569)PID                                         将本地端口和进程建立连接(java层)
jdb -connect com.sun.jdi.SocketAttach:hostname=localhost,port=65534          使用jdb调试java层
arm-linux-androideabi-gdb.exe                                           
    target remote :5039                                              使用gdb调试c层
    set breakpoint pending on

Android NDK installation path: D:/Android/AndroidNDK/android-ndk-r10e
ADB version found: Android Debug Bridge version 1.0.32
Using ADB flags:
Using auto-detected project path: .
Found package name: com.example.hellojni
ABIs targetted by application: arm64-v8a armeabi armeabi-v7a armeabi-v7a-hard mips mips64 x86 x86_64
Device API Level: 19
Device CPU ABIs: armeabi-v7a armeabi
Compatible device ABI: armeabi-v7a
Using gdb setup init: ./libs/armeabi-v7a/gdb.setup
Using toolchain prefix: D:/Android/AndroidNDK/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/windows/bin/arm-linux-androideabi
Using app out directory: ./obj/local/armeabi-v7a
Found debuggable flag: true
Found device gdbserver: /data/data/com.example.hellojni/lib/gdbserver
Found data directory: '/data/data/com.example.hellojni'
Found first launchable activity: .HelloJni
Launching activity: com.example.hellojni/.HelloJni
## COMMAND: adb_cmd shell am start -D -n com.example.hellojni/.HelloJni
## COMMAND: adb_cmd shell sleep 2.000000
Found running PID: 9139
## COMMAND: adb_cmd shell run-as com.example.hellojni /data/data/com.example.hellojni/lib/gdbserver --attach +debug-socket 9139 [BACKGROUND]
Launched gdbserver succesfully.
Setup network redirection
## COMMAND: adb_cmd forward tcp:5039 localfilesystem:/data/data/com.example.hellojni/debug-socket
Attached; pid = 9139
Listening on Unix socket debug-socket
## COMMAND: adb_cmd pull /system/bin/app_process ./obj/local/armeabi-v7a/app_process
79 KB/s (9488 bytes in 0.117s)
Pulled app_process from device/emulator.
## COMMAND: adb_cmd pull /system/bin/linker ./obj/local/armeabi-v7a/linker
585 KB/s (63596 bytes in 0.106s)
Pulled linker from device/emulator.
## COMMAND: adb_cmd pull /system/lib/libc.so ./obj/local/armeabi-v7a/libc.so
1184 KB/s (310584 bytes in 0.256s)
Pulled /system/lib/libc.so from device/emulator.
Set up JDB connection, using jdb command: C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe
## COMMAND: adb_cmd forward tcp:65534 jdwp:9139
--------------------./obj/local/armeabi-v7a/gdb.setup---------------
GNU gdb (GDB) 7.7
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i586-pc-mingw32msvc --target=arm-linux-android".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://source.android.com/source/report-bugs.html>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
Remote debugging from host 9.11.5.0
warning: Could not load shared library symbols for 112 libraries, e.g. libstdc++.so.
Use the "info sharedlibrary" command to see the complete listing.
Do you need "set solib-search-path" or "set sysroot"?
0x400daa80 in __futex_syscall3 () from D:\Android\AndroidNDK\android-ndk-r10e\samples\hello-jni\obj\local\armeabi-v7a\libc.so
(gdb)

(gdb) set solib-search-path C:/Users/lichao/2/
Reading symbols from C:\Users\lichao\2\linker...(no debugging symbols found)...done.
Loaded symbols for C:\Users\lichao\2\linker
Reading symbols from C:\Users\lichao\2\libc.so...(no debugging symbols found)...done.
Loaded symbols for C:\Users\lichao\2\libc.so
Reading symbols from C:\Users\lichao\2\libstdc++.so...(no debugging symbols found)...done.
Loaded symbols for C:\Users\lichao\2\libstdc++.so
Reading symbols from C:\Users\lichao\2\libm.so...(no debugging symbols found)...done.
Loaded symbols for C:\Users\lichao\2\libm.so
Reading symbols from C:\Users\lichao\2\liblog.so...(no debugging symbols found)...done.
Loaded symbols for C:\Users\lichao\2\liblog.so
Reading symbols from C:\Users\lichao\2\libcutils.so...(no debugging symbols found)...done.
Loaded symbols for C:\Users\lichao\2\libcutils.so
Reading symbols from C:\Users\lichao\2\libgccdemangle.so...(no debugging symbols found)...done.
Loaded symbols for C:\Users\lichao\2\libgccdemangle.so
Reading symbols from C:\Users\lichao\2\libcorkscrew.so...(no debugging symbols found)...done.

(gdb) bt
#0  0x400e50e0 in fork () from C:\Users\lichao\2\libc.so
#1  0x76886ca0 in Java_com_example_hellojni_HelloJni_stringFromJNI () from C:\Users\lichao\2\libhello-jni.so
#2  0x416b8350 in dvmPlatformInvoke () from C:\Users\lichao\2\libdvm.so
#3  0x416e8fd2 in dvmCallJNIMethod(unsigned int const*, JValue*, Method const*, Thread*) () from C:\Users\lichao\2\libdvm.so
#4  0x416ea9ba in dvmResolveNativeMethod(unsigned int const*, JValue*, Method const*, Thread*) () from C:\Users\lichao\2\libdvm.so
#5  0x416c1828 in dvmJitToInterpNoChain () from C:\Users\lichao\2\libdvm.so
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) list

GNU gdb 6.7
Copyright (C) 2007 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=arm-none-linux-gnueabi --target=".
(gdb)

0xb6cdf480 in __epoll_pwait () from E:\aaa\libc.so
=> 0xb6cdf480 <__epoll_pwait+28>:       1e ff 2f 91     bxls    lr
(gdb) bt
#0  0xb6cdf480 in __epoll_pwait () from E:\aaa\libc.so
#1  0xb6cb70ca in epoll_pwait () from E:\aaa\libc.so
#2  0xb6cb70d8 in epoll_wait () from E:\aaa\libc.so
#3  0xb6f06bd6 in android::Looper::pollInner(int) () from E:\aaa\libutils.so
#4  0xb6f06e52 in android::Looper::pollOnce(int, int*, int*, void**) () from E:\aaa\libutils.so
#5  0xb6e4d41c in android::NativeMessageQueue::pollOnce(_JNIEnv*, _jobject*, int) () from E:\aaa\libandroid_runtime.so
#6  0x732e056e in ?? ()

Step 0.前置说明
手机端：Android模拟器，Android 4.4.2 ART 运行时；（真机与DVM运行时是一样的）
PC端：ParallelDesktop虚拟机，Windows 8.0，gikdbg.art v1.0.build140601.3；
PS:非root环境的设备由于权限的原因会有很多问题，不推荐使用！

Step 1.连接设备
运行模拟器，打开gikdbg.art.exe，执行/ART Debug/Device菜单，我们就可以来到如下界面：

如果模拟器已经运行了，但是设备列表中没有，则等待一段时间后执行右键的Refresh菜单。然后双击或者右键Login就可以登陆选中的设备了。对于第一次Login该设备，会询问你是否上传依赖的文件到/data/local,这一步如果否定了的话将不能使用调试功能。上传文件这个步骤目前已知的问题是对于非root的设备，往往因为权限的原因上传不成功，一般情况下/data/local/tmp目录没有问题，但是有些设备又没有/data/local/tmp目录，因此我们只有设置/data/local为目标路径，这个问题目前还不知道好的解决办法。归纳一下就是：非root的机器无法在其/data/local下创建我们依赖的文件夹以及上传文件，如果我们将其迁移至/data/local/tmp这个目录下，又有部分设备没有这个文件夹，就更没有办法上传了。
对于这类上传失败的同学，可以想办法手工将$(GIKDBG.ART)/adb/android/gdb传至/data/local/gikir_android-xxxx/gdb这个位置，其中xxxx是GUID。
如果还没有安装该apk文件的，则可以在ADB Shell中执行$install –r命令选择gikdebugee.apk进行安装.
Step 2.选择进程
登陆成功后执行，确保模拟器的gikdebugee.apk运行正常，然后执行/ART Debug/File/Attach就可以得到如下进程列表，选中我们的gikdebugee进程，双击或者执行Attach按钮

之后我们就会看到如下加载输出：

等gdb加载完毕之后我们就可以进入熟悉的CPU主窗口了：

Step 3.选择模块
我们的目的是调试apk里面的so动态库，因此执行/ART Debug/View/Module切换到模块列表，选中我们要调试的模块，双击它

Step 4.击中断点
 本例中找到要调试的函数getNativeString，我们可以用CTRL+F查找到它，找到之后F2下断点，F9运行它，然后在设备中操作按钮则该方法将被断点击中，F8运行3步

adb push %NDK%\prebuilt\android-arm\gdbserver\gdbserver /system/bin
chmod 777 /system/bin/gdbserver
adb push test.out /system/bin
chmod 777 /system/bin/test.out
gdbserver :2345 /system/bin/test.out(若附加调试则提供进程号)
adb forward tcp:2345 tcp:2345
gdb >
gdb > target remote :2345

adb shell am start -D -n com.example.hellojni/.HelloJni     启动app并等待调试器
    ps | grep hellojni                                  得到PID 3569
adb shell run-as com.example.hellojni /data/data/com.example.hellojni/lib/gdbserver +debug-socket --attach (3569)PID
    将PID与文件映射建立调试链接(c层)
adb forward tcp:5039 localfilesystem:/data/data/com.example.hellojni/debug-socket将调试链接和本地端口建立链接(c层)
adb forward tcp:65534 jdwp:(3569)PID                                         将本地端口和进程建立连接(java层)
jdb -connect com.sun.jdi.SocketAttach:hostname=localhost,port=65534          使用jdb调试java层
arm-linux-androideabi-gdb.exe                                           
    target remote :5039                                              使用gdb调试c层
    set breakpoint pending on

public static void main(String[] args) {
        String v0 = "";
        int v3 = args.length;
        int v2;
        for(v2 = 0; v2 < v3; ++v2) {
            v0 = String.valueOf(v0) + " " + args[v2];
        }
        Log.d("my god", v0);
        Log.d("my god", Log.getStackTraceString(new Throwable()));
    }

start -n com.android.browser/.BrowserActivity -a android.intent.action.VIEW -d http://shouji.360.cn/web/uninstall/uninstall.html?u=100&id=76bb84de8f53b53f57dd3cedfe966091&v=6.3.1.1048&s=1&model=SE0gTk9URSAxTFRF&sdk=19&ch=200222&wid=9fa298f35aec4232c26048442f36dc59 --user 0
java.lang.Throwable 
    at com.android.commands.am.Am.main(Am.java:30)
    at com.android.internal.os.RuntimeInit.nativeFinishInit(Native Method)
    at com.android.internal.os.RuntimeInit.main(RuntimeInit.java:245)
    at dalvik.system.NativeStart.main(Native Method)

content:/data/user/0/com.qihoo360.mobilesafe/files/so_libs/um.0.2 com.qihoo360.mobilesafe --execute am start -n com.android.browser/.BrowserActivity -a android.intent.action.VIEW -d http://shouji.360.cn/web/uninstall/uninstall.html?u=100\&id=7b55c26b779bd111dfed8b02bb00131c\&v=5.5.0.1041\&s=1\&model=TmV4dXMgUw\&sdk=19\&at=KTvooEkhHMzgJ13AXfMkJINnhrmyyNdu\&ch=200222 --user 0
java.lang.Throwable 
    at com.example.emptytest.Main$1$1.invoked(Main.java:68)
    at com.saurik.substrate.MS$2.invoked(MS.java:68)
    at java.lang.Runtime.exec(Native Method)
    at egv.a(360MobileSafe:257)
    at egv.a(360MobileSafe:66)
    at com.qihoo360.mobilesafe.ui.index.MobileSafeApplication.p(360MobileSafe:1223)
    at com.qihoo360.mobilesafe.ui.index.MobileSafeApplication.onCreate(360MobileSafe:799)

(gdb) disass /r 0x401148b8,0x40114900
Dump of assembler code from 0x401148b8 to 0x401148c8:
=> 0x401148b8:  0c 70 a0 e1     mov     r7, r12
   0x401148bc:  01 0a 70 e3     cmn     r0, #4096       ; 0x1000
   0x401148c0:  1e ff 2f 91     bxls    lr
   0x401148c4:  00 00 60 e2     rsb     r0, r0, #0
   0x401148c8:  0e 70 00 ea     b       0x40130908
End of assembler dump.

print expr
    print ”%d” a

dprintf 动态插入printf函数
    dprintf location,format string,arg1,arg2,...

set *(unsigned int*)0x800000000=0x00000000

break *0x4000000  绝对地址
break 12          行号
break func1       函数
clear *0x40000000
clear 12
clear func1

watch/awatch/ rwatch [-l|-location] EXPRESSION      变化/读写/读断点
（如果EXPRESSION不是绝对地址，则需要用-l计算表达式）
watch *0x40000000==0x90909090
watch –l *$pc
watch i   (有源码，变量i的值有变化时停止)

break-range START-LOCATION, END-LOCATION
break-range 1.c:5, 1.c:10  在1.c的第5行和第10行之间下断
break-range +5, +10 在当前行+5和当前行+10之间下断

如何使程序在so加载时刻断下??（网上不少人用奇葩方式，还是对gdb不了解）
catch load 1.so

(gdb) load C:/Users/lichao/2/libadnative.so 0x50000000
Loading section .interp, size 0x13 lma 0x50000134
Loading section .dynsym, size 0x1210 lma 0x50000148
Loading section .dynstr, size 0x2061 lma 0x50001358
Loading section .hash, size 0x8a8 lma 0x500033bc
Loading section .rel.dyn, size 0x10a0 lma 0x50003c64
Loading section .rel.plt, size 0x1b0 lma 0x50004d04
Loading section .plt, size 0x29c lma 0x50004eb4
Loading section .text, size 0xe7a0 lma 0x50005150
Loading section .ARM.extab, size 0x8e8 lma 0x500138f0
Loading section .ARM.exidx, size 0xd80 lma 0x500141d8
Loading section .rodata, size 0x11bc lma 0x50014f58
Loading section .data.rel.ro.local, size 0x738 lma 0x50018098
Loading section .fini_array, size 0x8 lma 0x500187d0
Loading section .init_array, size 0x14 lma 0x500187d8
Loading section .data.rel.ro, size 0x508 lma 0x500187f0
Loading section .dynamic, size 0xf8 lma 0x50018cf8
Loading section .got, size 0x210 lma 0x50018df0
Loading section .data, size 0x1c lma 0x50019000
Start address 0x0, load size 94044
Transfer rate: 188 KB/sec, 2541 bytes/write.

file c:/1.so

info functions [regex]   定位地址
info symbol address      定位文件
info variables [regex]   全局静态符号