【Android安全】Android静态分析调试定位关键代码

Android调试方法：

1、logcat输出

2、调用栈打印

3、ddms method profiling

4、andbug只能设置一个断点不支持单步调试

5、ida动态调试原生程序

1、反编译命令  

java -jar apktool.jar d -d 123.apk lashou1

java -jar apktool.jar b -d lashou1 lashou1.apk

2、签名：下面的顺序不能反了

java -jar .\sign\signapk.jar .\sign\testkey.x509.pem .\sign\testkey.pk8 lashou1.apk lashou1sign.apk

3、添加调试输出信息

添加此信息时，需要修改函数中寄存器的数量，保证下面的v4和v1，v2不要和程序中的其它变量冲突了，以免影响程序运行。

const-string v4,"username and passwd"

invoke-static {v4,v1}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I
invoke-static {v4,v2}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I

4、错误解决

a.回编时错误

反编译时提示：

D:\software\android\ApkTool>java -jar apktool.jar d -d 123.apk lashou1208

I: Baksmaling...

I: Loading resource table...

I: Loaded.

I: Loading resource table from file: C:\Users\hp\apktool\framework\1.apk

I: Loaded.

I: Decoding file-resources...

W: Cant find 9patch chunk in file: "drawable-hdpi/index_bottom_bar.9.png". Renam

ing it to *.png.

W: Cant find 9patch chunk in file: "drawable-hdpi/ab_solid_custom_blue_inverse_h

olo.9.png". Renaming it to *.png.

W: Cant find 9patch chunk in file: "drawable-hdpi/movie_bottom_bar.9.png". Renam

ing it to *.png.

I: Decoding values*/* XMLs...

I: Done.

I: Copying assets and libs...

回编译时就会提示：

D:\software\android\ApkTool\lashou1208\res\values\public.xml:743: error: Public

symbol drawable/upomp_bypay_info_btn6_click declared here is not defined.

遇到此错误时说public.xml中部分变量未定义，将反编译时提示的带9的图片的都查询到并删除再反编译即可成功，后续再提示错误发现变量未定义直接删除文件中提示的那一行即可。

b.程序启动错误，提示“很抱歉,程序出现异常,即将退出”，找到此方法即为某个线程的run方法，由某个线程的start()方法所启动。

# virtual methods

.method public final run()V

    .locals 3

#add by jyh，直接返回存在错误，直接这么修改有问题。
return-void

    invoke-static {}, Landroid/os/Looper;->prepare()V

    iget-object v0, p0, Lcom/duoduo/g/aj;->a:Lcom/duoduo/g/ai;

    #v0=(Reference);

    invoke-static {v0}, Lcom/duoduo/g/ai;->a(Lcom/duoduo/g/ai;)Landroid/content/Context;

    move-result-object v0

    const-string v1, "\u5f88\u62b1\u6b49,\u7a0b\u5e8f\u51fa\u73b0\u5f02\u5e38,\u5373\u5c06\u9000\u51fa."
#\u5f88\u62b1\u6b49,\u7a0b\u5e8f\u51fa\u73b0\u5f02\u5e38,\u5373\u5c06\u9000\u51fa很抱歉,程序出现异常,即将退出

    #v1=(Reference);

    const/4 v2, 0x1

    #v2=(One);

    invoke-static {v0, v1, v2}, Landroid/widget/Toast;->makeText(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast;

    move-result-object v0

    invoke-virtual {v0}, Landroid/widget/Toast;->show()V

    invoke-static {}, Landroid/os/Looper;->loop()V

    return-void

.end method

b、找到调用时为start的函数，并分析，发现此函数判定包信息被修改后则将进程杀掉

    #v0=(Reference);

    invoke-virtual {v0}, Lcom/duoduo/g/aj;->start()V

    

        #v2=(One);

    #add by jiayanhui

    #if-nez p2, :cond_0

    直接返回

    

    
loc_1D47F4:
invoke-static                   {}, <int Process.myPid() imp. @ _def_Process_myPid@I>
move-result                     v0
invoke-static                   {v0}, <void Process.killProcess(int) imp. @ _def_Process_killProcess@VI>
invoke-static                   {v2}, <void System.exit(int) imp. @ _def_System_exit@VI>
goto/16                         locret    

c、栈跟踪法
#new Exception("print trace").printStackTrace();
#注意v0和v1不要是程序正在使用的变量，应该多定义几个。如 .locals 8 改为9后即可添加v7,v8
 new-instance v7,Ljava/lang/Exception;
 const-string v8,"print trace"
 invoke-direct {v7,v8}, Ljava/lang/Exception;-><init>(Ljava/lang/String;)V
 invoke-virtual {v7}, Ljava/lang/Exception;->printStackTrace()V
 

调用栈内容如下：  

12-10 03:05:40.943: W/System.err(1979): java.lang.Exception: print trace

12-10 03:05:40.948: W/System.err(1979): at com.duoduo.g.ai.uncaughtException(ai.java:422)

12-10 03:05:40.960: W/System.err(1979): at com.umeng.analytics.b.c.uncaughtException(c.java:106)

12-10 03:05:40.960: W/System.err(1979): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:693)

12-10 03:05:40.978: W/System.err(1979): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:690)

12-10 03:05:40.978: W/System.err(1979): at dalvik.system.NativeStart.main(Native Method)

12-10 03:05:46.188: W/System.err(2035): java.lang.Exception: print trace

12-10 03:05:46.188: W/System.err(2035): at com.duoduo.g.ai.uncaughtException(ai.java:422)

12-10 03:05:46.188: W/System.err(2035): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:693)

12-10 03:05:46.188: W/System.err(2035): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:690)

12-10 03:05:46.198: W/System.err(2035): at dalvik.system.NativeStart.main(Native Method)

12-10 03:05:50.538: W/System.err(2058): java.lang.Exception: print trace

12-10 03:05:50.548: W/System.err(2058): at com.duoduo.g.ai.uncaughtException(ai.java:422)

12-10 03:05:50.548: W/System.err(2058): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:693)

12-10 03:05:50.548: W/System.err(2058): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:690)

12-10 03:05:50.548: W/System.err(2058): at dalvik.system.NativeStart.main(Native Method)

d、解决此异常后编译签名即可运行