【Android安全】Android静态分析调试定位关键代码

Android调试方法：
1、logcat输出
2、调用栈打印
3、ddms method profiling
4、andbug只能设置一个断点不支持单步调试
5、ida动态调试原生程序

1、反编译命令  

java -jar apktool.jar d -d 123.apk lashou1
java -jar apktool.jar b -d lashou1 lashou1.apk


2、签名：下面的顺序不能反了
java -jar .\sign\signapk.jar .\sign\testkey.x509.pem .\sign\testkey.pk8 lashou1.apk lashou1sign.apk

3、添加调试输出信息

添加此信息时，需要修改函数中寄存器的数量，保证下面的v4和v1，v2不要和程序中的其它变量冲突了，以免影响程序运行。

const-string v4,"username and passwd"
invoke-static {v4,v1}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

invoke-static {v4,v2}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I

4、错误解决
a.回编时错误
反编译时提示：
D:\software\android\ApkTool>java -jar apktool.jar d -d 123.apk lashou1208
I: Baksmaling...
I: Loading resource table...
I: Loaded.
I: Loading resource table from file: C:\Users\hp\apktool\framework\1.apk
I: Loaded.
I: Decoding file-resources...
W: Cant find 9patch chunk in file: "drawable-hdpi/index_bottom_bar.9.png". Renam
ing it to *.png.
W: Cant find 9patch chunk in file: "drawable-hdpi/ab_solid_custom_blue_inverse_h
olo.9.png". Renaming it to *.png.
W: Cant find 9patch chunk in file: "drawable-hdpi/movie_bottom_bar.9.png". Renam
ing it to *.png.
I: Decoding values*/* XMLs...
I: Done.
I: Copying assets and libs...
回编译时就会提示：
D:\software\android\ApkTool\lashou1208\res\values\public.xml:743: error: Public
symbol drawable/upomp_bypay_info_btn6_click declared here is not defined.
遇到此错误时说public.xml中部分变量未定义，将反编译时提示的带9的图片的都查询到并删除再反编译即可成功，后续再提示错误发现变量未定义直接删除文件中提示的那一行即可。


b.程序启动错误，提示“很抱歉,程序出现异常,即将退出”，找到此方法即为某个线程的run方法，由某个线程的start()方法所启动。
# virtual methods
.method public final run()V
    .locals 3
#add by jyh，直接返回存在错误，直接这么修改有问题。
return-void


    invoke-static {}, Landroid/os/Looper;->prepare()V


    iget-object v0, p0, Lcom/duoduo/g/aj;->a:Lcom/duoduo/g/ai;


    #v0=(Reference);
    invoke-static {v0}, Lcom/duoduo/g/ai;->a(Lcom/duoduo/g/ai;)Landroid/content/Context;


    move-result-object v0


    const-string v1, "\u5f88\u62b1\u6b49,\u7a0b\u5e8f\u51fa\u73b0\u5f02\u5e38,\u5373\u5c06\u9000\u51fa."
#\u5f88\u62b1\u6b49,\u7a0b\u5e8f\u51fa\u73b0\u5f02\u5e38,\u5373\u5c06\u9000\u51fa很抱歉,程序出现异常,即将退出
    #v1=(Reference);
    const/4 v2, 0x1


    #v2=(One);
    invoke-static {v0, v1, v2}, Landroid/widget/Toast;->makeText(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast;


    move-result-object v0


    invoke-virtual {v0}, Landroid/widget/Toast;->show()V


    invoke-static {}, Landroid/os/Looper;->loop()V


    return-void
.end method


b、找到调用时为start的函数，并分析，发现此函数判定包信息被修改后则将进程杀掉
    #v0=(Reference);
    invoke-virtual {v0}, Lcom/duoduo/g/aj;->start()V
    
        #v2=(One);
    #add by jiayanhui
    #if-nez p2, :cond_0
    直接返回
    
    
loc_1D47F4:
invoke-static                   {}, <int Process.myPid() imp. @ _def_Process_myPid@I>
move-result                     v0
invoke-static                   {v0}, <void Process.killProcess(int) imp. @ _def_Process_killProcess@VI>
invoke-static                   {v2}, <void System.exit(int) imp. @ _def_System_exit@VI>
goto/16                         locret    
c、栈跟踪法
#new Exception("print trace").printStackTrace();
#注意v0和v1不要是程序正在使用的变量，应该多定义几个。如 .locals 8 改为9后即可添加v7,v8
 new-instance v7,Ljava/lang/Exception;
 const-string v8,"print trace"
 invoke-direct {v7,v8}, Ljava/lang/Exception;-><init>(Ljava/lang/String;)V
 invoke-virtual {v7}, Ljava/lang/Exception;->printStackTrace()V
 
调用栈内容如下：  
12-10 03:05:40.943: W/System.err(1979): java.lang.Exception: print trace
12-10 03:05:40.948: W/System.err(1979): at com.duoduo.g.ai.uncaughtException(ai.java:422)
12-10 03:05:40.960: W/System.err(1979): at com.umeng.analytics.b.c.uncaughtException(c.java:106)
12-10 03:05:40.960: W/System.err(1979): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:693)
12-10 03:05:40.978: W/System.err(1979): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:690)
12-10 03:05:40.978: W/System.err(1979): at dalvik.system.NativeStart.main(Native Method)
12-10 03:05:46.188: W/System.err(2035): java.lang.Exception: print trace
12-10 03:05:46.188: W/System.err(2035): at com.duoduo.g.ai.uncaughtException(ai.java:422)
12-10 03:05:46.188: W/System.err(2035): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:693)
12-10 03:05:46.188: W/System.err(2035): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:690)
12-10 03:05:46.198: W/System.err(2035): at dalvik.system.NativeStart.main(Native Method)
12-10 03:05:50.538: W/System.err(2058): java.lang.Exception: print trace
12-10 03:05:50.548: W/System.err(2058): at com.duoduo.g.ai.uncaughtException(ai.java:422)
12-10 03:05:50.548: W/System.err(2058): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:693)
12-10 03:05:50.548: W/System.err(2058): at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:690)
12-10 03:05:50.548: W/System.err(2058): at dalvik.system.NativeStart.main(Native Method)
d、解决此异常后编译签名即可运行