1
2
3
4
5

Java.lang.Class;
Java.lang.reflect.Constructor;
Java.lang.reflect.Field;
Java.lang.reflect.Method;
Java.lang.reflect.Modifier;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

// 示例类
class Person implements Runnable{
    public String name;
    private int age;

    //默认构造函数和有参构造函数
    public Person() {}
    private Person(String str){
        System.out.println("Private constructor:"+str);
    }
    public Person(String name, int age) {
        this.name = name;
        this.age = age;
    }

    // 不同访问权限的方法
    public void introduce() {
        System.out.println("我是" + name + ",年龄" + age);
    }

    private void privateMethod(String name,int age) {

        System.out.println("这是Person的私有方法,"+"name="+name+","+"age="+age);
    }

    @Override
    public void run() {
        System.out.println("Hello World");
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

        //1. 获取类对象
        // 动态加载
        Class<?> clazz= Class.forName("MyUnidbgScripts.Person"); // 通过类的完整名加载
        Class<?> clazz2=ClassLoader.getSystemClassLoader().loadClass("MyUnidbgScripts.Person");// 通过classloader加载
        // 非动态加载
        Class<?> clazz3=Person.class;
        Class<?> clazz4=new Person().getClass();
        System.out.println("Load Class:");
        System.out.println(clazz);
        System.out.println(clazz2);
        System.out.println(clazz3);
        System.out.println(clazz4);
        System.out.println();
        
        //2. 从类对象获取类的各种信息
        System.out.println("Class info:");
        System.out.println(clazz.getName());       // 完整类名
        System.out.println(clazz.getSimpleName()); // 类名
        System.out.println(clazz.getSuperclass()); // 父类类对象
        System.out.println(Arrays.toString(clazz.getInterfaces()));    //接口类对象数组
        System.out.println();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

Load Class:
class MyUnidbgScripts.Person
class MyUnidbgScripts.Person
class MyUnidbgScripts.Person
class MyUnidbgScripts.Person

Class info:
MyUnidbgScripts.Person
Person
class java.lang.Object
[interface java.lang.Runnable]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

        //3. 获取构造方法
        // 获取无参构造方法(默认构造方法)
        System.out.println("Get constructor:");
        Constructor<?> constructor=clazz.getConstructor();
        System.out.println(constructor);
        System.out.println();

        // 获取public构造方法
        System.out.println("Get public constructors:");
        Constructor<?>[] constructors=clazz.getConstructors();
        System.out.println(Arrays.toString(constructors));
        System.out.println();

        // 获取所有构造方法
        System.out.println("Get all constructors:");
        constructors=clazz.getDeclaredConstructors();
        System.out.println(Arrays.toString(constructors));
        System.out.println("Print All Constructors:");
        for(Constructor<?> cons:constructors){
            System.out.println("constructor: "+cons);
            System.out.println("\tname: "+cons.getName()+
                    "\n\tModifiers: "+Modifier.toString(cons.getModifiers())+
                    "\n\tParameterTypes: "+Arrays.toString(cons.getParameterTypes()));
        }
        System.out.println();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

Get constructor:
public MyUnidbgScripts.Person()

Get public constructors:
[public MyUnidbgScripts.Person(java.lang.String,int), public MyUnidbgScripts.Person()]

Get all constructors:
[public MyUnidbgScripts.Person(java.lang.String,int), private MyUnidbgScripts.Person(java.lang.String), public MyUnidbgScripts.Person()]
Print All Constructors:
constructor: public MyUnidbgScripts.Person(java.lang.String,int)
	name: MyUnidbgScripts.Person
	Modifiers: public
	ParameterTypes: [class java.lang.String, int]
constructor: private MyUnidbgScripts.Person(java.lang.String)
	name: MyUnidbgScripts.Person
	Modifiers: private
	ParameterTypes: [class java.lang.String]
constructor: public MyUnidbgScripts.Person()
	name: MyUnidbgScripts.Person
	Modifiers: public
	ParameterTypes: []

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

        //3. 获取属性
        // 获取所有public属性
        System.out.println("Get public fields:");
        Field[] fields=clazz.getFields();
        System.out.println(Arrays.toString(fields));
        System.out.println();

        // 获取所有属性
        System.out.println("Get all fields:");
        fields=clazz.getDeclaredFields();
        System.out.println(Arrays.toString(fields));
        System.out.println("Print all fields:");
        for(Field field:fields){
            System.out.println("field: "+field);
            System.out.println("\ttype: "+field.getType()+
                    "\n\tname: "+field.getName());
        }
        System.out.println();

        System.out.println("Get specific field:");
        // 获取public权限的指定属性
        Field field=clazz.getField("name");
        System.out.println(field);
        // 获取任意权限的指定属性
        field=clazz.getDeclaredField("age");
        System.out.println(field);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

Get public fields:
[public java.lang.String MyUnidbgScripts.Person.name]

Get all fields:
[public java.lang.String MyUnidbgScripts.Person.name, private int MyUnidbgScripts.Person.age]
Print all fields:
field: public java.lang.String MyUnidbgScripts.Person.name
	type: class java.lang.String
	name: name
field: private int MyUnidbgScripts.Person.age
	type: int
	name: age

Get specific field:
public java.lang.String MyUnidbgScripts.Person.name
private int MyUnidbgScripts.Person.age

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

        //4. 获取方法
        System.out.println("Get public methods:");
        Method[] methods=clazz.getMethods();   // 注意会获取所实现接口的public方法
        System.out.println(Arrays.toString(methods));
        System.out.println();

        System.out.println("Get all methods:");
        methods=clazz.getDeclaredMethods();    // 获取所有声明的方法
        System.out.println(Arrays.toString(methods));
        System.out.println();

        System.out.println("Print all methods:");
        for(Method method:methods){
            System.out.println("method: "+method);
            System.out.println("\tname: "+method.getName());
            System.out.println("\treturnType: "+method.getReturnType());
            System.out.println("\tparameterTypes: "+Arrays.toString(method.getParameterTypes()));
        }
        System.out.println();

        // 获取public的指定方法
        Method method=clazz.getMethod("introduce");
        System.out.println(method);
        // 获取任意权限的指定方法
        method=clazz.getDeclaredMethod("privateMethod",String.class,int.class);
        System.out.println(method);
        System.out.println();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

Get public methods:
[public void MyUnidbgScripts.Person.run(), public void MyUnidbgScripts.Person.introduce(), public final void java.lang.Object.wait(long,int) throws java.lang.InterruptedException, public final void java.lang.Object.wait() throws java.lang.InterruptedException, public final native void java.lang.Object.wait(long) throws java.lang.InterruptedException, public boolean java.lang.Object.equals(java.lang.Object), public java.lang.String java.lang.Object.toString(), public native int java.lang.Object.hashCode(), public final native java.lang.Class java.lang.Object.getClass(), public final native void java.lang.Object.notify(), public final native void java.lang.Object.notifyAll()]

Get all methods:
[public void MyUnidbgScripts.Person.run(), public void MyUnidbgScripts.Person.introduce(), private void MyUnidbgScripts.Person.privateMethod(java.lang.String,int)]

Print all methods:
method: public void MyUnidbgScripts.Person.run()
	name: run
	returnType: void
	parameterTypes: []
method: public void MyUnidbgScripts.Person.introduce()
	name: introduce
	returnType: void
	parameterTypes: []
method: private void MyUnidbgScripts.Person.privateMethod(java.lang.String,int)
	name: privateMethod
	returnType: void
	parameterTypes: [class java.lang.String, int]

public void MyUnidbgScripts.Person.introduce()
private void MyUnidbgScripts.Person.privateMethod(java.lang.String,int)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

        //5. 反射创建对象
        System.out.println("Create instance by reflection:");
        //5.1 Class.newInstance() 要求Class对象对应类有无参构造方法,执行无参构造方法创建实例
        System.out.println("Create instance by Class.newInstance():");
        Object obj=clazz.newInstance();
        System.out.println(obj.toString());
        System.out.println();

        //5.2 Constructor.newInstance() 通过Class获取Constructor,再创建对象,可使用指定构造方法
        System.out.println("Create instance by Constructor.newInstance():");
        Constructor<?> cons=clazz.getConstructor();// 获取无参构造方法
        obj=cons.newInstance();
        System.out.println(obj.toString());
        cons=clazz.getDeclaredConstructors()[0];// 获取有参构造方法
        obj=cons.newInstance("张三",18);
        System.out.println(obj.toString());
        System.out.println();

1
2
3
4
5
6
7

Create instance by reflection:
Create instance by Class.newInstance():
MyUnidbgScripts.Person@30dae81

Create instance by Constructor.newInstance():
MyUnidbgScripts.Person@1b2c6ec2
MyUnidbgScripts.Person@4edde6e5

1
2
3
4
5
6
7
8
9

       //6. 反射操作属性
        System.out.println("Access field by reflection:");
        Field nameField=clazz.getField("name");
        nameField.set(obj,"王五");    // 修改指定对象的指定属性
        Field ageField=clazz.getDeclaredField("age");
        ageField.setAccessible(true);// 突破权限控制
        ageField.set(obj,20);
        System.out.println(nameField.get(obj));// get方法获取字段值
        System.out.println(ageField.get(obj));

1
2
3

Access field by reflection:
王五
20

1
2
3
4
5
6
7

       //7. 反射调用方法
        System.out.println("Run method by reflection:");
        Method introduceMethod=clazz.getMethod("introduce");
        introduceMethod.invoke(obj); //person.introduce()
        Method privateMethod=clazz.getDeclaredMethod("privateMethod",String.class,int.class);// person.privateMethod("赵四",19)
        privateMethod.setAccessible(true);
        privateMethod.invoke(obj,"赵四",19);

1
2
3

Run method by reflection:
我是王五,年龄20
这是Person的私有方法,name=赵四,age=19

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

package com.example.androidshell;

import android.util.Log;

import java.lang.reflect.Field;
import java.lang.reflect.Method;

public class Reflection {
    private static final String TAG="glass";
    public static Object invokeStaticMethod(String class_name,String method_name,Class<?>[] parameterTypes,Object[] parameterValues){
        try {
            Class<?> clazz = Class.forName(class_name); //反射获取Class类对象
            Method method = clazz.getMethod(method_name,parameterTypes);//反射获取方法
            method.setAccessible(true);//突破权限访问控制
            return method.invoke(null,parameterValues);//反射调用,静态方法无需指定所属实例,直接传参即可
        }catch (Exception e){
            Log.d(TAG, e.toString());
            return null;
        }
    }

    public static Object invokeMethod(String class_name,String method_name,Object obj,Class<?>[] parameterTypes,Object[] parameterValues)
    {
        try {
            Class<?> clazz = Class.forName(class_name);
            Method method = clazz.getMethod(method_name,parameterTypes);
            method.setAccessible(true);//突破权限访问控制
            return method.invoke(obj,parameterValues);// 反射调用,动态方法需要指定所属实例
        }catch (Exception e)
        {
            Log.d(TAG, e.toString());
            return null;
        }
    }

    public static Object getField(String class_name,Object obj,String field_name)
    {
        try {
            Class<?> clazz = Class.forName(class_name);
            Field field = clazz.getDeclaredField(field_name);
            field.setAccessible(true);
            return field.get(obj);  //获取实例字段,需要指定实例对象
        }catch(Exception e)
        {
            Log.d(TAG, e.toString());
            return null;
        }
    }

    public static Object getStaticField(String class_name,String field_name)
    {
        try {
            Class<?> clazz = Class.forName(class_name);
            Field field = clazz.getDeclaredField(field_name);
            field.setAccessible(true);
            return field.get(null);
        }catch (Exception e)
        {
            Log.d(TAG, e.toString());
            return null;
        }
    }

    public static void setField(String class_name,String field_name,Object obj,Object value)
    {
        try {
            Class<?> clazz = Class.forName(class_name);
            Field field = clazz.getDeclaredField(field_name);
            field.setAccessible(true);
            field.set(obj,value);
        }catch (Exception e)
        {
            Log.d(TAG, e.toString());
        }
    }

    public static void setStaticField(String class_name,String field_name,Object value)
    {
        try {
            Class<?> clazz = Class.forName(class_name);
            Field field = clazz.getDeclaredField(field_name);
            field.setAccessible(true);
            field.set(null,value);
        }catch (Exception e){
            Log.d(TAG, e.toString());
        }
    }
}

1
2
3
4
5
6
7
8
9

public class JavaClassLoaderTest {
        public static void main(String[] args) {
            ClassLoader loader=JavaClassLoaderTest.class.getClassLoader();
            while(loader!=null){
              System.out.println(loader);
              loader=loader.getParent();
            }
        }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

    protected Class<?> loadClass(String name, boolean resolve)
        throws ClassNotFoundException
    {
        synchronized (getClassLoadingLock(name)) {
            Class<?> c = findLoadedClass(name);//1
            if (c == null) {
                long t0 = System.nanoTime();
                try {
                    if (parent != null) {
                        c = parent.loadClass(name, false);//2.
                    } else {
                        c = findBootstrapClassOrNull(name);//3
                    }
                } catch (ClassNotFoundException e) {
                    // ClassNotFoundException thrown if class not found
                    // from the non-null parent class loader
                }

                if (c == null) {
                    // If still not found, then invoke findClass in order
                    // to find the class.
                    long t1 = System.nanoTime();
                    c = findClass(name);//4

                    // this is the defining class loader; record the stats
                    PerfCounter.getParentDelegationTime().addTime(t1 - t0);
                    PerfCounter.getFindClassTime().addElapsedTimeFrom(t1);
                    PerfCounter.getFindClasses().increment();
                }
            }
            if (resolve) {
                resolveClass(c);
            }
            return c;
        }
    }

1
2
3
4
5
6
7

package com.example.emptydemo;
import android.util.Log;
public class TestClass{
    public void print(){
        Log.d("glass","com.example.emptydemo.print is called!");
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

package com.example.testdemo;

import android.content.Context;
import android.os.Bundle;

import androidx.appcompat.app.AppCompatActivity;

import java.io.File;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;

import dalvik.system.DexClassLoader;


public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        Context appContext = getApplicationContext();
        //com.example.emptydemo
        loadDexClassAndExecuteMethod(appContext, "/data/local/tmp/classes3.dex"); //直接加载dex文件
        loadDexClassAndExecuteMethod(appContext, "/data/local/tmp/EmptyDemo.apk"); //加载apk文件 本质还是加载dex
    }
    public void loadDexClassAndExecuteMethod(Context context, String strDexFilePath) {
        //1.创建优化私有目录app_opt_dex和app_lib_dex,用于ClassLoader
        File optFile = context.getDir("opt_dex", 0);// /data/user/0/com.example.testdemo/app_opt_dex
        File libFile = context.getDir("lib_dex", 0);// /data/user/0/com.example.testdemo/app_lib_dex


        //2.创建ClassLoader用于加载Dex文件 依次指定dex文件路径 Odex目录 lib库目录 父类加载器
        DexClassLoader dexClassLoader = new DexClassLoader(
                strDexFilePath,
                optFile.getAbsolutePath(),
                libFile.getAbsolutePath(),
                MainActivity.class.getClassLoader());
        Class<?> clazz = null;
        try {
            //3.通过创建的DexClassLoader加载dex文件的指定类
            clazz = dexClassLoader.loadClass("com.example.emptydemo.TestClass");

            if (clazz != null) {
                try {
                    //3.反射获取并调用类的方法
                    Object obj = clazz.newInstance();
                    Method method = clazz.getDeclaredMethod("print");
                    method.invoke(obj);
                } catch (InvocationTargetException e) {
                    e.printStackTrace();
                } catch (NoSuchMethodException e) {
                    e.printStackTrace();
                } catch (IllegalAccessException e) {
                    e.printStackTrace();
                } catch (InstantiationException e) {
                    e.printStackTrace();
                }
            }
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

/*
	参数一: String dexPath, Dex文件路径
	参数二: String optimizedDirectory, 优化后的dex即Odex目录
	Android中内存中不会出现上述参数一的Dex文件, 会先优化,然后运行,优化后为.odex文件
	参数三: String librarySearchPath, lib库搜索路径
	参数四: ClassLoader parent, 父类加载器
*/
public class DexClassLoader extends BaseDexClassLoader {
    public DexClassLoader(String dexPath, String optimizedDirectory, String librarySearchPath, ClassLoader parent) {
        super((String)null, (File)null, (String)null, (ClassLoader)null);
        throw new RuntimeException("Stub!");
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

package com.example.nativedemo;

import android.app.Activity;
import android.os.Bundle;
import android.util.Log;
import android.widget.TextView;

public class MainActivity extends Activity {

    static {
        System.loadLibrary("nativedemo");
    }
    public native String stringFromJNI();
    public native int add(int x,int y);
    public native int sub(int x,int y);

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        // Example of a call to a native method
        TextView tv = findViewById(R.id.sample_text) ;
        String result=stringFromJNI()+" add(111,222)="+add(111,222)+" sub(999,333)="+sub(999,333);
        tv.setText(result);
        Log.d("glass","Run source MainActivity.onCreate "+this);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

package com.example.nativedemo;

import android.app.Application;
import android.content.Context;
import android.util.Log;

public class MyApplication extends Application {

    @Override
    protected void attachBaseContext(Context base) {
        super.attachBaseContext(base);
        Log.d("glass", "Run source MyApplication.attachBaseContext "+this);
    }
    @Override
    public void onCreate() {
        super.onCreate();
        Log.d("glass", "Run source MyApplication.onCreate "+this);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

#include <jni.h>
#include <string>

// 静态注册
extern "C" JNIEXPORT jstring JNICALL
Java_com_example_nativedemo_MainActivity_stringFromJNI(
        JNIEnv* env,
        jobject /* this */) {
    std::string hello = "Hello from C++";
    return env->NewStringUTF(hello.c_str());
}

//native函数对应的java方法所属类
static const char *ClassName="com/example/nativedemo/MainActivity";

jint add(JNIEnv* env,jobject obj,jint x,jint y){
    return x+y;
}
jint sub(JNIEnv* env,jobject obj,jint x,jint y){
    return x-y;
}

//定义本地方法数组 建立映射关系
//JNINativeMethod结构体成员为函数名,函数签名,函数指针
static JNINativeMethod methods[]={
        {"add","(II)I",(void*)add},
        {"sub","(II)I",(void*)sub}
};

//编写加载注册方法
jint JNI_OnLoad(JavaVM* vm,void* reserved){
    JNIEnv* env=nullptr;//获取JNIEnv对象
    if(vm->GetEnv((void**)&env,JNI_VERSION_1_6)!=JNI_OK)
        return -1;
    //获取对应java方法所属的类对象
    jclass clazz=env->FindClass(ClassName);
    //调用RegisterNatives注册方法
    if(clazz){
        env->RegisterNatives(clazz,methods,sizeof(methods)/sizeof(methods[0]));
        return JNI_VERSION_1_6;//注意必须返回JNI版本
    }
    else
        return -1;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools">

    <application
        android:allowBackup="true"
        android:dataExtractionRules="@xml/data_extraction_rules"
        android:fullBackupContent="@xml/backup_rules"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/Theme.NativeDemo"
        tools:targetApi="29"
        android:name=".MyApplication"
        >
        <activity
            android:name=".MainActivity"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>
</manifest>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

<?xml version="1.0" encoding="utf-8"?>
<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:app="http://schemas.android.com/apk/res-auto"
    xmlns:tools="http://schemas.android.com/tools"
    android:layout_width="match_parent"
    android:layout_height="match_parent"
    android:gravity="center"
    tools:context="com.example.nativedemo.MainActivity"
    >

    <TextView
        android:id="@+id/sample_text"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:text="Hello World!"
        android:textAlignment="center"
        />

</LinearLayout>

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261

from zlib import adler32
from hashlib import sha1
from binascii import unhexlify
from lxml import etree
import subprocess
import shutil
from pathlib import Path
import argparse
# 封装path类,保存全局用到的路径
class Paths:
    def __init__(self, srcApk:Path, shellApk:Path, outputApk:Path):
        # Apk file paths
        self.srcApkPath= srcApk.resolve() # 解析为绝对路径
        self.shellApkPath= shellApk.resolve()
        self.newApkPath= outputApk.resolve()

        # Temp directories default python file path
        self.tmpdir= Path(__file__).parent/'temp'
        self.srcApkTempDir=  self.tmpdir/ 'srcApkTemp'
        self.shellApkTempDir= self.tmpdir/'shellApkTemp'
        self.newApkTempDir= self.tmpdir/ 'newApkTemp'


# Apktool类 提供解包,打包,签名功能
class Apktool:
    def __init__(self):
        self.apktool_path= Path(__file__).parent/'tools/apktool/apktool.bat'
        self.signer_path=Path(__file__).parent/'tools/uber-apk-signer-1.3.0.jar'

    def signApk(self,unsignedApkPath:Path):
        self.runCommand(['java','-jar', self.signer_path, '--apk',unsignedApkPath])

    # 使用apktool解包apk 只解包资源不解包dex
    def extractApk(self,apkPath:Path, outputDir:Path):
        self.runCommand([self.apktool_path, '-s', 'd' , apkPath, '-o', outputDir])

    # 重打包apk
    def repackApk(self,inputDir:Path, outApk:Path):
        self.runCommand([self.apktool_path, 'b' , inputDir, '-o', outApk])

    def runCommand(self,args):
        subprocess.run(args,stdout=subprocess.DEVNULL) #仅调用工具,不需要输出,重定向stdout到os.devnull
        # 参数列表 捕获输出 输出转为字符串
        #print(subprocess.run(args,  capture_output=True,text=True).stdout)

# AndroidManifest.xml的editor 用于获取和修改标签属性,以及添加标签
class ManifestEditor:
    def __init__(self, xml_content: bytes):
        self.ns = {'android': 'http://schemas.android.com/apk/res/android'}
        self.tree = etree.fromstring(xml_content)

    # 获取指定标签的android属性值 examples: get_attr('application', 'name') get_attr('activity', 'name')
    def getTagAttribute(self, tag_name: str, attr_name: str):
        if tag_name == 'manifest':  # 根标签特殊处理
            elem = self.tree
            if elem is not None:
                return elem.get(f'{attr_name}')  # 寻找标签的属性
        else:
            elem = self.tree.find(f'.//{tag_name}', namespaces=self.ns)
            if elem is not None:
                return elem.get(f'{{{self.ns["android"]}}}{attr_name}')  # 根标签之外的属性位于android命名空间下
        return None

    # 设置指定标签的属性值 example:set_attr('application','name',"com.example.ProxyApplication")
    def setTagAttribute(self, tag_name: str, attr_name: str, new_value: str):
        if tag_name == 'manifest':  # 根标签特殊处理
            elem = self.tree
            if elem is not None:
                return elem.set(f'{attr_name}', new_value)  # 设置属性值
        else:
            elem = self.tree.find(f'.//{tag_name}', namespaces=self.ns)
            if elem is not None:
                elem.set(f'{{{self.ns["android"]}}}{attr_name}', new_value)
                return True
        return False

    # 在指定父标签下添加新子标签 example: add_tag('application',"meta-data",{'name': 'android.permission.CAMERA','value':'hello'})
    def addTagWithAttributes(self, parent_tag: str, new_tag: str, attrs: dict):
        if parent_tag == 'manifest':
            parent = self.tree
            if parent is not None:
                new_elem = etree.SubElement(parent, new_tag)
                for k, v in attrs.items():  # 支持一次给添加的标签设置多个属性
                    new_elem.set(f'{k}', v)
                return True
        else:
            parent = self.tree.find(f'.//{parent_tag}', namespaces=self.ns)
            if parent is not None:
                new_elem = etree.SubElement(parent, new_tag)
                for k, v in attrs.items():
                    new_elem.set(f'{{{self.ns["android"]}}}{k}', v)
                return True
        return False

    # 不以壳manifest为基准操作则用不到该函数,以源apk的manifest为基准自带,无需额外设置
    def getMainActivity(self):
        activities = self.tree.findall('.//activity', namespaces=self.ns)
        for activity in activities:
            intent_filters = activity.findall('.//intent-filter', namespaces=self.ns)
            for intent_filter in intent_filters:
                action = intent_filter.find('.//action[@android:name="android.intent.action.MAIN"]', namespaces=self.ns)
                category = intent_filter.find('.//category[@android:name="android.intent.category.LAUNCHER"]',
                                              namespaces=self.ns)
                if action is not None and category is not None:
                    return activity.get(f'{{{self.ns["android"]}}}name')
        return None

    def getApplication(self):
        return self.getTagAttribute('application', 'name')

    def setApplication(self, application: str):
        self.setTagAttribute('application', 'name', application)

    def addMetaData(self, name: str, value: str):
        self.addTagWithAttributes('application', 'meta-data', {'name': name, 'value': value})

    def getManifestData(self):
        """返回XML字符串"""
        return etree.tostring(self.tree, pretty_print=True, encoding='utf-8', xml_declaration=True).decode()

# 合并壳dex和源apk
def combineShellDexAndSrcApk(sourceApkPath:Path, shellApkTempDir:Path, newApkTempDir:Path):
    def fixCheckSum(dexBytesArray):
        # dexfile[8:12]
        # 小端存储
        value = adler32(bytes(dexBytesArray[12:]))
        valueArray = bytearray(value.to_bytes(4, 'little'))
        for i in range(len(valueArray)):
            dexBytesArray[8 + i] = valueArray[i]

    def fixSignature(dexBytesArray):
        # dexfile[12:32]
        sha_1 = sha1()
        sha_1.update(bytes(dexBytesArray[32:]))
        value = sha_1.hexdigest()
        valueArray = bytearray(unhexlify(value))
        for i in range(len(valueArray)):
            dexBytesArray[12 + i] = valueArray[i]

    def fixFileSize(dexBytesArray, fileSize):
        # dexfile[32:36]
        # 小端存储
        fileSizeArray = bytearray(fileSize.to_bytes(4, "little"))
        for i in range(len(fileSizeArray)):
            dexBytesArray[32 + i] = fileSizeArray[i]

    def encrypto(file):
        for i in range(len(file)):
            file[i] ^= 0xff
        return file

    # 获取源apk
    with open(sourceApkPath, 'rb') as f:
        SourceApkArray=bytearray(f.read())
    # 获取shelldex
    with open(shellApkTempDir/'classes.dex', 'rb') as f:
        shellDexArray=bytearray(f.read())

    SourceApkLen = len(SourceApkArray)
    shellDexLen = len(shellDexArray)

    # 新的dex文件长度
    newDexLen = shellDexLen + SourceApkLen + 4
    # 加密源文件
    enApkArray = encrypto(SourceApkArray)
    # 新的dex文件内容 = 壳dex + 加密的源apk + 四字节标识加密后源apk大小长度
    newDexArray = shellDexArray + enApkArray + bytearray(SourceApkLen.to_bytes(4, 'little'))

    # 修改filesize
    fixFileSize(newDexArray, newDexLen)
    # 修改signature
    fixSignature(newDexArray)
    # 修改checksum
    fixCheckSum(newDexArray)
    # 导出文件
    with open(newApkTempDir/'classes.dex', 'wb') as f:
        f.write(newDexArray)

# 提取源apk的Manifest文件,修改application为壳application(可能添加meta-data标签),输出新的Manifest文件
def handleManifest( srcApkTempDir:Path,shellApkTempDir:Path,newApkTempDir:Path):
    # 从源apk提取AndroidManifest.xml
    with open(srcApkTempDir/'AndroidManifest.xml', 'r') as f:
        srcManifestEditor=ManifestEditor(f.read().encode())
    srcApplication=srcManifestEditor.getApplication()

    # 从壳apk提取AndroidManifest.xml
    with open(shellApkTempDir/'AndroidManifest.xml', 'r') as f:
        shellManifestEditor=ManifestEditor(f.read().encode())
    print('ShellApplication:',shellManifestEditor.getApplication())

    # 修改源AndroidManifest.xml的application为壳的代理application
    srcManifestEditor.setApplication(shellManifestEditor.getApplication())

    # 写入meta-data标签 保存源apk的原始application
    if srcApplication != None:
        print('Source application:',srcApplication)
        srcManifestEditor.addMetaData('APPLICATION_CLASS_NAME',srcApplication)

    # 输出新的AndroidManifest.xml
    with open(newApkTempDir/'AndroidManifest.xml', 'w') as f:
        f.write(srcManifestEditor.getManifestData())

def start(paths:Paths):
    apktool=Apktool()
    # 1.分别解包源文件和壳文件到临时目录
    print('Extracting source and shell apk...')
    apktool.extractApk(paths.srcApkPath,paths.srcApkTempDir)
    print('Extract source apk success!')

    print('Extracting shell apk...')
    apktool.extractApk(paths.shellApkPath,paths.shellApkTempDir)
    print('Extract shell apk success!')

    # 2.复制源apk所有文件到新apk临时目录中
    print('Copying source apk files to new apk temp dir...')
    shutil.copytree(paths.srcApkTempDir,paths.newApkTempDir )
    print('Copy source apk files success!')

    # 3.处理AndroidManifest.xml
    print('Handling AndroidManifest.xml...')
    handleManifest(paths.srcApkTempDir,paths.shellApkTempDir,paths.newApkTempDir)
    print('Handle AndroidManifest.xml success!')

    # 4.合并壳dex和源apk并导出文件
    print('Combining shell dex and source apk...')
    combineShellDexAndSrcApk(paths.srcApkPath,paths.shellApkTempDir,paths.newApkTempDir)
    print('Combine shell dex and source apk success!')

    # 5.重打包apk
    print('Repacking apk...')
    apktool.repackApk(paths.newApkTempDir,paths.newApkPath)
    print('Repack apk success!')

    # 6.签名apk
    print('Signing apk...')
    apktool.signApk(paths.newApkPath)
    print('Resign apk success!')

    # 7.删除临时目录
    print('Deleting temp directories...')
    shutil.rmtree(paths.tmpdir) # 删除临时目录
    print('Delete temp directories success!')
    
def main():
    parser = argparse.ArgumentParser(description="Android APK Packer")
    parser.add_argument('-src','--src-apk', required=True, type=Path, help='Path to source APK file')
    parser.add_argument('-shell','--shell-apk', required=True, type=Path, help='Path to shell APK file')
    parser.add_argument('-o','-out','--output-apk',type=Path,help='Output path for packed APK (Default: ./out/<src-apk>_protected.apk)')
    args = parser.parse_args()
    if args.output_apk == None:
        args.output_apk = Path('./out')/(args.src_apk.stem+'_protected.apk') # 默认新apk名称及输出路径
    paths = Paths(args.src_apk, args.shell_apk, args.output_apk)

    print('Source APK:', paths.srcApkPath)
    print('Shell APK:', paths.shellApkPath)
    print('Output APK:', paths.newApkPath)
    start(paths)


if __name__=="__main__":
    main()