Question

我试图通过逆向工程强化我的APK。我知道无法阻止反编译APK，但是我看到有些APK在反编译过程中使用了一种技巧来抛出异常 apktool （不仅仅是APK工具，像{{3} }无法返回classes.dex APK），因此我决定在反向工程中花费更长的时间

在这里您可以看到硬化应用程序的结果： winrar：QARK。winrar

apktool：

    sudo apktool d -f app/TTT.apk --keep-broken-res
    I: Using Apktool 2.3.1-dirty on TTT.apk
I: Loading resource table...
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /home/lab/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
Exception in thread "main" java.lang.NullPointerException
    at brut.androlib.res.data.value.ResEnumAttr.serializeBody(ResEnumAttr.java:56)
    at brut.androlib.res.data.value.ResAttr.serializeToResValuesXml(ResAttr.java:64)
    at brut.androlib.res.AndrolibResources.generateValuesFile(AndrolibResources.java:555)
    at brut.androlib.res.AndrolibResources.decode(AndrolibResources.java:269)
    at brut.androlib.Androlib.decodeResourcesFull(Androlib.java:132)
    at brut.androlib.ApkDecoder.decode(ApkDecoder.java:124)
    at brut.apktool.Main.cmdDecode(Main.java:163)
    at brut.apktool.Main.main(Main.java:72)

请为我解释一下这是怎么可能的（我需要详细的实现方法）

Answer 1

您链接的第一个APK不是有效的APK。这只是一个纯文本文件，下面的文本一遍又一遍地重复：

HTTP/1.1 200 OK
Date: Sat, 27 Oct 2018 17:35:36 GMT
Strict-Transport-Security: max-age=31536000;includeSubDomains; preload
Last-Modified: Sat, 28 Jul 2018 11:40:03 GMT
ETag: "23b1fe5-5720db0636ac0"
Accept-Ranges: bytes
Content-Length: 37429221
Keep-Alive: timeout=20
Connection: Keep-Alive

很明显，仅重复的HTTP响应标头不会形成有效的APK。您的工具在该文件上失败的原因不是该文件已加密/混淆/硬化，而是根本不是一个APK，如果您尝试安装它将无法使用。

您链接到的第二个APK在我unzip时对我来说很好。

我的结论是，您提到的“强化”功能不存在（这似乎是由于混合了有效和无效的APK），而且成功安装的任何APK也都可以成功提取。

Answer 2

这是加密Java类功能（例如dexgaurd或Bangcle kh）；而且还受到了诸如dexprotector之类的本机库加密（NLE）+ JNI混淆（JNI）的保护（我在动态分析工具中发现了这一点）

以及This文章和this

的许多语义语义学坦克

apktool尝试反编译/取消存档我的apk时引发异常

2 个答案: