判断apk是否加固或混淆,Python + dex2jar-2.0实现方法
dex2jar
Tools to work with android .dex and java .class files
项目地址:https://gitcode.com/gh_mirrors/de/dex2jar

·
大致流程如下:
1、解压apk的到classes.dex文件
2、编译获得Jar文件:> .\dex2jar-2.0\d2j-dex2jar.bat classes.dex
3、分析生成的 classes-dex2jar.jar 文件,判断apk是否混淆或加固
个人总结判断依据和部分标准:
1、已加固apk,反编译生成后的class-dex2.jar明显小于class.dex文件;jar文件中的class文件明显被隐藏无法被正常查看
2、未加固的apk,发编译生成后的class-dex2.jar大小接近于class.dex文件大小
3、已加固文件判断混淆,由于得到的jar文件过小获得信息量不多,so 默认判断为已混淆状态
4、未加固的apk,得到的jar文件中信息量充足,通过判断文件目录结构与class文件的名称判断是否混淆
图一:

图二:

图三:

图四:

手动判断分析的流程上面已经展示了,下面展示Python实现自动化判断的模块代码如下
Python代码示例:
def getaAPKDEX(self):
dexFile = "classes.dex"
jarFile = "classes-dex2jar.jar"
if (os.path.exists(dexFile)):os.remove(dexFile)
if (os.path.exists(jarFile)): os.remove(jarFile)
# 读取文件大小mb
dexFilefsize = round(os.path.getsize(dexFile) / float(1024), 0)
z_file = zipfile.ZipFile(self.fileAPKPath, "r")
dex_file_path = z_file.extract(dexFile)
z_file.close()
cmdCommond = ".\dex2jar-2.0\d2j-dex2jar.bat " + dex_file_path
self.doCMD(cmdCommond)
# 读取文件大小mb
jarFilefsize = round(os.path.getsize(jarFile) / float(1024), 0)
z_file = zipfile.ZipFile(jarFile, "r")
# 读取jar文件中的文件夹与文件信息
fileNameStr = ""
for f in z_file.namelist(): fileNameStr += f
z_file.close()
if dexFilefsize > jarFilefsize:
if "com/qihoo/util/QHDialog.class" in fileNameStr:
dex_jiagu = 1
dex_hunxiao = 1
else:
hunxiaoNum = 0
hunxiaoFile = ["/a.class", "/1.class", "/b.class", "/2.class", "a/", "/R.class"]
for hunxiao in hunxiaoFile:
if hunxiao in fileNameStr: hunxiaoNum += 1
dex_hunxiao = 1 if hunxiaoNum > 3 else 0
dex_jiagu = 0
if (os.path.exists(dexFile)):os.remove(dexFile)
if (os.path.exists(jarFile)): os.remove(jarFile)
return dex_jiagu, dex_hunxiao




Tools to work with android .dex and java .class files
最近提交(Master分支:16 天前 )
b5bda4fb
1 年前
9510b74d - 1 年前
更多推荐
所有评论(0)