运用smali自动注入技术分析android应用程序行为

转自：/article/9394216.html

现在android开发者社区里，除了app开发外，还有很多周边的工具类产品，比如安全、性能等，app产品

已经出现了巨无霸，但是工具类的产品，目前还没有出现规模比较大的公司，大部分还处于创业阶段，这可能

是创业者的下一个机会。工具类的产品相对app开发有比较高的技术门槛，从事这方面开发的技术人员需要掌

握的基本功如下：

1、熟悉android app的编译过程，了解jvm的bytecode与dalvik bytecode的区别；

2、熟悉android framework，读过部分代码，比如系统启动过程，zygote进程相关逻辑，熟练使用ndk，

掌握inline hook的基本原理；

3、熟练使用脚本语言，比如python，脚本语言在一些分析工具的开发中还是有很大优势的，而且一些著名的

开源工具也是用python写的，比如androguard；

4、熟悉apk文件的结构，熟悉dex文件的结构，比如dex文件头的结构；

5、熟悉smali语法，熟练使用apktool等工具，能解析smali文件，并读入内存自定义数据结构中；

有了上述功底，可以做的事情有很多，比如可以通过smali注入的方式插入自定义代码来监控app的行为数据，

包括性能数据以及部分逻辑数据，可以通过inline hook的方式在运行时监控应用的行为，笔者做了一个工具可以

自动往apk中插入smali代码，具体的步骤如下：

1、通过androguard解析apk文件，并获得dex文件；

2、通过baksmali将dex文件反编译为smali文件；

3、开始解析smali文件，将smali文件映射为内存数据结构；

4、分析smali文件，找出需要替换的方法关键字，并通过改写smali文件的方法注入代码；

当然这里面有很多细节问题需要解决，比如插入代码后会对原有的smali代码逻辑产生影响，如寄存器数量

增加，寄存器的的使用，跳转逻辑的影响，这些都需要你自己分析需要插入或者替换的代码上下文逻辑，使插入逻辑正确。

我下面以json为例，来详细描述如何替换smali代码：

json对象初始化的smali代码：

[plain] view
plain copy







new-instance v3, Lorg/json/JSONObject;

invoke-direct {v3, p0}, Lorg/json/JSONObject;-><init>(Ljava/lang/String;)V

第一行代码用来生成一个JSONObject对象，并放到v3寄存器中，第二行代码

调用v3中JSONObject对象的init方法，参数为存在p0寄存器（第一个参数）中的String对象调用json对象

格式化字符串jsonObject.toString，对应的smali代码如下：

[plain] view
plain copy







invoke-virtual {v3}, Lorg/json/JSONObject;->toString()Ljava/lang/String;

move-result-object v8

第一行代码调用v3中存放的json对象的toString方法，第二行代码将该返回值存放到v8寄存器中。

下面定义一个静态的方法，覆盖jsonobject对应的方法：

[java] view
plain copy







public static String toString(JSONObject jsonObject) {

String jsonString = jsonObject.toString();

Log.i("json toString:" + jsonString);

return jsonString;

}

ok，剩下的就是将smali代码里的逻辑改为调用上面的静态方法，替换后的内容如下：

[plain] view
plain copy







invoke-static {v3}, Lcom/test/JsonReplace;->toString(Lorg/json/JSONObject;)Ljava/lang/String;

move-result-object v7

init方法做同样的处理，这样就可以截获json对象的内容，从而可以监控使用json来上传数据的app内容，

如果在上面的方法开始和结束的地方获取系统时间，还可以用来获取json toString方法耗费的时间。

json方法只是众多可以捕获的方法之一，按照类似的逻辑还可以捕获更多您感兴趣的方法。

为了测试一下smali自动注入的成果，笔者下载了一个360安全卫士，进行了自动注入，此处需要注意的是，

修改完smali后需要重新打包签名，而360安全卫士在启动时做了签名校验，如果发现签名不一致会弹出一个

对话框让你去下载应用并退出，不过这也可以通过修改smali代码的方式来解决，可以找到签名校验的地方将

返回值改为1即可，由于这部分的内容涉及app的安全策略，且和本文的主题没有多大关系，所以笔者就不写

出来了，有兴趣的可以私下交流。

注入smali后可以抓取到360安全卫士上传的所有json字符串内容，我摘取了其中的部分内容：

[plain] view
plain copy







json init:{"ads":[{"des":"1mob","ris":0,"name":"1mob","fbs":[{"t":1,"s":1,"c":"ff#*#1a#/BR;#1a#/PIA;#1a#/Main;#1a#/PManager;#1a#Ljava/lang/reflect/Method;.getParameterTypes:()[Ljava/lang/Class;#1a#Ljava/lang/Class;.getDeclaredMethods:()[Ljava/lang/reflect/Method;","n":"ad.push.1mob","st":2},{"t":1,"s":0,"c":"ff#*#1a#/BR;#1a#/US;#1a#/Main;#1a#/UNManager;#1a#Ljava/lang/reflect/Method;.getParameterTypes:()[Ljava/lang/Class;#1a#Ljava/lang/Class;.getDeclaredMethods:()[Ljava/lang/reflect/Method;#1a#setGapTime","n":"ad.spot.1mob","st":8}]},{"des":"360dianjing","ris":0,"name":"360dianjing","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#http://mob.tf.360.cn/#1a1#360dianjing#1a1#ibstates.php","n":"ad.banner.360dianjing.a","st":1},{"t":1,"s":0,"c":"ff#*#1a1#http://ads.lianmeng.360.cn/#1a1#360dianjing#1a1#ibstates.php","n":"ad.banner.360dianjing.b","st":1}]},{"des":"3gyu","ris":0,"name":"3gyu","fbs":[]},{"des":"7xpush","ris":0,"name":"7xpush","fbs":[{"t":1,"s":1,"c":"ff#*#1a1#http://www.qixiazi.com/ads.xml#1a1#com.kding.ads.service.DownService#1a1#/kding/ads#1a1#notification","n":"ad.push.7xpush","st":2}]},{"des":"91zan","ris":0,"name":"91zan","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#com.skpresent.shell.ShellServiceKit#1a1#zpresent.jar#1a1#zpresent.dex","n":"ad.banner.91zan.a","st":1},{"t":1,"s":0,"c":"ff#*#1a1#com.skpop.shell.ShellServiceKit#1a1#zpop.jar#1a1#zpop.dex","n":"ad.banner.91zan.b","st":1},{"t":1,"s":0,"c":"ff#*#1a1#com.skfloat.shell.ShellServiceKit#1a1#zfloat.jar#1a1#zfloat.dex","n":"ad.banner.91zan.c","st":1},{"t":1,"s":1,"c":"ff#*#1a1#com.skpush.shell.ShellServiceKit#1a1#zan_dev_appconfig_push#1a1#zpush.dex","n":"ad.push.91zan","st":2}]},{"des":"98mid","ris":0,"name":"98mid","fbs":[{"t":1,"s":1,"c":"ff#*#1a1#img=D:/images#1a1#myAppMarket98mid#1a1#times.bat#1a1#http://www.98mid.com/","n":"ad.push.98mid","st":2}]},{"des":"A立方广告","ris":33,"name":"a3ad","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#Lcom/allyes/a3/sdk/widget/AdView;","n":"ad.banner.a3ad","st":1}]},{"des":"adchina","ris":33,"name":"adchina","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#Lcom/adchina/android/ads/AdManager;","n":"ad.banner.adchina.b","st":1},{"t":1,"s":0,"c":"ff#*#1a1#Lcom/adchina/android/ads/views/AdView;","n":"ad.banner.adchina.c","st":1}]},{"des":"adcocoa","ris":0,"name":"adcocoa","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#adcocoa_icon_default.png#1a1#adcocoa_id#1a1#adcocoa/cache","n":"ad.spot.adcocoa","st":8}]},{"des":"ader","ris":0,"name":"ader","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#AdBigWebView#1a1#com.rrgame.sdk#1a1#banner","n":"ad.banner.ader","st":1}]},{"des":"adfonic","ris":0,"name":"adfonic","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#http://adfonic.net/ad/","n":"ad.banner.adfonic","st":1}]},{"des":"adlantis","ris":0,"name":"adlantis","fbs":[{"t":1,"s":0,"c":"ff#*#1a#Ljp/adlantis/android/","n":"ad.banner.adlantis.a","st":1},{"t":1,"s":0,"c":"ff#*#1a1#sp.ad.adlantis.jp","n":"ad.banner.adlantis.b","st":1}]},{"des":"adlayout","ris":32,"name":"adlayout","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#Lnet/adlayout/ad/AdLayout;","n":"ad.gather.adlayout","st":11}]},{"des":"admarket","ris":0,"name":"admarket","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#showmyappdialog#1a1#huituixiazai","n":"ad.banner.admarket","st":1}]},{"des":"admob","ris":0,"name":"admob","fbs":[{"t":1,"s":0,"c":"ff#*#1a1#http://a.admob.com/f0?#1a1#AdMobSDK",

[plain] view
plain copy







/catchjson( 7454): json toString:{"pkg":"org.orangenose.games","ti":{"v":0,"m":2},"si":{"v":22907852054,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"cn.ishuidi.shuidi","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"net.ot24.et.sqt","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"cc.freecall.ipcall","ti":{"v":0,"m":2},"si":{"v":22906542357,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"cn.btcall.ipcall","ti":{"v":0,"m":2},"si":{"v":22906542613,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"cn.pyt365.ipcall","ti":{"v":0,"m":2},"si":{"v":22906541333,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.lanshan.weimi","ti":{"v":0,"m":2},"si":{"v":22907853334,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.liulishuo.engzo","ti":{"v":0,"m":2},"si":{"v":22907591190,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.wandoujia.phoenix2.usbproxy","ti":{"v":0,"m":2},"si":{"v":22906541333,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.dnurse","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.sec.android.app.myfiles","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.qihoo360.smartkey","ti":{"v":10,"m":2},"si":{"v":22906475797,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.qihoo.wifi","ti":{"v":10,"m":2},"si":{"v":22906475797,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.qihoo.antivirus","ti":{"v":10,"m":2},"si":{"v":22906475797,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.android.fileexplorer","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.meizu.filemanager","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}

I/catchjson( 7454): json toString:{"pkg":"com.android.browser","ti":{"v":0,"m":2},"si":{"v":22906475797,"m":511}}

[plain] view
plain copy







I/catchjson( 7454): json toString:{"s":"11146d3626e64dab800a6a0ae57e4ec0","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"12332c1955435e036a5a94df4e188bd7","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"15db4f6a2b422f536cd3ce8230120e35","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"1d4dcf3a79293e05fa9744444263d048","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"328f0b456d41a3f19464241ab327b6c5","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"3bd87d5c8d98f7d711eff0d82d8fe7b9","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"517badabd9c40f1fca00d0b74d514a31","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"58f2fe7e4a67c1ba29c2a5c58c66739b","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"5b252a142a450b34bd3253acb51882bd","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"6d1fc48aeafe7286cfc9b05d815fd9f9","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"72fa45c1f82c02200c2bb769f641759e","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"829e5b4f1e9725ee6a3900009521d6df","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"8609665349f3431def232651c7785b86","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"8823a09ee4baaf6c63d767e56e5a295d","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"ca45263bc938da16ef1b069c95e61ba2","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"d488edaf562233024a034073f7d2bd93","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"dc6dbd6e49682a57a8b82889043b93a8","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"fec53268a38f029357056d46098c9384","a":1119509,"t":10}

I/catchjson( 7454): json toString:{"s":"bb5cf8250d16d684a7b1e28b12780636","a":1119509,"t":10}

至于字符串里内容的用处，由于笔者没有分析其代码逻辑，且和我的写作主题无关，所以不做解释，这里仅此

技术角度来分析通过自动注入smali代码的方式来获得应用行为的可能性，并且检测一下笔者开发的自动化注入

工具，无他意。

这里是通过smali注入的技术来获取应用的数据，还可以通过inline hook的方式，动态抓取应用的行为数据，