Java.lang.Class;Java.lang.reflect.Constructor;Java.lang.reflect.Field;Java.lang.reflect.Method;Java.lang.reflect.Modifier;

// 示例类class Person implements Runnable{public String name;private int age;//默认构造函数和有参构造函数public Person() {}private Person(String str){        System.out.println("Private constructor:"+str);    }public Person(String name, int age) {this.name = name;this.age = age;    }// 不同访问权限的方法public void introduce() {        System.out.println("我是" + name + ",年龄" + age);    }private void privateMethod(String name,int age) {        System.out.println("这是Person的私有方法,"+"name="+name+","+"age="+age);    }    @Overridepublic void run() {        System.out.println("Hello World");    }}

//1. 获取类对象// 动态加载        Class<?> clazz= Class.forName("MyUnidbgScripts.Person"); // 通过类的完整名加载        Class<?> clazz2=ClassLoader.getSystemClassLoader().loadClass("MyUnidbgScripts.Person");// 通过classloader加载// 非动态加载        Class<?> clazz3=Person.class;        Class<?> clazz4=new Person().getClass();        System.out.println("Load Class:");        System.out.println(clazz);        System.out.println(clazz2);        System.out.println(clazz3);        System.out.println(clazz4);        System.out.println();//2. 从类对象获取类的各种信息        System.out.println("Class info:");        System.out.println(clazz.getName());       // 完整类名        System.out.println(clazz.getSimpleName()); // 类名        System.out.println(clazz.getSuperclass()); // 父类类对象        System.out.println(Arrays.toString(clazz.getInterfaces()));    //接口类对象数组        System.out.println();

Load Class:class MyUnidbgScripts.Personclass MyUnidbgScripts.Personclass MyUnidbgScripts.Personclass MyUnidbgScripts.PersonClass info:MyUnidbgScripts.PersonPersonclass java.lang.Object[interface java.lang.Runnable]

//3. 获取构造方法// 获取无参构造方法(默认构造方法)        System.out.println("Get constructor:");        Constructor<?> constructor=clazz.getConstructor();        System.out.println(constructor);        System.out.println();// 获取public构造方法        System.out.println("Get public constructors:");        Constructor<?>[] constructors=clazz.getConstructors();        System.out.println(Arrays.toString(constructors));        System.out.println();// 获取所有构造方法        System.out.println("Get all constructors:");        constructors=clazz.getDeclaredConstructors();        System.out.println(Arrays.toString(constructors));        System.out.println("Print All Constructors:");for(Constructor<?> cons:constructors){            System.out.println("constructor: "+cons);            System.out.println("tname: "+cons.getName()+"ntModifiers: "+Modifier.toString(cons.getModifiers())+"ntParameterTypes: "+Arrays.toString(cons.getParameterTypes()));        }        System.out.println();

Get constructor:public MyUnidbgScripts.Person()Get public constructors:[public MyUnidbgScripts.Person(java.lang.String,int), public MyUnidbgScripts.Person()]Get all constructors:[public MyUnidbgScripts.Person(java.lang.String,int), private MyUnidbgScripts.Person(java.lang.String), public MyUnidbgScripts.Person()]Print All Constructors:constructor:public MyUnidbgScripts.Person(java.lang.String,int)    name: MyUnidbgScripts.Person    Modifiers: public    ParameterTypes: [class java.lang.String, int]constructor:private MyUnidbgScripts.Person(java.lang.String)    name: MyUnidbgScripts.Person    Modifiers: private    ParameterTypes: [class java.lang.String]constructor:public MyUnidbgScripts.Person()    name: MyUnidbgScripts.Person    Modifiers: public    ParameterTypes: []

//3. 获取属性// 获取所有public属性        System.out.println("Get public fields:");        Field[] fields=clazz.getFields();        System.out.println(Arrays.toString(fields));        System.out.println();// 获取所有属性        System.out.println("Get all fields:");        fields=clazz.getDeclaredFields();        System.out.println(Arrays.toString(fields));        System.out.println("Print all fields:");for(Field field:fields){            System.out.println("field: "+field);            System.out.println("ttype: "+field.getType()+"ntname: "+field.getName());        }        System.out.println();        System.out.println("Get specific field:");// 获取public权限的指定属性        Field field=clazz.getField("name");        System.out.println(field);// 获取任意权限的指定属性        field=clazz.getDeclaredField("age");        System.out.println(field);

Get public fields:[public java.lang.String MyUnidbgScripts.Person.name]Get all fields:[public java.lang.String MyUnidbgScripts.Person.name, private int MyUnidbgScripts.Person.age]Print all fields:field:public java.lang.String MyUnidbgScripts.Person.name    type: class java.lang.String    name: namefield:private int MyUnidbgScripts.Person.age    type: int    name: ageGet specific field:public java.lang.String MyUnidbgScripts.Person.nameprivate int MyUnidbgScripts.Person.age

//4. 获取方法        System.out.println("Get public methods:");        Method[] methods=clazz.getMethods();   // 注意会获取所实现接口的public方法        System.out.println(Arrays.toString(methods));        System.out.println();        System.out.println("Get all methods:");        methods=clazz.getDeclaredMethods();    // 获取所有声明的方法        System.out.println(Arrays.toString(methods));        System.out.println();        System.out.println("Print all methods:");for(Method method:methods){            System.out.println("method: "+method);            System.out.println("tname: "+method.getName());            System.out.println("treturnType: "+method.getReturnType());            System.out.println("tparameterTypes: "+Arrays.toString(method.getParameterTypes()));        }        System.out.println();// 获取public的指定方法        Method method=clazz.getMethod("introduce");        System.out.println(method);// 获取任意权限的指定方法        method=clazz.getDeclaredMethod("privateMethod",String.class,int.class);        System.out.println(method);        System.out.println();

Get public methods:[public void MyUnidbgScripts.Person.run(), public void MyUnidbgScripts.Person.introduce(), public final void java.lang.Object.wait(long,int) throws java.lang.InterruptedException, public final void java.lang.Object.wait() throws java.lang.InterruptedException, public final native void java.lang.Object.wait(long) throws java.lang.InterruptedException, public boolean java.lang.Object.equals(java.lang.Object), public java.lang.String java.lang.Object.toString(), public native int java.lang.Object.hashCode(), public final native java.lang.Class java.lang.Object.getClass(), public final native void java.lang.Object.notify(), public final native void java.lang.Object.notifyAll()]Get all methods:[public void MyUnidbgScripts.Person.run(), public void MyUnidbgScripts.Person.introduce(), private void MyUnidbgScripts.Person.privateMethod(java.lang.String,int)]Print all methods:method: public void MyUnidbgScripts.Person.run()    name: run    returnType: void    parameterTypes: []method: public void MyUnidbgScripts.Person.introduce()    name: introduce    returnType: void    parameterTypes: []method: private void MyUnidbgScripts.Person.privateMethod(java.lang.String,int)    name: privateMethod    returnType: void    parameterTypes: [class java.lang.String, int]public void MyUnidbgScripts.Person.introduce()private void MyUnidbgScripts.Person.privateMethod(java.lang.String,int)

//5. 反射创建对象        System.out.println("Create instance by reflection:");//5.1 Class.newInstance() 要求Class对象对应类有无参构造方法,执行无参构造方法创建实例        System.out.println("Create instance by Class.newInstance():");        Object obj=clazz.newInstance();        System.out.println(obj.toString());        System.out.println();

//5.2 Constructor.newInstance() 通过Class获取Constructor,再创建对象,可使用指定构造方法        System.out.println("Create instance by Constructor.newInstance():");        Constructor<?> cons=clazz.getConstructor();// 获取无参构造方法        obj=cons.newInstance();        System.out.println(obj.toString());        cons=clazz.getDeclaredConstructors()[0];// 获取有参构造方法        obj=cons.newInstance("张三",18);        System.out.println(obj.toString());        System.out.println();

Create instance by reflection:Create instance by Class.newInstance():MyUnidbgScripts.Person@30dae81Create instance by Constructor.newInstance():MyUnidbgScripts.Person@1b2c6ec2MyUnidbgScripts.Person@4edde6e5

//6. 反射操作属性        System.out.println("Access field by reflection:");        Field nameField=clazz.getField("name");        nameField.set(obj,"王五");    // 修改指定对象的指定属性        Field ageField=clazz.getDeclaredField("age");        ageField.setAccessible(true);// 突破权限控制        ageField.set(obj,20);        System.out.println(nameField.get(obj));// get方法获取字段值        System.out.println(ageField.get(obj));

Access field by reflection:王五20

//7. 反射调用方法        System.out.println("Run method by reflection:");        Method introduceMethod=clazz.getMethod("introduce");        introduceMethod.invoke(obj); //person.introduce()        Method privateMethod=clazz.getDeclaredMethod("privateMethod",String.class,int.class);// person.privateMethod("赵四",19)        privateMethod.setAccessible(true);        privateMethod.invoke(obj,"赵四",19);

Run method by reflection:我是王五,年龄20这是Person的私有方法,name=赵四,age=19

package com.example.androidshell;import android.util.Log;import java.lang.reflect.Field;import java.lang.reflect.Method;public class Reflection {private static final String TAG="glass";public static Object invokeStaticMethod(String class_name,String method_name,Class<?>[] parameterTypes,Object[] parameterValues){try {Class<?> clazz = Class.forName(class_name); //反射获取Class类对象Method method = clazz.getMethod(method_name,parameterTypes);//反射获取方法            method.setAccessible(true);//突破权限访问控制return method.invoke(null,parameterValues);//反射调用,静态方法无需指定所属实例,直接传参即可        }catch (Exception e){Log.d(TAG, e.toString());return null;        }    }public static Object invokeMethod(String class_name,String method_name,Object obj,Class<?>[] parameterTypes,Object[] parameterValues)    {try {Class<?> clazz = Class.forName(class_name);Method method = clazz.getMethod(method_name,parameterTypes);            method.setAccessible(true);//突破权限访问控制return method.invoke(obj,parameterValues);// 反射调用,动态方法需要指定所属实例        }catch (Exception e)        {Log.d(TAG, e.toString());return null;        }    }public static Object getField(String class_name,Object obj,String field_name)    {try {Class<?> clazz = Class.forName(class_name);Field field = clazz.getDeclaredField(field_name);            field.setAccessible(true);return field.get(obj);  //获取实例字段,需要指定实例对象        }catch(Exception e)        {Log.d(TAG, e.toString());return null;        }    }public static Object getStaticField(String class_name,String field_name)    {try {Class<?> clazz = Class.forName(class_name);Field field = clazz.getDeclaredField(field_name);            field.setAccessible(true);return field.get(null);        }catch (Exception e)        {Log.d(TAG, e.toString());return null;        }    }public static void setField(String class_name,String field_name,Object obj,Object value)    {try {Class<?> clazz = Class.forName(class_name);Field field = clazz.getDeclaredField(field_name);            field.setAccessible(true);            field.set(obj,value);        }catch (Exception e)        {Log.d(TAG, e.toString());        }    }public static void setStaticField(String class_name,String field_name,Object value)    {try {Class<?> clazz = Class.forName(class_name);Field field = clazz.getDeclaredField(field_name);            field.setAccessible(true);            field.set(null,value);        }catch (Exception e){Log.d(TAG, e.toString());        }    }}

public class JavaClassLoaderTest {public static void main(String[] args) {            ClassLoader loader=JavaClassLoaderTest.class.getClassLoader();while(loader!=null){              System.out.println(loader);              loader=loader.getParent();            }        }}

protected Class<?> loadClass(String name, boolean resolve)throws ClassNotFoundException    {synchronized (getClassLoadingLock(name)) {            Class<?> c = findLoadedClass(name);//1if (c == null) {longt0 = System.nanoTime();try {if (parent != null) {                        c = parent.loadClass(name, false);//2.                    } else {                        c = findBootstrapClassOrNull(name);//3                    }                } catch (ClassNotFoundException e) {// ClassNotFoundException thrown if class not found// from the non-null parent class loader                }if (c == null) {// If still not found, then invoke findClass in order// to find the class.longt1 = System.nanoTime();                    c = findClass(name);//4// this is the defining class loader; record the stats                    PerfCounter.getParentDelegationTime().addTime(t1 - t0);                    PerfCounter.getFindClassTime().addElapsedTimeFrom(t1);                    PerfCounter.getFindClasses().increment();                }            }if (resolve) {                resolveClass(c);            }return c;        }    }

package com.example.emptydemo;import android.util.Log;public class TestClass{public void print(){        Log.d("glass","com.example.emptydemo.print is called!");    }}

package com.example.testdemo;import android.content.Context;import android.os.Bundle;import androidx.appcompat.app.AppCompatActivity;import java.io.File;import java.lang.reflect.InvocationTargetException;import java.lang.reflect.Method;import dalvik.system.DexClassLoader;public class MainActivity extends AppCompatActivity {@Overrideprotected void onCreate(Bundle savedInstanceState) {super.onCreate(savedInstanceState);        setContentView(R.layout.activity_main);ContextappContext = getApplicationContext();//com.example.emptydemo        loadDexClassAndExecuteMethod(appContext, "/data/local/tmp/classes3.dex"); //直接加载dex文件        loadDexClassAndExecuteMethod(appContext, "/data/local/tmp/EmptyDemo.apk"); //加载apk文件 本质还是加载dex    }public void loadDexClassAndExecuteMethod(Context context, String strDexFilePath) {//1.创建优化私有目录app_opt_dex和app_lib_dex,用于ClassLoaderFileoptFile = context.getDir("opt_dex", 0);// /data/user/0/com.example.testdemo/app_opt_dexFilelibFile = context.getDir("lib_dex", 0);// /data/user/0/com.example.testdemo/app_lib_dex//2.创建ClassLoader用于加载Dex文件 依次指定dex文件路径 Odex目录 lib库目录 父类加载器DexClassLoaderdexClassLoader =new DexClassLoader(                strDexFilePath,                optFile.getAbsolutePath(),                libFile.getAbsolutePath(),                MainActivity.class.getClassLoader());        Class<?> clazz = null;try {//3.通过创建的DexClassLoader加载dex文件的指定类            clazz = dexClassLoader.loadClass("com.example.emptydemo.TestClass");if (clazz != null) {try {//3.反射获取并调用类的方法Objectobj = clazz.newInstance();Methodmethod = clazz.getDeclaredMethod("print");                    method.invoke(obj);                } catch (InvocationTargetException e) {                    e.printStackTrace();                } catch (NoSuchMethodException e) {                    e.printStackTrace();                } catch (IllegalAccessException e) {                    e.printStackTrace();                } catch (InstantiationException e) {                    e.printStackTrace();                }            }        } catch (ClassNotFoundException e) {            e.printStackTrace();        }    }}

/*    参数一: String dexPath, Dex文件路径    参数二: String optimizedDirectory, 优化后的dex即Odex目录    Android中内存中不会出现上述参数一的Dex文件, 会先优化,然后运行,优化后为.odex文件    参数三: String librarySearchPath, lib库搜索路径    参数四: ClassLoader parent, 父类加载器*/public class DexClassLoader extends BaseDexClassLoader {public DexClassLoader(String dexPath, String optimizedDirectory, String librarySearchPath, ClassLoader parent) {super((String)null, (File)null, (String)null, (ClassLoader)null);throw new RuntimeException("Stub!");    }}

package com.example.nativedemo;import android.app.Activity;import android.os.Bundle;import android.util.Log;import android.widget.TextView;public class MainActivity extends Activity {static {        System.loadLibrary("nativedemo");    }public native String stringFromJNI();public native intadd(int x,int y);public native intsub(int x,int y);@Overrideprotected void onCreate(Bundle savedInstanceState) {super.onCreate(savedInstanceState);        setContentView(R.layout.activity_main);// Example of a call to a native methodTextViewtv = findViewById(R.id.sample_text) ;        String result=stringFromJNI()+" add(111,222)="+add(111,222)+" sub(999,333)="+sub(999,333);        tv.setText(result);        Log.d("glass","Run source MainActivity.onCreate "+this);    }}

package com.example.nativedemo;import android.app.Application;import android.content.Context;import android.util.Log;public class MyApplication extends Application {@Overrideprotected void attachBaseContext(Context base) {super.attachBaseContext(base);        Log.d("glass", "Run source MyApplication.attachBaseContext "+this);    }@Overridepublic void onCreate() {super.onCreate();        Log.d("glass", "Run source MyApplication.onCreate "+this);    }}

#include <jni.h>#include <string>// 静态注册extern "C" JNIEXPORT jstring JNICALLJava_com_example_nativedemo_MainActivity_stringFromJNI(        JNIEnv* env,        jobject /* this */) {    std::string hello = "Hello from C++";return env->NewStringUTF(hello.c_str());}//native函数对应的java方法所属类staticconstchar *ClassName="com/example/nativedemo/MainActivity";jint add(JNIEnv* env,jobject obj,jint x,jint y){return x+y;}jint sub(JNIEnv* env,jobject obj,jint x,jint y){return x-y;}//定义本地方法数组 建立映射关系//JNINativeMethod结构体成员为函数名,函数签名,函数指针static JNINativeMethod methods[]={        {"add","(II)I",(void*)add},        {"sub","(II)I",(void*)sub}};//编写加载注册方法jint JNI_OnLoad(JavaVM* vm,void* reserved){    JNIEnv* env=nullptr;//获取JNIEnv对象if(vm->GetEnv((void**)&env,JNI_VERSION_1_6)!=JNI_OK)return -1;//获取对应java方法所属的类对象    jclass clazz=env->FindClass(ClassName);//调用RegisterNatives注册方法if(clazz){        env->RegisterNatives(clazz,methods,sizeof(methods)/sizeof(methods[0]));return JNI_VERSION_1_6;//注意必须返回JNI版本    }elsereturn -1;}

<?xml version="1.0" encoding="utf-8"?><manifestxmlns:android="http://schemas.android.com/apk/res/android"xmlns:tools="http://schemas.android.com/tools"><applicationandroid:allowBackup="true"android:dataExtractionRules="@xml/data_extraction_rules"android:fullBackupContent="@xml/backup_rules"android:icon="@mipmap/ic_launcher"android:label="@string/app_name"android:roundIcon="@mipmap/ic_launcher_round"android:supportsRtl="true"android:theme="@style/Theme.NativeDemo"tools:targetApi="29"android:name=".MyApplication"        ><activityandroid:name=".MainActivity"android:exported="true"><intent-filter><actionandroid:name="android.intent.action.MAIN" /><categoryandroid:name="android.intent.category.LAUNCHER" /></intent-filter></activity></application></manifest>

<?xml version="1.0" encoding="utf-8"?><LinearLayoutxmlns:android="http://schemas.android.com/apk/res/android"xmlns:app="http://schemas.android.com/apk/res-auto"xmlns:tools="http://schemas.android.com/tools"android:layout_width="match_parent"android:layout_height="match_parent"android:gravity="center"tools:context="com.example.nativedemo.MainActivity"    ><TextViewandroid:id="@+id/sample_text"android:layout_width="wrap_content"android:layout_height="wrap_content"android:text="Hello World!"android:textAlignment="center"        /></LinearLayout>

from zlib import adler32from hashlib import sha1from binascii import unhexlifyfrom lxml import etreeimport subprocessimport shutilfrom pathlib import Pathimport argparse# 封装path类,保存全局用到的路径class Paths:def __init__(self, srcApk:Path, shellApk:Path, outputApk:Path):# Apk file paths        self.srcApkPath= srcApk.resolve() # 解析为绝对路径        self.shellApkPath= shellApk.resolve()        self.newApkPath= outputApk.resolve()# Temp directories default python file path        self.tmpdir= Path(__file__).parent/'temp'        self.srcApkTempDir=  self.tmpdir/ 'srcApkTemp'        self.shellApkTempDir= self.tmpdir/'shellApkTemp'        self.newApkTempDir= self.tmpdir/ 'newApkTemp'# Apktool类 提供解包,打包,签名功能class Apktool:def __init__(self):        self.apktool_path= Path(__file__).parent/'tools/apktool/apktool.bat'        self.signer_path=Path(__file__).parent/'tools/uber-apk-signer-1.3.0.jar'def signApk(self,unsignedApkPath:Path):        self.runCommand(['java','-jar', self.signer_path, '--apk',unsignedApkPath])# 使用apktool解包apk 只解包资源不解包dexdef extractApk(self,apkPath:Path, outputDir:Path):        self.runCommand([self.apktool_path, '-s', 'd' , apkPath, '-o', outputDir])# 重打包apkdef repackApk(self,inputDir:Path, outApk:Path):        self.runCommand([self.apktool_path, 'b' , inputDir, '-o', outApk])def runCommand(self,args):        subprocess.run(args,stdout=subprocess.DEVNULL) #仅调用工具,不需要输出,重定向stdout到os.devnull# 参数列表 捕获输出 输出转为字符串#print(subprocess.run(args,  capture_output=True,text=True).stdout)# AndroidManifest.xml的editor 用于获取和修改标签属性,以及添加标签class ManifestEditor:def __init__(self, xml_content: bytes):        self.ns = {'android': 'http://schemas.android.com/apk/res/android'}        self.tree = etree.fromstring(xml_content)# 获取指定标签的android属性值 examples: get_attr('application', 'name') get_attr('activity', 'name')def getTagAttribute(self, tag_name: str, attr_name: str):if tag_name == 'manifest':  # 根标签特殊处理            elem = self.treeif elem is not None:return elem.get(f'{attr_name}')  # 寻找标签的属性else:            elem = self.tree.find(f'.//{tag_name}', namespaces=self.ns)if elem is not None:return elem.get(f'{{{self.ns["android"]}}}{attr_name}')  # 根标签之外的属性位于android命名空间下return None# 设置指定标签的属性值 example:set_attr('application','name',"com.example.ProxyApplication")def setTagAttribute(self, tag_name: str, attr_name: str, new_value: str):if tag_name == 'manifest':  # 根标签特殊处理            elem = self.treeif elem is not None:return elem.set(f'{attr_name}', new_value)  # 设置属性值else:            elem = self.tree.find(f'.//{tag_name}', namespaces=self.ns)if elem is not None:                elem.set(f'{{{self.ns["android"]}}}{attr_name}', new_value)return Truereturn False# 在指定父标签下添加新子标签 example: add_tag('application',"meta-data",{'name': 'android.permission.CAMERA','value':'hello'})def addTagWithAttributes(self, parent_tag: str, new_tag: str, attrs: dict):if parent_tag == 'manifest':            parent = self.treeif parent is not None:                new_elem = etree.SubElement(parent, new_tag)for k, v in attrs.items():  # 支持一次给添加的标签设置多个属性                    new_elem.set(f'{k}', v)return Trueelse:            parent = self.tree.find(f'.//{parent_tag}', namespaces=self.ns)if parent is not None:                new_elem = etree.SubElement(parent, new_tag)for k, v in attrs.items():                    new_elem.set(f'{{{self.ns["android"]}}}{k}', v)return Truereturn False# 不以壳manifest为基准操作则用不到该函数,以源apk的manifest为基准自带,无需额外设置def getMainActivity(self):        activities = self.tree.findall('.//activity', namespaces=self.ns)for activity in activities:            intent_filters = activity.findall('.//intent-filter', namespaces=self.ns)for intent_filter in intent_filters:                action = intent_filter.find('.//action[@android:name="android.intent.action.MAIN"]', namespaces=self.ns)                category = intent_filter.find('.//category[@android:name="android.intent.category.LAUNCHER"]',                                              namespaces=self.ns)if action is not None and category is not None:return activity.get(f'{{{self.ns["android"]}}}name')return Nonedef getApplication(self):return self.getTagAttribute('application', 'name')def setApplication(self, application: str):        self.setTagAttribute('application', 'name', application)def addMetaData(self, name: str, value: str):        self.addTagWithAttributes('application', 'meta-data', {'name': name, 'value': value})def getManifestData(self):"""返回XML字符串"""return etree.tostring(self.tree, pretty_print=True, encoding='utf-8', xml_declaration=True).decode()# 合并壳dex和源apkdef combineShellDexAndSrcApk(sourceApkPath:Path, shellApkTempDir:Path, newApkTempDir:Path):def fixCheckSum(dexBytesArray):# dexfile[8:12]# 小端存储        value = adler32(bytes(dexBytesArray[12:]))        valueArray = bytearray(value.to_bytes(4, 'little'))for i in range(len(valueArray)):            dexBytesArray[8 + i] = valueArray[i]def fixSignature(dexBytesArray):# dexfile[12:32]        sha_1 = sha1()        sha_1.update(bytes(dexBytesArray[32:]))        value = sha_1.hexdigest()        valueArray = bytearray(unhexlify(value))for i in range(len(valueArray)):            dexBytesArray[12 + i] = valueArray[i]def fixFileSize(dexBytesArray, fileSize):# dexfile[32:36]# 小端存储        fileSizeArray = bytearray(fileSize.to_bytes(4, "little"))for i in range(len(fileSizeArray)):            dexBytesArray[32 + i] = fileSizeArray[i]def encrypto(file):for i in range(len(file)):            file[i] ^= 0xffreturn file# 获取源apkwith open(sourceApkPath, 'rb') as f:        SourceApkArray=bytearray(f.read())# 获取shelldexwith open(shellApkTempDir/'classes.dex', 'rb') as f:        shellDexArray=bytearray(f.read())    SourceApkLen = len(SourceApkArray)    shellDexLen = len(shellDexArray)# 新的dex文件长度    newDexLen = shellDexLen + SourceApkLen + 4# 加密源文件    enApkArray = encrypto(SourceApkArray)# 新的dex文件内容 = 壳dex + 加密的源apk + 四字节标识加密后源apk大小长度    newDexArray = shellDexArray + enApkArray + bytearray(SourceApkLen.to_bytes(4, 'little'))# 修改filesize    fixFileSize(newDexArray, newDexLen)# 修改signature    fixSignature(newDexArray)# 修改checksum    fixCheckSum(newDexArray)# 导出文件with open(newApkTempDir/'classes.dex', 'wb') as f:        f.write(newDexArray)# 提取源apk的Manifest文件,修改application为壳application(可能添加meta-data标签),输出新的Manifest文件def handleManifest( srcApkTempDir:Path,shellApkTempDir:Path,newApkTempDir:Path):# 从源apk提取AndroidManifest.xmlwith open(srcApkTempDir/'AndroidManifest.xml', 'r') as f:        srcManifestEditor=ManifestEditor(f.read().encode())    srcApplication=srcManifestEditor.getApplication()# 从壳apk提取AndroidManifest.xmlwith open(shellApkTempDir/'AndroidManifest.xml', 'r') as f:        shellManifestEditor=ManifestEditor(f.read().encode())print('ShellApplication:',shellManifestEditor.getApplication())# 修改源AndroidManifest.xml的application为壳的代理application    srcManifestEditor.setApplication(shellManifestEditor.getApplication())# 写入meta-data标签 保存源apk的原始applicationif srcApplication != None:print('Source application:',srcApplication)        srcManifestEditor.addMetaData('APPLICATION_CLASS_NAME',srcApplication)# 输出新的AndroidManifest.xmlwith open(newApkTempDir/'AndroidManifest.xml', 'w') as f:        f.write(srcManifestEditor.getManifestData())def start(paths:Paths):    apktool=Apktool()# 1.分别解包源文件和壳文件到临时目录print('Extracting source and shell apk...')    apktool.extractApk(paths.srcApkPath,paths.srcApkTempDir)print('Extract source apk success!')print('Extracting shell apk...')    apktool.extractApk(paths.shellApkPath,paths.shellApkTempDir)print('Extract shell apk success!')# 2.复制源apk所有文件到新apk临时目录中print('Copying source apk files to new apk temp dir...')    shutil.copytree(paths.srcApkTempDir,paths.newApkTempDir )print('Copy source apk files success!')# 3.处理AndroidManifest.xmlprint('Handling AndroidManifest.xml...')    handleManifest(paths.srcApkTempDir,paths.shellApkTempDir,paths.newApkTempDir)print('Handle AndroidManifest.xml success!')# 4.合并壳dex和源apk并导出文件print('Combining shell dex and source apk...')    combineShellDexAndSrcApk(paths.srcApkPath,paths.shellApkTempDir,paths.newApkTempDir)print('Combine shell dex and source apk success!')# 5.重打包apkprint('Repacking apk...')    apktool.repackApk(paths.newApkTempDir,paths.newApkPath)print('Repack apk success!')# 6.签名apkprint('Signing apk...')    apktool.signApk(paths.newApkPath)print('Resign apk success!')# 7.删除临时目录print('Deleting temp directories...')    shutil.rmtree(paths.tmpdir) # 删除临时目录print('Delete temp directories success!')def main():    parser = argparse.ArgumentParser(description="Android APK Packer")    parser.add_argument('-src','--src-apk', required=True, type=Path, help='Path to source APK file')    parser.add_argument('-shell','--shell-apk', required=True, type=Path, help='Path to shell APK file')    parser.add_argument('-o','-out','--output-apk',type=Path,help='Output path for packed APK (Default: ./out/<src-apk>_protected.apk)')    args = parser.parse_args()if args.output_apk == None:        args.output_apk = Path('./out')/(args.src_apk.stem+'_protected.apk') # 默认新apk名称及输出路径    paths = Paths(args.src_apk, args.shell_apk, args.output_apk)print('Source APK:', paths.srcApkPath)print('Shell APK:', paths.shellApkPath)print('Output APK:', paths.newApkPath)    start(paths)if __name__=="__main__":    main()

package com.example.androidshell;import android.app.Application;import android.app.Instrumentation;import android.content.Context;import android.content.pm.ApplicationInfo;import android.content.pm.PackageManager;import android.os.Bundle;import android.util.ArrayMap;import android.util.Log;import java.io.BufferedInputStream;import java.io.ByteArrayOutputStream;import java.io.File;import java.io.FileInputStream;import java.io.FileOutputStream;import java.io.IOException;import java.lang.ref.WeakReference;import java.nio.ByteBuffer;import java.nio.ByteOrder;import java.util.ArrayList;import java.util.Iterator;import java.util.zip.ZipEntry;import java.util.zip.ZipInputStream;import dalvik.system.DexClassLoader;public class FirstProxyApplication extends  Application {private static final String TAG="glass";private String apkPath;private String dexPath;private String libPath;public void log(String message){Log.d(TAG,message);}@Overrideprotected void attachBaseContext(Context base) {super.attachBaseContext(base);        log("FirstProxyApplication.attachBaseContext() running!");try {//1.创建私有目录,保存dex,lib和源apk 具体路径为data/user/0/<package_name>/app_tmp_dexFiledex = getDir("tmp_dex", MODE_PRIVATE);Filelib = getDir("tmp_lib", MODE_PRIVATE);            dexPath = dex.getAbsolutePath();            libPath = lib.getAbsolutePath();            apkPath = dex.getAbsolutePath() + File.separator + "Source.apk";            log("dexPath: " + dexPath);            log("libPath: " + libPath);            log("apkPath: " + apkPath);// 根据文件路径创建File对象FileapkFile =new File(apkPath);// 只有首次运行时需要创建相关文件if (!apkFile.exists()) {// 根据路径创建文件                apkFile.createNewFile();//读取Classes.dex文件byte[] shellDexData = readDexFromApk();//从中分离出源apk文件                extractSrcApkFromShellDex(shellDexData);            }//配置加载源程序的动态环境,即替换mClassLoader            replaceClassLoader();        } catch (Exception e) {            Log.getStackTraceString(e);        }    }// 从当前程序的apk读取dex文件并存储为字节数组private byte[] readDexFromApk() throws IOException {//1.获取当前应用程序的源码路径(apk),一般是data/app目录下,该目录用于存放用户安装的软件StringsourceDir =this.getApplicationInfo().sourceDir;        log("this.getApplicationInfo().sourceDir: " +sourceDir);//2.创建相关输入流FileInputStreamfileInputStream =new FileInputStream(sourceDir);BufferedInputStreambufferedInputStream =new BufferedInputStream(fileInputStream);ZipInputStreamzipInputStream =new ZipInputStream(bufferedInputStream); //用于解析apk文件ByteArrayOutputStreambyteArrayOutputStream =new ByteArrayOutputStream(); //用于存放dex文件//3.遍历apk的所有文件并提取dex文件        ZipEntry zipEntry;while((zipEntry = zipInputStream.getNextEntry()) != null){ //存在下一个文件// 将classes.dex文件存储到bytearray中 壳dex和源apk合并后只保留一个dex便于处理if (zipEntry.getName().equals("classes.dex")){byte[] bytes = new byte[1024];int num;while((num = zipInputStream.read(bytes))!=-1){      //每次读取1024byte,返回读取到的byte数                    byteArrayOutputStream.write(bytes,0, num); //存放到开辟的byteArrayOutputStream中                }            }            zipInputStream.closeEntry(); //关闭当前文件        }        zipInputStream.close();        log("Read dex from apk succeed!");return byteArrayOutputStream.toByteArray(); //将读取到的dex文件以字节数组形式返回    }// 从壳dex文件中提取源apk并解析private void extractSrcApkFromShellDex(byte[] shellDexData) throws IOException {intshellDexLen = shellDexData.length;//开始解析dex文件//1.读取源apk的大小byte[] srcApkSizeBytes = new byte[4];        System.arraycopy(shellDexData, shellDexLen - 4, srcApkSizeBytes,0,4);intsrcApkSize =ByteBuffer.wrap(srcApkSizeBytes).order(ByteOrder.LITTLE_ENDIAN).getInt();//转成bytebuffer,方便4 bytes转int 将bytes转成int,加壳时,长度按小端存储//2.读取源apkbyte[] sourceApkData = new byte[srcApkSize];        System.arraycopy(shellDexData, shellDexLen - srcApkSize - 4, sourceApkData, 0, srcApkSize);//注意减4//3.解密源apk        sourceApkData = decrypt(sourceApkData);//写入新建的apk文件中Fileapkfile =new File(apkPath);try {FileOutputStreamapkfileOutputStream =new FileOutputStream(apkfile);            apkfileOutputStream.write(sourceApkData);            apkfileOutputStream.close();        }catch (IOException e){throw new IOException(e);        }//分析源apk,取出so文件放入libPath目录中FileInputStreamfileInputStream =new FileInputStream(apkfile);BufferedInputStreambufferedInputStream =new BufferedInputStream(fileInputStream);ZipInputStreamzipInputStream =new ZipInputStream(bufferedInputStream);        ZipEntry nextEntry;while ((nextEntry=zipInputStream.getNextEntry())!=null){Stringname = nextEntry.getName();if (name.startsWith("lib/") && name.endsWith(".so")){//获取文件名并创建相应文件                String[] nameSplit = name.split("/");StringsoFileStorePath = libPath + File.separator + nameSplit[nameSplit.length - 1];FilestoreFile =new File(soFileStorePath);                storeFile.createNewFile();//读数据到相应so文件中FileOutputStreamfileOutputStream =new FileOutputStream(storeFile);byte[] bytes = new byte[1024];int num;while((num = zipInputStream.read(bytes))!=-1){                    fileOutputStream.write(bytes,0,num);                }                fileOutputStream.flush();                fileOutputStream.close();            }            zipInputStream.closeEntry();        }        zipInputStream.close();    }// 解密函数private byte[] decrypt(byte[] data) {for (inti =0; i < data.length; i++){            data[i] ^= (byte) 0xff;        }return data;    }// 替换壳App的ClassLoader为源App的ClassLoaderprivate void replaceClassLoader() {//1.获取当前的classloaderClassLoaderclassLoader =this.getClassLoader();        log("Current ClassLoader: " + classLoader.toString());        log("Parent ClassLoader: " + classLoader.getParent().toString());//2.反射获取ActivityThreadObjectsCurrentActivityThreadObj = Reflection.getStaticField("android.app.ActivityThread","sCurrentActivityThread");        log("ActivityThread.sCurrentActivity: " + sCurrentActivityThreadObj.toString());//3.反射获取LoadedApk//获取当前ActivityThread实例的mPackages字段 类型为ArrayMap<String, WeakReference<LoadedApk>>, 里面存放了当前应用的LoadedApk对象ArrayMapmPackagesObj = (ArrayMap) Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mPackages");        log( "mPackagesObj: " + mPackagesObj.toString());//获取mPackages中的当前应用包名StringcurrentPackageName =this.getPackageName();        log("currentPackageName: " + currentPackageName);// 获取loadedApk实例也有好几种,mInitialApplication mAllApplications mPackages// 通过包名获取当前应用的loadedApk实例WeakReferenceweakReference = (WeakReference) mPackagesObj.get(currentPackageName);ObjectloadedApkObj = weakReference.get();        log( "LoadedApk: " + loadedApkObj.toString());//4.替换ClassLoaderDexClassLoaderdexClassLoader =new DexClassLoader(apkPath,dexPath,libPath, classLoader.getParent()); //动态加载源程序的dex文件,以当前classloader的父加载器作为parent        Reflection.setField("android.app.LoadedApk","mClassLoader",loadedApkObj,dexClassLoader); //替换当前loadedApk实例中的mClassLoader字段        log("New DexClassLoader: " + dexClassLoader);    }//替换壳程序LoadedApk的Application为源程序Application,并调用其onCreate方法public booleanreplaceApplication(){// Application实例存在于: LoadedApk.mApplication// 以及ActivityThread的mInitialApplication和mAllApplications和mBoundApplication//判断源程序是否使用自定义Application 若使用则需要进行替换,若未使用则直接返回,使用壳的默认Application即可StringappClassName =null; //源程序的Application类名try {//获取AndroidManifest.xml 文件中的 <meta-data> 元素ApplicationInfoapplicationInfo = getPackageManager().getApplicationInfo(this.getPackageName(), PackageManager.GET_META_DATA);BundlemetaData = applicationInfo.metaData;//获取xml文件声明的Application类if (metaData != null && metaData.containsKey("APPLICATION_CLASS_NAME")){                appClassName = metaData.getString("APPLICATION_CLASS_NAME");            } else {                log("源程序中没有自定义Application");return false; //如果不存在直接返回,使用壳的application即可            }        } catch (PackageManager.NameNotFoundException e) {            log(Log.getStackTraceString(e));        }//源程序存在自定义application类,开始替换        log("Try to replace Application");//1.反射获取ActivityThread实例ObjectsCurrentActivityThreadObj = Reflection.getStaticField("android.app.ActivityThread","sCurrentActivityThread");        log("ActivityThread: " + sCurrentActivityThreadObj.toString());//2.获取并设置LoadedApk//获取mBoundApplication (AppBindData对象)ObjectmBoundApplicationObj = Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mBoundApplication") ;        log("mBoundApplication: "+mBoundApplicationObj.toString());//获取mBoundApplication.info (即LoadedApk)ObjectinfoObj = Reflection.getField("android.app.ActivityThread$AppBindData",mBoundApplicationObj,"info");        log( "LoadedApk: " + infoObj.toString());//把LoadedApk的mApplication设置为null,这样后续才能调用makeApplication() 否则由于已存在Application,无法进行替换        Reflection.setField("android.app.LoadedApk","mApplication",infoObj,null);//3.获取ActivityThread.mInitialApplication 即拿到旧的Application(对于要加载的Application来讲)ObjectmInitialApplicationObj = Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mInitialApplication");        log("mInitialApplicationObj: " + mInitialApplicationObj.toString());//4.获取ActivityThread.mAllApplications并删除旧的application        ArrayList<Application> mAllApplicationsObj = (ArrayList<Application>) Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mAllApplications");        mAllApplicationsObj.remove(mInitialApplicationObj);        log("mInitialApplication 从 mAllApplications 中移除成功");//5.重置相关类的Application类名 便于后续创建Application//获取LoadedApk.mApplicationInfoApplicationInfoapplicationInfo = (ApplicationInfo) Reflection.getField("android.app.LoadedApk",infoObj,"mApplicationInfo");        log( "LoadedApk.mApplicationInfo: " + applicationInfo.toString());//获取mBoundApplication.appInfoApplicationInfoappinfoInAppBindData = (ApplicationInfo) Reflection.getField("android.app.ActivityThread$AppBindData",mBoundApplicationObj,"appInfo");        log("ActivityThread.mBoundApplication.appInfo: " + appinfoInAppBindData.toString());//此处通过引用修改值,虽然后续没有使用,但是实际上是修改其指向的LoadedApk相关字段的值//设置两个appinfo的classname为源程序的application类名,以便后续调用makeApplication()创建源程序的application        applicationInfo.className = appClassName;        appinfoInAppBindData.className = appClassName;        log("Source Application name: " + appClassName);//6.反射调用makeApplication方法创建源程序的applicationApplicationapplication = (Application) Reflection.invokeMethod("android.app.LoadedApk","makeApplication",infoObj,new Class[]{boolean.class, Instrumentation.class},new Object[]{false,null}); //使用源程序中的application//Application app = (Application)ReflectionMethods.invokeMethod("android.app.LoadedApk","makeApplication",infoObj,new Class[]{boolean.class, Instrumentation.class},new Object[]{true,null}); //使用自定义的application 强制为系统默认        log("Create source Application succeed: "+application);//7.重置ActivityThread.mInitialApplication为新的Application        Reflection.setField("android.app.ActivityThread","mInitialApplication",sCurrentActivityThreadObj,application);        log("Reset ActivityThread.mInitialApplication by new Application succeed!");//8.ContentProvider会持有代理的Application,需要特殊处理一下ArrayMapmProviderMap = (ArrayMap) Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mProviderMap");        log("ActivityThread.mProviderMap: " + mProviderMap);//获取所有provider,装进迭代器中遍历Iteratoriterator = mProviderMap.values().iterator();while(iterator.hasNext()){ObjectproviderClientRecord = iterator.next();//获取ProviderClientRecord.mLocalProvider,可能为空ObjectmLocalProvider = Reflection.getField("android.app.ActivityThread$ProviderClientRecord",providerClientRecord,"mLocalProvider") ;if(mLocalProvider != null){                log("ProviderClientRecord.mLocalProvider: " + mLocalProvider);//获取ContentProvider中的mContext字段,设置为新的Application                Reflection.setField("android.content.ContentProvider","mContext",mLocalProvider,application);            }        }        log( "Run Application.onCreate" );        application.onCreate(); //源程序,启动!return true;    }@Overridepublic void onCreate() {super.onCreate();        log("ProxyApplication.onCreate() is running!");if(replaceApplication())            log("Replace application succeed!");    }}

package com.example.androidshell;import android.util.Log;import java.lang.reflect.Field;import java.lang.reflect.Method;public class Reflection {private static final String TAG="glass";public static Object invokeStaticMethod(String class_name,String method_name,Class<?>[] parameterTypes,Object[] parameterValues){try {Class<?> clazz = Class.forName(class_name); //反射获取Class类对象Method method = clazz.getMethod(method_name,parameterTypes);//反射获取方法            method.setAccessible(true);//突破权限访问控制return method.invoke(null,parameterValues);//反射调用,静态方法无需指定所属实例,直接传参即可        }catch (Exception e){Log.d(TAG, e.toString());return null;        }    }public static Object invokeMethod(String class_name,String method_name,Object obj,Class<?>[] parameterTypes,Object[] parameterValues)    {try {Class<?> clazz = Class.forName(class_name);Method method = clazz.getMethod(method_name,parameterTypes);            method.setAccessible(true);//突破权限访问控制return method.invoke(obj,parameterValues);// 反射调用,动态方法需要指定所属实例        }catch (Exception e)        {Log.d(TAG, e.toString());return null;        }    }public static Object getField(String class_name,Object obj,String field_name)    {try {Class<?> clazz = Class.forName(class_name);Field field = clazz.getDeclaredField(field_name);            field.setAccessible(true);return field.get(obj);  //获取实例字段,需要指定实例对象        }catch(Exception e)        {Log.d(TAG, e.toString());return null;        }    }public static Object getStaticField(String class_name,String field_name)    {try {Class<?> clazz = Class.forName(class_name);Field field = clazz.getDeclaredField(field_name);            field.setAccessible(true);return field.get(null);        }catch (Exception e)        {Log.d(TAG, e.toString());return null;        }    }public static void setField(String class_name,String field_name,Object obj,Object value)    {try {Class<?> clazz = Class.forName(class_name);Field field = clazz.getDeclaredField(field_name);            field.setAccessible(true);            field.set(obj,value);        }catch (Exception e)        {Log.d(TAG, e.toString());        }    }public static void setStaticField(String class_name,String field_name,Object value)    {try {Class<?> clazz = Class.forName(class_name);Field field = clazz.getDeclaredField(field_name);            field.setAccessible(true);            field.set(null,value);        }catch (Exception e){Log.d(TAG, e.toString());        }    }}

<?xml version="1.0" encoding="utf-8"?><manifestxmlns:android="http://schemas.android.com/apk/res/android"xmlns:tools="http://schemas.android.com/tools"><applicationandroid:allowBackup="true"android:dataExtractionRules="@xml/data_extraction_rules"android:fullBackupContent="@xml/backup_rules"android:icon="@mipmap/ic_launcher"android:label="@string/app_name"android:roundIcon="@mipmap/ic_launcher_round"android:supportsRtl="true"android:theme="@style/Theme.AndroidShell"tools:targetApi="29"android:name="com.example.androidshell.FirstProxyApplication"        ></application></manifest>

from zlib import adler32from hashlib import sha1from binascii import unhexlifyfrom lxml import etreeimport subprocessimport shutilfrom pathlib import Pathimport argparse# 封装path类,保存全局用到的路径class Paths:def __init__(self, srcApk:Path, shellApk:Path, outputApk:Path):# Apk file paths        self.srcApkPath= srcApk.resolve() # 解析为绝对路径        self.shellApkPath= shellApk.resolve()        self.newApkPath= outputApk.resolve()# Temp directories default python file path        self.tmpdir= Path(__file__).parent/'temp'        self.srcApkTempDir=  self.tmpdir/ 'srcApkTemp'        self.shellApkTempDir= self.tmpdir/'shellApkTemp'        self.newApkTempDir= self.tmpdir/ 'newApkTemp'# Apktool类 提供解包,打包,签名功能class Apktool:def __init__(self):        self.apktool_path= Path(__file__).parent/'tools/apktool/apktool.bat'        self.signer_path=Path(__file__).parent/'tools/uber-apk-signer-1.3.0.jar'def signApk(self,unsignedApkPath:Path):        self.runCommand(['java','-jar', self.signer_path, '--apk',unsignedApkPath])# 使用apktool解包apk 只解包资源不解包dexdef extractApk(self,apkPath:Path, outputDir:Path):        self.runCommand([self.apktool_path, '-s', 'd' , apkPath, '-o', outputDir])# 重打包apkdef repackApk(self,inputDir:Path, outApk:Path):        self.runCommand([self.apktool_path, 'b' , inputDir, '-o', outApk])def runCommand(self,args):        subprocess.run(args,stdout=subprocess.DEVNULL) #仅调用工具,不需要输出,重定向stdout到os.devnull# 参数列表 捕获输出 输出转为字符串#print(subprocess.run(args,  capture_output=True,text=True).stdout)# AndroidManifest.xml的editor 用于获取和修改标签属性,以及添加标签class ManifestEditor:def __init__(self, xml_content: bytes):        self.ns = {'android': 'http://schemas.android.com/apk/res/android'}        self.tree = etree.fromstring(xml_content)# 获取指定标签的android属性值 examples: get_attr('application', 'name') get_attr('activity', 'name')def getTagAttribute(self, tag_name: str, attr_name: str):if tag_name == 'manifest':  # 根标签特殊处理            elem = self.treeif elem is not None:return elem.get(f'{attr_name}')  # 寻找标签的属性else:            elem = self.tree.find(f'.//{tag_name}', namespaces=self.ns)if elem is not None:return elem.get(f'{{{self.ns["android"]}}}{attr_name}')  # 根标签之外的属性位于android命名空间下return None# 设置指定标签的属性值 example:set_attr('application','name',"com.example.ProxyApplication")def setTagAttribute(self, tag_name: str, attr_name: str, new_value: str):if tag_name == 'manifest':  # 根标签特殊处理            elem = self.treeif elem is not None:return elem.set(f'{attr_name}', new_value)  # 设置属性值else:            elem = self.tree.find(f'.//{tag_name}', namespaces=self.ns)if elem is not None:                elem.set(f'{{{self.ns["android"]}}}{attr_name}', new_value)return Truereturn False# 在指定父标签下添加新子标签 example: add_tag('application',"meta-data",{'name': 'android.permission.CAMERA','value':'hello'})def addTagWithAttributes(self, parent_tag: str, new_tag: str, attrs: dict):if parent_tag == 'manifest':            parent = self.treeif parent is not None:                new_elem = etree.SubElement(parent, new_tag)for k, v in attrs.items():  # 支持一次给添加的标签设置多个属性                    new_elem.set(f'{k}', v)return Trueelse:            parent = self.tree.find(f'.//{parent_tag}', namespaces=self.ns)if parent is not None:                new_elem = etree.SubElement(parent, new_tag)for k, v in attrs.items():                    new_elem.set(f'{{{self.ns["android"]}}}{k}', v)return Truereturn False# 不以壳manifest为基准操作则用不到该函数,以源apk的manifest为基准自带,无需额外设置def getMainActivity(self):        activities = self.tree.findall('.//activity', namespaces=self.ns)for activity in activities:            intent_filters = activity.findall('.//intent-filter', namespaces=self.ns)for intent_filter in intent_filters:                action = intent_filter.find('.//action[@android:name="android.intent.action.MAIN"]', namespaces=self.ns)                category = intent_filter.find('.//category[@android:name="android.intent.category.LAUNCHER"]',                                              namespaces=self.ns)if action is not None and category is not None:return activity.get(f'{{{self.ns["android"]}}}name')return Nonedef getApplication(self):return self.getTagAttribute('application', 'name')def setApplication(self, application: str):        self.setTagAttribute('application', 'name', application)def addMetaData(self, name: str, value: str):        self.addTagWithAttributes('application', 'meta-data', {'name': name, 'value': value})def getManifestData(self):"""返回XML字符串"""return etree.tostring(self.tree, pretty_print=True, encoding='utf-8', xml_declaration=True).decode()def getEtractNativeLibs(self):"""返回是否释放so文件"""return self.getTagAttribute('application', 'extractNativeLibs')def resetExtractNativeLibs(self):"""重置etractNativeLibs属性为true"""        self.setTagAttribute('application', 'extractNativeLibs', 'true')# 合并壳dex和源apk的dexdef combineShellAndSourceDexs(shellApkTempDir:Path,srcApkTempDir:Path,newApkTempDir:Path):def fixCheckSum(dexBytesArray):# dexfile[8:12]# 小端存储        value = adler32(bytes(dexBytesArray[12:]))        valueArray = bytearray(value.to_bytes(4, 'little'))for i in range(len(valueArray)):            dexBytesArray[8 + i] = valueArray[i]def fixSignature(dexBytesArray):# dexfile[12:32]        sha_1 = sha1()        sha_1.update(bytes(dexBytesArray[32:]))        value = sha_1.hexdigest()        valueArray = bytearray(unhexlify(value))for i in range(len(valueArray)):            dexBytesArray[12 + i] = valueArray[i]def fixFileSize(dexBytesArray, fileSize):# dexfile[32:36]# 小端存储        fileSizeArray = bytearray(fileSize.to_bytes(4, "little"))for i in range(len(fileSizeArray)):            dexBytesArray[32 + i] = fileSizeArray[i]def encrypto(file):for i in range(len(file)):            file[i] ^= 0xffreturn filedef readAndCombineDexs(unpackedApkDir:Path):# 读取解包后的apk的所有dex文件,并合并为一个dex文件        combinedDex = bytearray()# glob方法返回包含所有匹配文件的生成器for dex in unpackedApkDir.glob('classes*.dex'):print('Source Apk Dex file:', dex)with open(dex, 'rb') as f:                data = bytearray(f.read())                combinedDex+=bytearray(len(data).to_bytes(4, 'little'))  # dex文件的长度,小端序                combinedDex+=data # dex文件内容return combinedDex# 获取shelldexwith open(shellApkTempDir/'classes.dex', 'rb') as f:        shellDexArray=bytearray(f.read())# 获取源apk的dex文件    srcDexArray = readAndCombineDexs(srcApkTempDir)# 新的dex文件长度    newDexLen = len(srcDexArray) + len(shellDexArray) + 4# 加密源文件    encSrcDexArray = encrypto(srcDexArray)# 新的dex文件内容 = 壳dex + 加密的源dex + 四字节标识加密后源dex大小长度    newDexArray = shellDexArray + encSrcDexArray  + bytearray(len(encSrcDexArray).to_bytes(4, 'little'))# 修改filesize    fixFileSize(newDexArray, newDexLen)# 修改signature    fixSignature(newDexArray)# 修改checksum    fixCheckSum(newDexArray)# 导出文件with open(newApkTempDir/'classes.dex', 'wb') as f:        f.write(newDexArray)# 提取源apk的Manifest文件,修改application为壳application(可能添加meta-data标签),输出新的Manifest文件def handleManifest( srcApkTempDir:Path,shellApkTempDir:Path,newApkTempDir:Path):# 从源apk提取AndroidManifest.xmlwith open(srcApkTempDir/'AndroidManifest.xml', 'r') as f:        srcManifestEditor=ManifestEditor(f.read().encode())    srcApplication=srcManifestEditor.getApplication()    srcExtractNativeLibs=srcManifestEditor.getEtractNativeLibs()print('SourceApplication:',srcApplication)print('SourceExtractNativeLibs:',srcExtractNativeLibs)# 从壳apk提取AndroidManifest.xmlwith open(shellApkTempDir/'AndroidManifest.xml', 'r') as f:        shellManifestEditor=ManifestEditor(f.read().encode())print('ShellApplication:',shellManifestEditor.getApplication())# 修改源AndroidManifest.xml的application为壳的代理application    srcManifestEditor.setApplication(shellManifestEditor.getApplication())# 写入meta-data标签 保存源apk的原始applicationif srcApplication != None:print('Source application:',srcApplication)        srcManifestEditor.addMetaData('APPLICATION_CLASS_NAME',srcApplication)# 如果源apk的manifest中默认设置etractNativeLibs=false,则重置为true,确保释放lib文件if srcExtractNativeLibs=='false':        srcManifestEditor.resetExtractNativeLibs() # 输出新的AndroidManifest.xmlwith open(newApkTempDir/'AndroidManifest.xml', 'w') as f:        f.write(srcManifestEditor.getManifestData())def start(paths:Paths):    apktool=Apktool()# 1.分别解包源文件和壳文件到临时目录print('Extracting source and shell apk...')    apktool.extractApk(paths.srcApkPath,paths.srcApkTempDir)print('Extract source apk success!')print('Extracting shell apk...')    apktool.extractApk(paths.shellApkPath,paths.shellApkTempDir)print('Extract shell apk success!')# 2.复制源apk所有文件到新apk临时目录中,忽略源dex和manifest文件print('Copying source apk files to new apk temp dir...')    shutil.copytree(paths.srcApkTempDir,paths.newApkTempDir,ignore=shutil.ignore_patterns('AndroidManifest.xml','classes*.dex')) print('Copy source apk files success!')# 3.处理AndroidManifest.xmlprint('Handling AndroidManifest.xml...')    handleManifest(paths.srcApkTempDir,paths.shellApkTempDir,paths.newApkTempDir)print('Handle AndroidManifest.xml success!')# 4.合并壳dex和源apk并导出文件print('Combining shell dex and source dexs...')    combineShellAndSourceDexs(paths.shellApkTempDir,paths.srcApkTempDir,paths.newApkTempDir)print('Combine shell dex and source dexs success!')# 5.重打包apkprint('Repacking apk...')    apktool.repackApk(paths.newApkTempDir,paths.newApkPath)print('Repack apk success!')# 6.签名apkprint('Signing apk...')    apktool.signApk(paths.newApkPath)print('Resign apk success!')# 7.删除临时目录print('Deleting temp directories...')    shutil.rmtree(paths.tmpdir) # 删除临时目录print('Delete temp directories success!')def main():    parser = argparse.ArgumentParser(description="Android APK Packer")    parser.add_argument('-src','--src-apk', required=True, type=Path, help='Path to source APK file')    parser.add_argument('-shell','--shell-apk', required=True, type=Path, help='Path to shell APK file')    parser.add_argument('-o','-out','--output-apk',type=Path,help='Output path for packed APK (Default: ./out/<src-apk>_protected.apk)')    args = parser.parse_args()if args.output_apk == None:        args.output_apk = Path('./out')/(args.src_apk.stem+'_protected.apk') # 默认新apk名称及输出路径    paths = Paths(args.src_apk, args.shell_apk, args.output_apk)print('Source APK:', paths.srcApkPath)print('Shell APK:', paths.shellApkPath)print('Output APK:', paths.newApkPath)    start(paths)if __name__=="__main__":    main()

package com.example.androidshell;import android.app.Application;import android.app.Instrumentation;import android.content.Context;import android.content.pm.ApplicationInfo;import android.content.pm.PackageManager;import android.os.Build;import android.os.Bundle;import android.util.ArrayMap;import android.util.Log;import java.io.BufferedInputStream;import java.io.ByteArrayOutputStream;import java.io.FileInputStream;import java.io.IOException;import java.lang.ref.WeakReference;import java.nio.ByteBuffer;import java.nio.ByteOrder;import java.util.ArrayList;import java.util.Iterator;import java.util.zip.ZipEntry;import java.util.zip.ZipInputStream;import dalvik.system.InMemoryDexClassLoader;public class SecondProxyApplication extends Application {private final String TAG="glass";public void log(String message){Log.d(TAG,message);}@Overrideprotected void attachBaseContext(Context base) {super.attachBaseContext(base);        log("SecondProxyApplication.attachBaseContext is running!");try {byte[] shellDexData = readDexFromApk();            log("成功从源APK中读取classes.dex");//从中分理出源dex文件            ByteBuffer[] byteBuffers = extractDexFilesFromShellDex(shellDexData);            log("成功分离出源dex集合");//配置加载源程序的动态环境,即替换mClassLoader            replaceClassLoader(byteBuffers);        } catch (Exception e) {            log( Log.getStackTraceString(e));        }    }@Overridepublic void onCreate() {super.onCreate();        log("SecondProxyApplication.onCreate is running!");if(replaceApplication())            log("替换Application成功");    }// 从壳dex文件中提取源apk的dex并封装为ByteBufferprivate ByteBuffer[] extractDexFilesFromShellDex(byte[] shellDexData) throws IOException {intshellDexlength = shellDexData.length;//开始解析dex文件byte[] sourceDexsSizeByte = new byte[4];//读取源dexs的大小        System.arraycopy(shellDexData,shellDexlength - 4, sourceDexsSizeByte,0,4);//转成bytebuffer,方便4byte转intByteBufferwrap = ByteBuffer.wrap(sourceDexsSizeByte);//将byte转成int, 加壳时,长度按小端存储intsourceDexsSizeInt = wrap.order(ByteOrder.LITTLE_ENDIAN).getInt();        Log.d(TAG, "源dex集合的大小: " + sourceDexsSizeInt);//读取源dexsbyte[] sourceDexsData = new byte[sourceDexsSizeInt];        System.arraycopy(shellDexData,shellDexlength - sourceDexsSizeInt - 4, sourceDexsData, 0, sourceDexsSizeInt);//解密源dexs        sourceDexsData = decrypt(sourceDexsData);//更新部分//从源dexs中分离dex        ArrayList<byte[]> sourceDexList = new ArrayList<>();intpos =0;while(pos < sourceDexsSizeInt){//先提取四个字节,描述当前dex的大小//开始解析dex文件byte[] singleDexSizeByte = new byte[4];//读取源dexs的大小            System.arraycopy(sourceDexsData, pos, singleDexSizeByte,0,4);//转成bytebuffer,方便4byte转intByteBuffersingleDexwrap = ByteBuffer.wrap(singleDexSizeByte);intsingleDexSizeInt = singleDexwrap.order(ByteOrder.LITTLE_ENDIAN).getInt();            Log.d(TAG, "当前singleDex的大小: " + singleDexSizeInt);//读取单独dexbyte[] singleDexData = new byte[singleDexSizeInt];            System.arraycopy(sourceDexsData,pos + 4, singleDexData, 0, singleDexSizeInt);//加入到dexlist中            sourceDexList.add(singleDexData);//更新pos            pos += 4 + singleDexSizeInt;        }//将dexlist包装成ByteBufferintdexNum = sourceDexList.size();        Log.d(TAG, "源dex的数量: " + dexNum);        ByteBuffer[] dexBuffers = new ByteBuffer[dexNum];for (inti =0; i < dexNum; i++){            dexBuffers[i] = ByteBuffer.wrap(sourceDexList.get(i));        }return dexBuffers;    }// 从apk读取dex文件并返回dex对应字节数组// 从当前程序的apk读取dex文件并存储为字节数组private byte[] readDexFromApk() throws IOException {//1.获取当前应用程序的源码路径(apk),一般是data/app目录下,该目录用于存放用户安装的软件StringsourceDir =this.getApplicationInfo().sourceDir;        log("this.getApplicationInfo().sourceDir: " +sourceDir);//2.创建相关输入流FileInputStreamfileInputStream =new FileInputStream(sourceDir);BufferedInputStreambufferedInputStream =new BufferedInputStream(fileInputStream);ZipInputStreamzipInputStream =new ZipInputStream(bufferedInputStream); //用于解析apk文件ByteArrayOutputStreambyteArrayOutputStream =new ByteArrayOutputStream(); //用于存放dex文件//3.遍历apk的所有文件并提取dex文件        ZipEntry zipEntry;while((zipEntry = zipInputStream.getNextEntry()) != null){ //存在下一个文件// 将classes.dex文件存储到bytearray中 壳dex和源apk合并后只保留一个dex便于处理if (zipEntry.getName().equals("classes.dex")){byte[] bytes = new byte[1024];int num;while((num = zipInputStream.read(bytes))!=-1){      //每次读取1024byte,返回读取到的byte数                    byteArrayOutputStream.write(bytes,0, num); //存放到开辟的byteArrayOutputStream中                }            }            zipInputStream.closeEntry(); //关闭当前文件        }        zipInputStream.close();        log("Read dex from apk succeed!");return byteArrayOutputStream.toByteArray(); //将读取到的dex文件以字节数组形式返回    }private byte[] decrypt(byte[] sourceApkdata) {for (inti =0; i < sourceApkdata.length; i++){            sourceApkdata[i] ^= (byte) 0xff;        }return sourceApkdata;    }//替换壳程序LoadedApk的Application为源程序Application,并调用其onCreate方法public booleanreplaceApplication(){// Application实例存在于: LoadedApk.mApplication// 以及ActivityThread的mInitialApplication和mAllApplications和mBoundApplication//判断源程序是否使用自定义Application 若使用则需要进行替换,若未使用则直接返回,使用壳的默认Application即可StringappClassName =null; //源程序的Application类名try {//获取AndroidManifest.xml 文件中的 <meta-data> 元素ApplicationInfoapplicationInfo = getPackageManager().getApplicationInfo(this.getPackageName(), PackageManager.GET_META_DATA);BundlemetaData = applicationInfo.metaData;//获取xml文件声明的Application类if (metaData != null && metaData.containsKey("APPLICATION_CLASS_NAME")){                appClassName = metaData.getString("APPLICATION_CLASS_NAME");            } else {                log("源程序中没有自定义Application");return false; //如果不存在直接返回,使用壳的application即可            }        } catch (PackageManager.NameNotFoundException e) {            log(Log.getStackTraceString(e));        }//源程序存在自定义application类,开始替换        log("Try to replace Application");//1.反射获取ActivityThread实例ObjectsCurrentActivityThreadObj = Reflection.getStaticField("android.app.ActivityThread","sCurrentActivityThread");        log("ActivityThread: " + sCurrentActivityThreadObj.toString());//2.获取并设置LoadedApk//获取mBoundApplication (AppBindData对象)ObjectmBoundApplicationObj = Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mBoundApplication") ;        log("mBoundApplication: "+mBoundApplicationObj.toString());//获取mBoundApplication.info (即LoadedApk)ObjectinfoObj = Reflection.getField("android.app.ActivityThread$AppBindData",mBoundApplicationObj,"info");        log( "LoadedApk: " + infoObj.toString());//把LoadedApk的mApplication设置为null,这样后续才能调用makeApplication() 否则由于已存在Application,无法进行替换        Reflection.setField("android.app.LoadedApk","mApplication",infoObj,null);//3.获取ActivityThread.mInitialApplication 即拿到旧的Application(对于要加载的Application来讲)ObjectmInitialApplicationObj = Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mInitialApplication");        log("mInitialApplicationObj: " + mInitialApplicationObj.toString());//4.获取ActivityThread.mAllApplications并删除旧的application        ArrayList<Application> mAllApplicationsObj = (ArrayList<Application>) Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mAllApplications");        mAllApplicationsObj.remove(mInitialApplicationObj);        log("mInitialApplication 从 mAllApplications 中移除成功");//5.重置相关类的Application类名 便于后续创建Application//获取LoadedApk.mApplicationInfoApplicationInfoapplicationInfo = (ApplicationInfo) Reflection.getField("android.app.LoadedApk",infoObj,"mApplicationInfo");        log( "LoadedApk.mApplicationInfo: " + applicationInfo.toString());//获取mBoundApplication.appInfoApplicationInfoappinfoInAppBindData = (ApplicationInfo) Reflection.getField("android.app.ActivityThread$AppBindData",mBoundApplicationObj,"appInfo");        log("ActivityThread.mBoundApplication.appInfo: " + appinfoInAppBindData.toString());//此处通过引用修改值,虽然后续没有使用,但是实际上是修改其指向的LoadedApk相关字段的值//设置两个appinfo的classname为源程序的application类名,以便后续调用makeApplication()创建源程序的application        applicationInfo.className = appClassName;        appinfoInAppBindData.className = appClassName;        log("Source Application name: " + appClassName);//6.反射调用makeApplication方法创建源程序的applicationApplicationapplication = (Application) Reflection.invokeMethod("android.app.LoadedApk","makeApplication",infoObj,new Class[]{boolean.class, Instrumentation.class},new Object[]{false,null}); //使用源程序中的application//Application app = (Application)ReflectionMethods.invokeMethod("android.app.LoadedApk","makeApplication",infoObj,new Class[]{boolean.class, Instrumentation.class},new Object[]{true,null}); //使用自定义的application 强制为系统默认        log("Create source Application succeed: "+application);//7.重置ActivityThread.mInitialApplication为新的Application        Reflection.setField("android.app.ActivityThread","mInitialApplication",sCurrentActivityThreadObj,application);        log("Reset ActivityThread.mInitialApplication by new Application succeed!");//8.ContentProvider会持有代理的Application,需要特殊处理一下ArrayMapmProviderMap = (ArrayMap) Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mProviderMap");        log("ActivityThread.mProviderMap: " + mProviderMap);//获取所有provider,装进迭代器中遍历Iteratoriterator = mProviderMap.values().iterator();while(iterator.hasNext()){ObjectproviderClientRecord = iterator.next();//获取ProviderClientRecord.mLocalProvider,可能为空ObjectmLocalProvider = Reflection.getField("android.app.ActivityThread$ProviderClientRecord",providerClientRecord,"mLocalProvider") ;if(mLocalProvider != null){                log("ProviderClientRecord.mLocalProvider: " + mLocalProvider);//获取ContentProvider中的mContext字段,设置为新的Application                Reflection.setField("android.content.ContentProvider","mContext",mLocalProvider,application);            }        }        log( "Run Application.onCreate" );        application.onCreate(); //源程序,启动!return true;    }// 替换壳App的ClassLoader为源App的ClassLoaderprivate void replaceClassLoader(ByteBuffer[] byteBuffers) throws Exception{//1.获取当前的classloaderClassLoaderclassLoader =this.getClassLoader();        log("Current ClassLoader: " + classLoader.toString());        log("Parent ClassLoader: " + classLoader.getParent().toString());//2.反射获取ActivityThreadObjectsCurrentActivityThreadObj = Reflection.getStaticField("android.app.ActivityThread","sCurrentActivityThread");        log("ActivityThread.sCurrentActivity: " + sCurrentActivityThreadObj.toString());//3.反射获取LoadedApk//获取当前ActivityThread实例的mPackages字段 类型为ArrayMap<String, WeakReference<LoadedApk>>, 里面存放了当前应用的LoadedApk对象ArrayMapmPackagesObj = (ArrayMap) Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mPackages");        log( "mPackagesObj: " + mPackagesObj.toString());//获取mPackages中的当前应用包名StringcurrentPackageName =this.getPackageName();        log("currentPackageName: " + currentPackageName);// 获取loadedApk实例也有好几种,mInitialApplication mAllApplications mPackages// 通过包名获取当前应用的loadedApk实例WeakReferenceweakReference = (WeakReference) mPackagesObj.get(currentPackageName);ObjectloadedApkObj = weakReference.get();        log( "LoadedApk: " + loadedApkObj.toString());//动态加载源程序的dex文件if(Build.VERSION.SDK_INT>=29){            Log.d(TAG,"Library path:"+this.getApplicationInfo().nativeLibraryDir);            InMemoryDexClassLoader dexClassLoader=new InMemoryDexClassLoader(byteBuffers,this.getApplicationInfo().nativeLibraryDir,classLoader.getParent());            Log.d(TAG, "New InMemoryDexClassLoader: " + dexClassLoader);//替换当前loadedApk实例中的mClassLoader字段            Reflection.setField("android.app.LoadedApk","mClassLoader",loadedApkObj,dexClassLoader);        }else{            Log.d(TAG,"不支持Android 8.0以下版本");        }    }}

//Android 7及以前void LoadMethod(Thread* self,const DexFile& dex_file,const ClassDataItemIterator& it,                  Handle<mirror::Class> klass, ArtMethod* dst)//Android 8-9void LoadMethod(const DexFile& dex_file,const ClassDataItemIterator& it,                  Handle<mirror::Class> klass, ArtMethod* dst)//Android 10-14void LoadMethod(const DexFile& dex_file,const ClassAccessor::Method& method,                  Handle<mirror::Class> klass,                  ArtMethod* dst)//Android 15void LoadMethod(const DexFile& dex_file,const ClassAccessor::Method& method,                  ObjPtr<mirror::Class> klass,/*inout*/ MethodAnnotationsIterator* mai,/*out*/ ArtMethod* dst)

// Android 5.0 Level 21 及之前使用该声明staticvoid* (*g_originDefineClassV21)(void* thiz,constchar* descriptor,void* class_loader,constvoid* dex_file,constvoid* dex_class_def);/*//原始声明mirror::Class* DefineClass(const char* descriptor,                            Handle<mirror::ClassLoader> class_loader,                            const DexFile& dex_file,                            const DexFile::ClassDef& dex_class_def)*/// Android 5.1-14 Level22-34使用该声明staticvoid* (*g_originDefineClassV22)(void* thiz,void* self,constchar* descriptor,size_t hash,void* class_loader,constvoid* dex_file,constvoid* dex_class_def);/*//原始声明ObjPtr<mirror::Class> DefineClass(Thread* self,                                  const char* descriptor,                                  size_t hash,                                  Handle<mirror::ClassLoader> class_loader,                                  const DexFile& dex_file,                                  const dex::ClassDef& dex_class_def)*///Android 15 Level 35 以后使用该声明staticvoid* (*g_originDefineClassV35)(void* thiz,void* self,constchar* descriptor,size_t descriptor_length,size_t hash,void* class_loader,constvoid* dex_file,constvoid* dex_class_def);//原始声明/*ObjPtr<mirror::Class> DefineClass(Thread* self,                                  const char* descriptor,                                  size_t descriptor_length,                                  size_t hash,                                  Handle<mirror::ClassLoader> class_loader,                                  const DexFile& dex_file,                                  const dex::ClassDef& dex_class_def)*/

from zlib import adler32from hashlib import sha1from binascii import unhexlifyfrom lxml import etreeimport subprocessimport shutilfrom pathlib import Pathimport argparse# Paths类,管理全局用到的路径class Paths:def __init__(self, srcApk:Path, shellApk:Path, outputApk:Path):# 相关APK文件路径        self.srcApkPath= srcApk.resolve() # 解析为绝对路径        self.shellApkPath= shellApk.resolve()        self.newApkPath= outputApk.resolve()# 临时目录 以该脚本文件父目录为根目录        self.tmpdir= Path(__file__).parent/'temp'        self.srcApkTempDir=  self.tmpdir/ 'srcApkTemp'        self.shellApkTempDir= self.tmpdir/'shellApkTemp'        self.newApkTempDir= self.tmpdir/ 'newApkTemp'# Apktool类,通过subprocess调用其他工具 提供解包,打包,签名,抽取代码功能class Apktool:def __init__(self):        self.apktool_path= Path(__file__).parent/'tools/apktool/apktool.bat'        self.signer_path=Path(__file__).parent/'tools/uber-apk-signer-1.3.0.jar'        self.readDex_path=Path(__file__).parent/'tools/ReadDex.exe'# 为apk签名def signApk(self,unsignedApkPath:Path):        self.runCommand(['java','-jar', self.signer_path, '--apk',unsignedApkPath])# 使用apktool解包apk 只解包资源得到AndroidManifest.xml 不需要解包dex文件得到smali def unpackApk(self,apkPath:Path, outputDir:Path):        self.runCommand([self.apktool_path, '-s', 'd' , apkPath, '-o', outputDir])# 重打包apkdef repackApk(self,inputDir:Path, outApk:Path):        self.runCommand([self.apktool_path, 'b' , inputDir, '-o', outApk])# 抽取指定dex文件的代码def extractDexCodes(self,dexPath:Path):# 调用ReadDex.exe抽取dex文件代码,输出到同级目录 例如classes.dex抽取后生成classes.dex.patched和classes.dex.codes        self.runCommand([self.readDex_path,'-file',  dexPath, '-extractCodes'])# 执行命令def runCommand(self,args):#subprocess.run(args)        subprocess.run(args,stdout=subprocess.DEVNULL) #仅调用工具,不需要额外输出,重定向stdout到os.devnull# 参数列表 捕获输出 输出转为字符串#print(subprocess.run(args,  capture_output=True,text=True).stdout)# AndroidManifest.xml的editor 用于获取和修改标签属性,以及添加标签class ManifestEditor:def __init__(self, xml_content: bytes):        self.ns = {'android': 'http://schemas.android.com/apk/res/android'}        self.tree = etree.fromstring(xml_content)# 获取指定标签的android属性值 examples: get_attr('application', 'name') get_attr('activity', 'name')def getTagAttribute(self, tag_name: str, attr_name: str):if tag_name == 'manifest':  # 根标签特殊处理            elem = self.treeif elem is not None:return elem.get(f'{attr_name}')  # 寻找标签的属性else:            elem = self.tree.find(f'.//{tag_name}', namespaces=self.ns)if elem is not None:return elem.get(f'{{{self.ns["android"]}}}{attr_name}')  # 根标签之外的属性位于android命名空间下return None# 设置指定标签的属性值 example:s et_attr('application','name',"com.example.ProxyApplication")def setTagAttribute(self, tag_name: str, attr_name: str, new_value: str):if tag_name == 'manifest':  # 根标签特殊处理            elem = self.treeif elem is not None:return elem.set(f'{attr_name}', new_value)  # 设置属性值else:            elem = self.tree.find(f'.//{tag_name}', namespaces=self.ns)if elem is not None:                elem.set(f'{{{self.ns["android"]}}}{attr_name}', new_value)return Truereturn False# 在指定父标签下添加新子标签 example: add_tag('application',"meta-data",{'name': 'android.permission.CAMERA','value':'hello'})def addTagWithAttributes(self, parent_tag: str, new_tag: str, attrs: dict):if parent_tag == 'manifest':            parent = self.treeif parent is not None:                new_elem = etree.SubElement(parent, new_tag)for k, v in attrs.items():  # 支持一次给添加的标签设置多个属性                    new_elem.set(f'{k}', v)return Trueelse:            parent = self.tree.find(f'.//{parent_tag}', namespaces=self.ns)if parent is not None:                new_elem = etree.SubElement(parent, new_tag)for k, v in attrs.items():                    new_elem.set(f'{{{self.ns["android"]}}}{k}', v)return Truereturn False# 不以壳manifest为基准操作则用不到该函数,以源apk的manifest为基准自带,无需额外设置def getMainActivity(self):        activities = self.tree.findall('.//activity', namespaces=self.ns)for activity in activities:            intent_filters = activity.findall('.//intent-filter', namespaces=self.ns)for intent_filter in intent_filters:                action = intent_filter.find('.//action[@android:name="android.intent.action.MAIN"]', namespaces=self.ns)                category = intent_filter.find('.//category[@android:name="android.intent.category.LAUNCHER"]',                                              namespaces=self.ns)if action is not None and category is not None:return activity.get(f'{{{self.ns["android"]}}}name')return None# 获取application标签的name属性值def getApplicationName(self):return self.getTagAttribute('application', 'name')# 设置application标签的name属性值def setApplicationName(self, application: str):        self.setTagAttribute('application', 'name', application)# 添加meta-data标签,并设置name和value属性值def addMetaData(self, name: str, value: str):        self.addTagWithAttributes('application', 'meta-data', {'name': name, 'value': value})# 获取AndroidManifest.xml的字符串def getManifestData(self):"""返回XML字符串"""return etree.tostring(self.tree, pretty_print=True, encoding='utf-8', xml_declaration=True).decode()# 获取application标签的extractNativeLibs属性值def getEtractNativeLibs(self):return self.getTagAttribute('application', 'extractNativeLibs')# 设置application标签的extractNativeLibs属性值为truedef resetExtractNativeLibs(self):        self.setTagAttribute('application', 'extractNativeLibs', 'true')# 工具函数,注意修复时顺序为: fileSize->signature->checksum# 修复dex文件的checksumdef fixCheckSum(dexBytes:bytearray):# dexfile[8:12] 小端序4字节    value = adler32(bytes(dexBytes[12:]))    valueArray = bytearray(value.to_bytes(4, 'little'))for i in range(len(valueArray)):        dexBytes[8 + i] = valueArray[i]# 修复dex文件的signaturedef fixSignature(dexBytes:bytearray):# dexfile[12:32] 小端序20字节    sha_1 = sha1()    sha_1.update(bytes(dexBytes[32:]))    value = sha_1.hexdigest()    valueArray = bytearray(unhexlify(value))for i in range(len(valueArray)):        dexBytes[12 + i] = valueArray[i]# 修复dex文件的filesizedef fixFileSize(dexBytes:bytearray, fileSize):# dexfile[32:36] 小端存储    fileSizeArray = bytearray(fileSize.to_bytes(4, "little"))for i in range(len(fileSizeArray)):        dexBytes[32 + i] = fileSizeArray[i]# 加密函数,使用异或def encrypt(data:bytearray):# todo:使用aes/sm4等加密算法替代for i in range(len(data)):        data[i] ^= 0xffreturn data# 抽取指定目录下的所有dex文件的代码 patch所有dex文件并修复,将codes文件移动到assets目录下def extractAllDexFiles(directory:Path):    apktool=Apktool()# 1.遍历目录下的所有dex文件,并抽取对应代码for dex in directory.glob('classes*.dex'):        apktool.extractDexCodes(dex) # 抽取dex文件代码 得到classes*.dex.patched和classes*.dex.codes# 2.修复抽取后的文件并覆写原dex文件for patchedDex in directory.glob('classes*.dex.patched'):        newDexName = str(patchedDex).replace('.patched', '') # 重命名# 读取文件内容with open(patchedDex, 'rb') as f:            data = bytearray(f.read())# 修复signature和checksum,注意先后顺序            fixSignature(data)            fixCheckSum(data)# 修复后的文件覆写原dex文件with open(newDexName, 'wb') as newf:                newf.write(data)# 3.删除patched文件for patchedDex in directory.glob('classes*.dex.patched'):        patchedDex.unlink()# 4.移动.codes文件到assets目录下# 如果没有assets目录则创建if not (directory/'assets').exists():        (directory/'assets').mkdir(parents=True)for codes in directory.glob('classes*.dex.codes'):        shutil.move(codes,directory/'assets'/codes.name) # 移动到assets目录下# 合并壳dex和源apk的dex,支持多dex文件,合并为一个dexdef combineShellAndSourceDexs(shellApkTempDir:Path,srcApkTempDir:Path,newApkTempDir:Path):# 读取解包后的apk的所有dex文件,并合并为一个dex文件def readAndCombineDexs(unpackedApkDir:Path):        combinedDex = bytearray()# glob方法返回包含所有匹配文件的生成器for dex in unpackedApkDir.glob('classes*.dex'):print('Source Apk Dex file:', dex)with open(dex, 'rb') as f:                data = bytearray(f.read())                combinedDex+=bytearray(len(data).to_bytes(4, 'little'))  # dex文件的长度,小端序                combinedDex+=data # dex文件内容return combinedDex# 获取shelldexwith open(shellApkTempDir/'classes.dex', 'rb') as f:        shellDexArray=bytearray(f.read())# 获取源apk的dex文件    srcDexArray = readAndCombineDexs(srcApkTempDir)# 新的dex文件长度    newDexLen = len(srcDexArray) + len(shellDexArray) + 4# 加密源文件    encSrcDexArray = encrypt(srcDexArray)# 新的dex文件内容 = 壳dex + 加密的源dex + 四字节标识加密后源dex大小长度    newDexArray = shellDexArray + encSrcDexArray  + bytearray(len(encSrcDexArray).to_bytes(4, 'little'))# 修改filesize    fixFileSize(newDexArray, newDexLen)# 修改signature    fixSignature(newDexArray)# 修改checksum    fixCheckSum(newDexArray) # 注意先后顺序,先修改signature,再修改checksum# 导出文件with open(newApkTempDir/'classes.dex', 'wb') as f:        f.write(newDexArray)# 提取源apk的Manifest文件,修改application为壳application(可能添加meta-data标签),输出新的Manifest文件def handleManifest(srcApkTempDir:Path,shellApkTempDir:Path,newApkTempDir:Path):# 从源apk提取AndroidManifest.xmlwith open(srcApkTempDir/'AndroidManifest.xml', 'r') as f:        srcManifestEditor=ManifestEditor(f.read().encode())    srcApplication=srcManifestEditor.getApplicationName()           # 获取application:name,确定是否存在自定义Application类    srcExtractNativeLibs=srcManifestEditor.getEtractNativeLibs()    # 获取application:extractNativeLibs,判断是否释放lib文件print('SourceApplication:',srcApplication)print('SourceExtractNativeLibs:',srcExtractNativeLibs)# 从壳apk提取AndroidManifest.xmlwith open(shellApkTempDir/'AndroidManifest.xml', 'r') as f:        shellManifestEditor=ManifestEditor(f.read().encode())print('ShellApplication:',shellManifestEditor.getApplicationName())# 修改源AndroidManifest.xml的application为壳的代理application    srcManifestEditor.setApplicationName(shellManifestEditor.getApplicationName())# 写入meta-data标签 保存源apk的原始applicationif srcApplication != None:print('Source application:',srcApplication)        srcManifestEditor.addMetaData('APPLICATION_CLASS_NAME',srcApplication)# 如果源apk的manifest中默认设置etractNativeLibs=false,则重置为true,确保释放lib文件if srcExtractNativeLibs=='false':        srcManifestEditor.resetExtractNativeLibs() # 输出新的AndroidManifest.xmlwith open(newApkTempDir/'AndroidManifest.xml', 'w') as f:        f.write(srcManifestEditor.getManifestData())# 执行加固流程def start(paths:Paths):    apktool=Apktool()# 1.分别解包源文件和壳文件到临时目录print('Extracting source and shell apk...')    apktool.unpackApk(paths.srcApkPath,paths.srcApkTempDir)print('Extract source apk success!')print('Extracting shell apk...')    apktool.unpackApk(paths.shellApkPath,paths.shellApkTempDir)print('Extract shell apk success!')# 2.抽取源dex文件代码print('Exrtracting dex files codes...')    extractAllDexFiles(paths.srcApkTempDir) print('Extract dex files codes success!')# 3.复制源apk所有文件到新apk临时目录中 忽略源dex和manifest文件print('Copying source apk files to new apk temp dir...')    shutil.copytree(paths.srcApkTempDir,paths.newApkTempDir,ignore=shutil.ignore_patterns('AndroidManifest.xml','classes*.dex')) print('Copy source apk files success!')# 4.复制壳apk的lib库文件到新apk临时目录中 （壳的代码回填逻辑在lib中实现）print('Copying shell apk lib files to new apk temp dir...')    shutil.copytree(paths.shellApkTempDir/'lib',paths.newApkTempDir/'lib',dirs_exist_ok=True) # dirs_exist_ok=True 如果目标目录已存在,则覆盖print('Copy shell apk lib files success!')# 5.处理AndroidManifest.xmlprint('Handling AndroidManifest.xml...')    handleManifest(paths.srcApkTempDir,paths.shellApkTempDir,paths.newApkTempDir)print('Handle AndroidManifest.xml success!')# 6.合并壳dex和源apk的dex并导出文件print('Combining shell dex and source dexs...')    combineShellAndSourceDexs(paths.shellApkTempDir,paths.srcApkTempDir,paths.newApkTempDir)print('Combine shell dex and source dexs success!')# 7.重打包apkprint('Repacking apk...')    apktool.repackApk(paths.newApkTempDir,paths.newApkPath)print('Repack apk success!')# 8.签名apkprint('Signing apk...')    apktool.signApk(paths.newApkPath)print('Resign apk success!')# 9.删除临时目录print('Deleting temp directories...')    shutil.rmtree(paths.tmpdir) print('Delete temp directories success!')def main():    parser = argparse.ArgumentParser(description="Android APK Packer")    parser.add_argument('-src','--src-apk', required=True, type=Path, help='Path to source APK file')    parser.add_argument('-shell','--shell-apk', required=True, type=Path, help='Path to shell APK file')    parser.add_argument('-o','-out','--output-apk',type=Path,help='Output path for packed APK (Default: ./out/<src-apk>_protected.apk)')    args = parser.parse_args()if args.output_apk == None:        args.output_apk = Path('./out')/(args.src_apk.stem+'_protected.apk') # 默认新apk名称及输出路径    paths = Paths(args.src_apk, args.shell_apk, args.output_apk)print('Source APK:', paths.srcApkPath)print('Shell APK:', paths.shellApkPath)print('Output APK:', paths.newApkPath)    start(paths)if __name__=="__main__":    main()

package com.example.androidshell;import android.app.Application;import android.app.Instrumentation;import android.content.Context;import android.content.pm.ApplicationInfo;import android.content.pm.PackageManager;import android.content.res.AssetManager;import android.os.Bundle;import android.util.ArrayMap;import android.util.Log;import java.io.BufferedInputStream;import java.io.BufferedOutputStream;import java.io.ByteArrayOutputStream;import java.io.File;import java.io.FileInputStream;import java.io.FileOutputStream;import java.io.IOException;import java.io.InputStream;import java.lang.ref.WeakReference;import java.nio.ByteBuffer;import java.nio.ByteOrder;import java.util.ArrayList;import java.util.Iterator;import java.util.zip.ZipEntry;import java.util.zip.ZipInputStream;import dalvik.system.DexClassLoader;public class ThirdProxyApplication extends Application {private final String TAG="glass";private String dexPath;private String odexPath;private String libPath;public void log(String message){Log.d(TAG,message);}@Overrideprotected void attachBaseContext(Context base) {super.attachBaseContext(base);        log("ThirdProxyApplication.attachBaseContext is running!");        System.loadLibrary("androidshell");     //主动加载so,设置hook,进行指令回填        log("Load libandroidshell.so succeed!");try {//初始化相关环境            initEnvironments();//配置加载源程序的动态环境,即替换mClassLoader            replaceClassLoader();        } catch (Exception e) {            log( Log.getStackTraceString(e));        }    }@Overridepublic void onCreate() {super.onCreate();        log("ThirdProxyApplication.onCreate is running!");if(replaceApplication())            log("Replace Application succeed!");    }private void initEnvironments() throws IOException {//1.设置相关目录和路径Filedex = getDir("tmp_dex", MODE_PRIVATE);     // 私有目录,存放dex文件//File lib = getDir("tmp_lib", MODE_PRIVATE);       // lib可使用默认目录//libPath = lib.getAbsolutePath();        odexPath = dex.getAbsolutePath();        libPath=this.getApplicationInfo().nativeLibraryDir; //默认lib路径        dexPath =this.getApplicationInfo().sourceDir;   //当前base.apk路径//2.从当前base.apk读取classes.dex并读取为字节数组byte[] shellDexData = readDexFromApk();        log("Get classes.dex from base.apk succeed!");//3.从壳dex文件中分离出源dex文件        ByteBuffer[] byteBuffers = extractDexFilesFromShellDex(shellDexData);//4.将源dex文件依次写入私有目录        writeByteBuffersToDirectory(byteBuffers, odexPath);//5.将codes文件依次写入私有目录        copyClassesCodesFiles(this, odexPath);//6.拼接dex目录字符串,设置dex文件路径 DexClassLoader支持传递多个dex文件路径以加载多个dex文件,通过':'分隔路径        StringBuffer dexFiles=new StringBuffer();for(File file:dex.listFiles()){if(file.getName().contains(".codes"))continue;            dexFiles.append(file.getAbsolutePath());            dexFiles.append(":");        }        dexPath=dexFiles.toString();    }private void writeByteBuffersToDirectory(ByteBuffer[] byteBuffers, String directoryPath) throws IOException {// 创建目录对象Filedirectory =new File(directoryPath);// 检查目录是否存在,不存在则创建if (!directory.exists()) {if (!directory.mkdirs()) {throw new IOException("无法创建目录: " + directoryPath);            }        }// 遍历 ByteBuffer 数组for (inti =0; i < byteBuffers.length; i++) {// 生成文件名            String fileName;if (i == 0) {                fileName = "classes.dex";            } else {                fileName = "classes" + (i + 1) + ".dex";            }// 构建文件对象Filefile =new File(directory, fileName);// 创建文件输出流try (FileOutputStreamfos =new FileOutputStream(file)) {// 获取 ByteBuffer 中的字节数组ByteBufferbuffer = byteBuffers[i];byte[] bytes = new byte[buffer.remaining()];                buffer.get(bytes);// 将字节数组写入文件                fos.write(bytes);            }        }    }private void copyClassesCodesFiles(Context context, String targetDirectoryPath) {AssetManagerassetManager = context.getAssets();try {// 获取 assets 目录下的所有文件和文件夹            String[] files = assetManager.list("");if (files != null) {// 创建目标目录FiletargetDirectory =new File(targetDirectoryPath);if (!targetDirectory.exists()) {if (!targetDirectory.mkdirs()) {throw new IOException("无法创建目标目录: " + targetDirectoryPath);                    }                }for (String fileName : files) {// 筛选以 classes 开头且以 .codes 结尾的文件if (fileName.startsWith("classes") && fileName.endsWith(".codes")) {try (InputStreaminputStream = assetManager.open(fileName);BufferedInputStreambis =new BufferedInputStream(inputStream);FileOutputStreamfos =new FileOutputStream(new File(targetDirectory, fileName));BufferedOutputStreambos =new BufferedOutputStream(fos)) {byte[] buffer = new byte[1024];int bytesRead;while ((bytesRead = bis.read(buffer)) != -1) {                                bos.write(buffer, 0, bytesRead);                            }                        } catch (IOException e) {                            e.printStackTrace();                        }                    }                }            }        } catch (IOException e) {            e.printStackTrace();        }    }// 从壳dex文件中提取源apk的dex并封装为ByteBufferprivate ByteBuffer[] extractDexFilesFromShellDex(byte[] shellDexData) {intshellDexlength = shellDexData.length;//开始解析dex文件byte[] sourceDexsSizeByte = new byte[4];//读取源dexs的大小        System.arraycopy(shellDexData,shellDexlength - 4, sourceDexsSizeByte,0,4);//转成bytebuffer,方便4byte转intByteBufferwrap = ByteBuffer.wrap(sourceDexsSizeByte);//将byte转成int, 加壳时,长度按小端存储intsourceDexsSizeInt = wrap.order(ByteOrder.LITTLE_ENDIAN).getInt();        Log.d(TAG, "源dex集合的大小: " + sourceDexsSizeInt);//读取源dexsbyte[] sourceDexsData = new byte[sourceDexsSizeInt];        System.arraycopy(shellDexData,shellDexlength - sourceDexsSizeInt - 4, sourceDexsData, 0, sourceDexsSizeInt);//解密源dexs        sourceDexsData = decrypt(sourceDexsData);//更新部分//从源dexs中分离dex        ArrayList<byte[]> sourceDexList = new ArrayList<>();intpos =0;while(pos < sourceDexsSizeInt){//先提取四个字节,描述当前dex的大小//开始解析dex文件byte[] singleDexSizeByte = new byte[4];//读取源dexs的大小            System.arraycopy(sourceDexsData, pos, singleDexSizeByte,0,4);//转成bytebuffer,方便4byte转intByteBuffersingleDexwrap = ByteBuffer.wrap(singleDexSizeByte);intsingleDexSizeInt = singleDexwrap.order(ByteOrder.LITTLE_ENDIAN).getInt();            Log.d(TAG, "当前Dex的大小: " + singleDexSizeInt);//读取单独dexbyte[] singleDexData = new byte[singleDexSizeInt];            System.arraycopy(sourceDexsData,pos + 4, singleDexData, 0, singleDexSizeInt);//加入到dexlist中            sourceDexList.add(singleDexData);//更新pos            pos += 4 + singleDexSizeInt;        }//将dexlist包装成ByteBufferintdexNum = sourceDexList.size();        Log.d(TAG, "源dex的数量: " + dexNum);        ByteBuffer[] dexBuffers = new ByteBuffer[dexNum];for (inti =0; i < dexNum; i++){            dexBuffers[i] = ByteBuffer.wrap(sourceDexList.get(i));        }return dexBuffers;    }// 从当前程序的apk读取dex文件并存储为字节数组private byte[] readDexFromApk() throws IOException {//1.获取当前应用程序的源码路径(apk),一般是data/app目录下,该目录用于存放用户安装的软件StringsourceDir =this.getApplicationInfo().sourceDir;        log("this.getApplicationInfo().sourceDir: " +sourceDir);//2.创建相关输入流FileInputStreamfileInputStream =new FileInputStream(sourceDir);BufferedInputStreambufferedInputStream =new BufferedInputStream(fileInputStream);ZipInputStreamzipInputStream =new ZipInputStream(bufferedInputStream); //用于解析apk文件ByteArrayOutputStreambyteArrayOutputStream =new ByteArrayOutputStream(); //用于存放dex文件//3.遍历apk的所有文件并提取dex文件        ZipEntry zipEntry;while((zipEntry = zipInputStream.getNextEntry()) != null){ //存在下一个文件// 将classes.dex文件存储到bytearray中 壳dex和源apk合并后只保留一个dex便于处理if (zipEntry.getName().equals("classes.dex")){byte[] bytes = new byte[1024];int num;while((num = zipInputStream.read(bytes))!=-1){      //每次读取1024byte,返回读取到的byte数                    byteArrayOutputStream.write(bytes,0, num); //存放到开辟的byteArrayOutputStream中                }            }            zipInputStream.closeEntry(); //关闭当前文件        }        zipInputStream.close();        log("Read dex from apk succeed!");return byteArrayOutputStream.toByteArray(); //将读取到的dex文件以字节数组形式返回    }// 解密private byte[] decrypt(byte[] data) {for (inti =0; i < data.length; i++){            data[i] ^= (byte) 0xff;        }return data;    }//替换壳程序LoadedApk的Application为源程序Application,并调用其onCreate方法private booleanreplaceApplication(){// Application实例存在于: LoadedApk.mApplication// 以及ActivityThread的mInitialApplication和mAllApplications和mBoundApplication//判断源程序是否使用自定义Application 若使用则需要进行替换,若未使用则直接返回,使用壳的默认Application即可StringappClassName =null; //源程序的Application类名try {//获取AndroidManifest.xml 文件中的 <meta-data> 元素ApplicationInfoapplicationInfo = getPackageManager().getApplicationInfo(this.getPackageName(), PackageManager.GET_META_DATA);BundlemetaData = applicationInfo.metaData;//获取xml文件声明的Application类if (metaData != null && metaData.containsKey("APPLICATION_CLASS_NAME")){                appClassName = metaData.getString("APPLICATION_CLASS_NAME");            } else {                log("源程序中没有自定义Application");return false; //如果不存在直接返回,使用壳的application即可            }        } catch (PackageManager.NameNotFoundException e) {            log(Log.getStackTraceString(e));        }//源程序存在自定义application类,开始替换        log("Try to replace Application");//1.反射获取ActivityThread实例ObjectsCurrentActivityThreadObj = Reflection.getStaticField("android.app.ActivityThread","sCurrentActivityThread");        log("ActivityThread: " + sCurrentActivityThreadObj.toString());//2.获取并设置LoadedApk//获取mBoundApplication (AppBindData对象)ObjectmBoundApplicationObj = Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mBoundApplication") ;        log("mBoundApplication: "+mBoundApplicationObj.toString());//获取mBoundApplication.info (即LoadedApk)ObjectinfoObj = Reflection.getField("android.app.ActivityThread$AppBindData",mBoundApplicationObj,"info");        log( "LoadedApk: " + infoObj.toString());//把LoadedApk的mApplication设置为null,这样后续才能调用makeApplication() 否则由于已存在Application,无法进行替换        Reflection.setField("android.app.LoadedApk","mApplication",infoObj,null);//3.获取ActivityThread.mInitialApplication 即拿到旧的Application(对于要加载的Application来讲)ObjectmInitialApplicationObj = Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mInitialApplication");        log("mInitialApplicationObj: " + mInitialApplicationObj.toString());//4.获取ActivityThread.mAllApplications并删除旧的application        ArrayList<Application> mAllApplicationsObj = (ArrayList<Application>) Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mAllApplications");        mAllApplicationsObj.remove(mInitialApplicationObj);        log("mInitialApplication 从 mAllApplications 中移除成功");//5.重置相关类的Application类名 便于后续创建Application//获取LoadedApk.mApplicationInfoApplicationInfoapplicationInfo = (ApplicationInfo) Reflection.getField("android.app.LoadedApk",infoObj,"mApplicationInfo");        log( "LoadedApk.mApplicationInfo: " + applicationInfo.toString());//获取mBoundApplication.appInfoApplicationInfoappinfoInAppBindData = (ApplicationInfo) Reflection.getField("android.app.ActivityThread$AppBindData",mBoundApplicationObj,"appInfo");        log("ActivityThread.mBoundApplication.appInfo: " + appinfoInAppBindData.toString());//此处通过引用修改值,虽然后续没有使用,但是实际上是修改其指向的LoadedApk相关字段的值//设置两个appinfo的classname为源程序的application类名,以便后续调用makeApplication()创建源程序的application        applicationInfo.className = appClassName;        appinfoInAppBindData.className = appClassName;        log("Source Application name: " + appClassName);//6.反射调用makeApplication方法创建源程序的applicationApplicationapplication = (Application) Reflection.invokeMethod("android.app.LoadedApk","makeApplication",infoObj,new Class[]{boolean.class, Instrumentation.class},new Object[]{false,null}); //使用源程序中的application//Application app = (Application)ReflectionMethods.invokeMethod("android.app.LoadedApk","makeApplication",infoObj,new Class[]{boolean.class, Instrumentation.class},new Object[]{true,null}); //使用自定义的application 强制为系统默认        log("Create source Application succeed: "+application);//7.重置ActivityThread.mInitialApplication为新的Application        Reflection.setField("android.app.ActivityThread","mInitialApplication",sCurrentActivityThreadObj,application);        log("Reset ActivityThread.mInitialApplication by new Application succeed!");//8.ContentProvider会持有代理的Application,需要特殊处理一下ArrayMapmProviderMap = (ArrayMap) Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mProviderMap");        log("ActivityThread.mProviderMap: " + mProviderMap);//获取所有provider,装进迭代器中遍历Iteratoriterator = mProviderMap.values().iterator();while(iterator.hasNext()){ObjectproviderClientRecord = iterator.next();//获取ProviderClientRecord.mLocalProvider,可能为空ObjectmLocalProvider = Reflection.getField("android.app.ActivityThread$ProviderClientRecord",providerClientRecord,"mLocalProvider") ;if(mLocalProvider != null){                log("ProviderClientRecord.mLocalProvider: " + mLocalProvider);//获取ContentProvider中的mContext字段,设置为新的Application                Reflection.setField("android.content.ContentProvider","mContext",mLocalProvider,application);            }        }        log( "Run Application.onCreate" );        application.onCreate(); //源程序,启动!return true;    }// 替换壳App的ClassLoader为源App的ClassLoaderprivate void replaceClassLoader() {//1.获取当前的classloaderClassLoaderclassLoader =this.getClassLoader();        log("Current ClassLoader: " + classLoader.toString());        log("Parent ClassLoader: " + classLoader.getParent().toString());//2.反射获取ActivityThreadObjectsCurrentActivityThreadObj = Reflection.getStaticField("android.app.ActivityThread","sCurrentActivityThread");        log("ActivityThread.sCurrentActivityThread: " + sCurrentActivityThreadObj.toString());//3.反射获取LoadedApk//获取当前ActivityThread实例的mPackages字段 类型为ArrayMap<String, WeakReference<LoadedApk>>, 里面存放了当前应用的LoadedApk对象ArrayMapmPackagesObj = (ArrayMap) Reflection.getField("android.app.ActivityThread",sCurrentActivityThreadObj,"mPackages");        log( "mPackagesObj: " + mPackagesObj.toString());//获取mPackages中的当前应用包名StringcurrentPackageName =this.getPackageName();        log("currentPackageName: " + currentPackageName);// 获取loadedApk实例也有好几种,mInitialApplication mAllApplications mPackages// 通过包名获取当前应用的loadedApk实例WeakReferenceweakReference = (WeakReference) mPackagesObj.get(currentPackageName);ObjectloadedApkObj = weakReference.get();        log( "LoadedApk: " + loadedApkObj.toString());//4.替换ClassLoaderDexClassLoaderdexClassLoader =new DexClassLoader(dexPath, odexPath,libPath, classLoader.getParent()); //动态加载源程序的dex文件,以当前classloader的父加载器作为parent        Reflection.setField("android.app.LoadedApk","mClassLoader",loadedApkObj,dexClassLoader); //替换当前loadedApk实例中的mClassLoader字段        log("New DexClassLoader: " + dexClassLoader);    }}