[Andriod] APK 編譯/反編譯工具指南

Intro

APK (Android application package) - Wikipedia


工具 - Tools


實作

反編譯 - Decomplie

  1. 確認Mobile裝置連接上電腦OS (USB debugging on),可以透過adb devices查詢:

    $ adb devices
    
    List of devices attached
    emulator-1234   device
  2. 列出並找到該裝置上所安裝的app:

    $ adb shell pm list packages
    
    $ adb shell pm list packages | grep "appname" -i
    package:com.appname.andriod

    對應Play Store的package name可以參考網址ID參數https://play.google.com/store/apps/details?id=com.appname.andriod

  3. 知道app名稱後,利用adb shell pm path 查出package路徑:

    $ adb shell pm path com.appname.andriod
    
    package:/data/app/~~ufyPM_R_wxl2R0wWj-sA5B==/com.appname.andriod-b6Vvzl4uVnfCEwaEypQ3-x==/base.apk
  4. 利用adb pull抓出package:

    $ adb pull /data/app/~~ufyPM_R_wxl2R0wWj-sA5B==/com.appname.andriod-b6Vvzl4uVnfCEwaEypQ3-x==/base.apk
  5. 取得APK後,即可透過apktool d來反編譯:

    $ apktool d base.apk

    -r,--no-res Do not decode resources.

修改 - Modification

這裡示範一個將app修改開啟Webview debug(setWebContentsDebuggingEnabled)再重新編譯回去安裝使用的情境。

  1. 從apk根目錄中AndroidManifest.xml檔案找出android.intent.category.LAUNCHER所在的activity,即可從其android:name確認launcher class位置

    <activity android:exported="true" android:name="com.appname.andriod.modules.launch.LaunchActivity" ...>
        <intent-filter>
            <action android:name="android.intent.action.MAIN"/>
            <category android:name="android.intent.category.LAUNCHER"/>
        </intent-filter>
    </activity>
  2. 編輯該launcher class的smali檔案,將啟用debug的smali code加入至onCreate function中,可以加在return之前

    const/4 v2, 0x1
    invoke-static {v2}, Landroid/webkit/WebView;->setWebContentsDebuggingEnabled(Z)V

    舉例(apk\smali\com\appname\android\modules\launch\LaunchActivity.smali):

    # virtual methods
    .method public final onCreate(Landroid/os/Bundle;)V
        .locals 4
    
        .line 1
        ...
        .line 19
    
        const/4 v2, 0x1
        invoke-static {v2}, Landroid/webkit/WebView;->setWebContentsDebuggingEnabled(Z)V
        return-void
        .line 20
    .end method

編譯 - Compile

  1. 透過apktool b編譯

    $ apktool b base/ -o new_app.apk

    --use-aapt2 parameter for invalid resource error

  2. 透過Uber Apk Signer簽章app

    $ java -jar uber-apk-signer.jar --apks new_app.apk
    ...
    VERIFY
    file: ./new_app-aligned-debugSigned.apk...
    
    # Multiple packages app 簽章
    $ java -jar uber-apk-signer.jar --apks new_app.apk config.arm64.apk
  3. 透過adb install安裝app回裝置上

    $ adb install new_app-aligned-debugSigned.apk
    
    # Multiple packages app 安裝
    $ adb install-multiple base.apk config.arm64.apk

Reference

Leave a Reply

Your email address will not be published. Required fields are marked *