WindySha / Xpatch

This is a tool to repackage apk file, then the apk can load any xposed modules installed in the device. It is another way to hook an app without root device.
Apache License 2.0
2.58k stars 393 forks source link

貌似会火,加油加油,提个issue,支持加固的apk #14

Open lanshifu opened 5 years ago

lanshifu commented 5 years ago

加固的应用应该是有办法二次打包的,我在太极里面选了一个加固的应用,二次打包成功,安装正常打开。大牛研究研究,我等好好学习~

lanshifu commented 5 years ago

$java -jar xpatch-1.3.jar -l fanqie.apk

currentDir = /Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs/. apkPath = fanqie.apk !!!!! output apk path --> fanqie-xposed-signed.apk disableCrackSignature --> false !!!!! srcApkFileParentPath = /Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs unzipApkFilePath = /Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs/2019-05-21-20-56-59-tmp/fanqie-apk-unzip-files/ getApkSignInfo result --> [ [ Version: V3 Subject: CN=12 Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

Key: Sun RSA public key, 2048 bits modulus: 24130348069396996362624358114703898744403401279187759308920046538000401438493568046418974753742225818403940818620744243876555870569372401030779168301841553649911865500498018992293002096033009687798785769446059251931404949992709561316046439257789885600737436804779782306023631574333084879614563213480684625669588111934960610556807250314745225930801306633098867523889870299554800692659594104929884390787149034426864508811861123468729443035067826559436899445756406136861777830795268275636858855125755751950910351900984073252170012623829240873451097190216886312067356420315474459012868388486955185414259543218098165294633 public exponent: 65537 Validity: [From: Sat Mar 24 22:59:15 CST 2018, To: Wed Mar 18 22:59:15 CST 2043] Issuer: CN=12 SerialNumber: [ 2c39e908]

Certificate Extensions: 1 [1]: ObjectId: 2.5.29.14 Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: 4D 6A 08 8A 8F AE 59 CC DA B8 06 54 2D AB 13 F4 Mj....Y....T-... 0010: CD 4E 9A 3A .N.: ] ]

] Algorithm: [SHA256withRSA] Signature: 0000: 36 4D 84 C7 DD D9 AC 1E 1E A0 E1 ED B8 0A 38 3D 6M............8= 0010: 00 5F 58 59 13 50 E4 11 B4 43 EA 14 B6 0C A5 CE ._XY.P...C...... 0020: 58 BA 96 CD 40 F3 D1 BF 00 A4 CE 0E EF 96 F7 83 X...@........... 0030: 6D 5C CA 0E 30 02 FA B1 E3 70 9D 3E D2 E2 C5 EE m..0....p.>.... 0040: 7D 46 17 10 9B B7 04 5C 06 A5 47 56 6C 60 14 E1 .F.......GVl`.. 0050: 5E 32 15 53 15 8F F1 3C 1D 49 F6 85 69 BA EC 8C ^2.S...<.I..i... 0060: 14 12 10 CA 8D 2A C1 FB 32 1D 5A AF 04 79 2F B2 .......2.Z..y/. 0070: 50 85 5E 7D 91 DE C4 0A 4C 8B BA DF 83 21 15 F8 P.^.....L....!.. 0080: DE C3 8F A9 9F A0 9E C8 3D 02 2E 53 39 5D 5C 05 ........=..S9]. 0090: A3 15 B4 63 E4 7A 7A CB 48 2F 03 4D B4 B9 B8 86 ...c.zz.H/.M.... 00A0: E1 34 ED C2 CC 03 A7 5B 9C 1D EF 3B 72 9F A8 38 .4.....[...;r..8 00B0: 7D 57 2E 1C 1B BA BC F5 1C D6 E5 26 5B 2A 18 57 .W.........&[.W 00C0: AD 93 53 40 B3 14 96 1B 1F 78 09 C4 1E B8 48 C9 ..S@.....x....H. 00D0: 73 BC A6 43 80 6F 8A 32 ED D3 FA E4 FF 45 A0 2D s..C.o.2.....E.- 00E0: 6B 23 4C 82 96 67 39 21 DD 65 E8 69 AB 48 D9 D7 k#L..g9!.e.i.H.. 00F0: 7E E8 4E 29 67 53 79 DC A8 53 5B E7 6E 42 6C 46 ..N)gSy..S[.nBlF

] --- dexFileCount = 1 Get the application name --> com.tencent.StubShell.TxAppEntry dex2JarCmd modify code , filePath = /Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs/2019-05-21-20-56-59-tmp/fanqie-apk-unzip-files/classes.dex, applicationName= com.tencent.StubShell.TxAppEntry dex2jar /Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs/2019-05-21-20-56-59-tmp/fanqie-apk-unzip-files/classes.dex -> /Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs/2019-05-21-20-56-59-tmp/output-jar.jar baseName =classes isApplicationClassFounded -> truethe dexPath is /Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs/2019-05-21-20-56-59-tmp/fanqie-apk-unzip-files/classes.dex the application class is in this dex file = classes.dex jar2dex /Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs/2019-05-21-20-56-59-tmp/output-jar.jar -> /Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs/2019-05-21-20-56-59-tmp/fanqie-apk-unzip-files/classes.dex call com.android.dx.command.Main.main[--dex, --no-strict, --output=/Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs/2019-05-21-20-56-59-tmp/fanqie-apk-unzip-files/classes.dex, /Users/lanshifu/Documents/android_work_space/Xpatch-master/xpatch/build/libs/2019-05-21-20-56-59-tmp/output-jar.jar] sign apk time is :6s

result=jar 已签名。

警告: 未提供 -tsa 或 -tsacert, 此 jar 没有时间戳。如果没有时间戳, 则在签名者证书的到期日期 (2044-01-25) 或以后的任何撤销日期之后, 用户可能无法验证此 jar。

2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] JNI DETECTED ERROR IN APPLICATION: obj == null 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] in call to GetObjectField 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] from void com.tencent.StubShell.TxAppEntry.load(android.content.Context) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] "main" prio=5 tid=1 Runnable 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] | group="main" sCount=0 dsCount=0 flags=0 obj=0x7537cd60 self=0xe36c3000 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] | sysTid=25200 nice=-10 cgrp=default sched=0/0 handle=0xe7d58494 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] | state=R schedstat=( 452388541 13232809 343 ) utm=37 stm=8 core=5 HZ=100 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] | stack=0xff1cc000-0xff1ce000 stackSize=8MB 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] | held mutexes= "mutator lock"(shared held) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] native: #00 pc 002e7713 /system/lib/libart.so (art::DumpNativeStack(std::1::basic_ostream<char, std::__1::char_traits>&, int, BacktraceMap, char const, art::ArtMethod, void, bool)+134) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] native: #01 pc 0038d135 /system/lib/libart.so (art::Thread::DumpStack(std::1::basic_ostream<char, std::1::char_traits>&, bool, BacktraceMap*, bool) const+212) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] native: #02 pc 00389713 /system/lib/libart.so (art::Thread::Dump(std::__1::basic_ostream<char, std::1::char_traits>&, bool, BacktraceMap, bool) const+34) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] native: #03 pc 0023a433 /system/lib/libart.so (art::JavaVMExt::JniAbort(char const, char const)+722) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] native: #04 pc 0028a479 /system/lib/libart.so (art::JNI::GetObjectField(_JNIEnv, _jobject, _jfieldID)+788) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] native: #05 pc 0000848d (???) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at com.tencent.StubShell.TxAppEntry.load(Native method) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at com.tencent.StubShell.TxAppEntry.a(unavailable:-1) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at com.tencent.StubShell.TxAppEntry.attachBaseContext(unavailable:-1) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at android.app.Application.attach(Application.java:224) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at android.app.Instrumentation.newApplication(Instrumentation.java:1128) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at android.app.LoadedApk.makeApplication(LoadedApk.java:1156) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at android.app.ActivityThread.handleBindApplication(ActivityThread.java:6529) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at android.app.ActivityThread.access$1900(ActivityThread.java:267) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1963) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at android.os.Handler.dispatchMessage(Handler.java:109) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at android.os.Looper.loop(Looper.java:207) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at android.app.ActivityThread.main(ActivityThread.java:7470) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at java.lang.reflect.Method.invoke(Native method) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:524) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542] at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:958) 2019-05-21 21:07:36.689 25200-25200 A/com.one.tomato: java_vm_ext.cc:542]

打开二次打包的apk,腾讯加固的入口 com.tencent.StubShell.TxAppEntry.load(android.content.Context)
报错。 我用jadx打开二次打包的apk,看到初始化xposed代码都成功加到 TxAppEntry 里面了

image

写入代码的逻辑,还没看懂怎么写入的,大佬看看是不是可以规避这个报错,支持加固apk,加油加油。

WindySha commented 5 years ago

对于加固App,已经有方案了,不久就会开源出来,敬请关注