androguard解析指令及字节码

解析字节码是常用到的一个需求，被解析出来的字节码可以用于多种用途，例如数值分析、机器学习等。

所谓的字节码：在 Java 语言中中引入了虚拟机的概念，即在机器和编译程序之间加入了一层抽象的虚拟的机器。这台虚拟的机器在任何平台上都提供给编译程序一个的共同的接口。编译程序只需要面向虚拟机，生成虚拟机能够理解的代码，然后由解释器来将虚拟机代码转换为特定系统的机器码执行。在 Java 中，这种供虚拟机理解的代码叫做字节码（即扩展名为 .class 的文件），它不面向任何特定的处理器，只面向虚拟机。每一种平台的解释器是不同的，但是实现的虚拟机是相同的。Java 源程序经过编译器编译后变成字节码，字节码由虚拟机解释执行，虚拟机将每一条要执行的字节码送给解释器，解释器将其翻译成特定机器上的机器码，然后在特定的机器上运行。这也就是解释了 Java 的编译与解释并存的特点。

采用字节码的好处：Java 语言通过字节码的方式，在一定程度上解决了传统解释型语言执行效率低的问题，同时又保留了解释型语言可移植的特点。所以 Java 程序运行时比较高效，而且，由于字节码并不专对一种特定的机器，因此，Java程序无须重新编译便可在多种不同的计算机上运行。

每种方法的字节码都存储在 Dalvik 文件中。Androguard 可以提供三种不同形式获取字节码的方法。

字节码是以16位为单位构造的，但是Androguard将使用8位单位来显示字节码。 如果在字节码中给出了偏移量，则也以字节表示。同样的所有索引均以字节长度提供。

由于Dalvik与Java密切相关，因此所有整数值都表示为带符号的“ int”（32位值）或“ long”（64位）。
值以十进制或十六进制表示。如果值为十六进制，则该值后缀为“ h”，即“ f7a0h”或“ 63392”。

Getting the raw bytecode

要想获取方法的字节码的原始字节表示，第一步仍然是先要加载要测试的 APK 文件

ubuntu@ubuntu:~$ androguard analyze /home/ubuntu/Desktop/meeting.apk 
Please be patient, this might take a while.
Found the provided file is of type 'APK'
[INFO    ] androguard.apk: Starting analysis on AndroidManifest.xml
[INFO    ] androguard.apk: APK file was successfully validated!
[INFO    ] androguard.analysis: Adding DEX file version 35
[INFO    ] androguard.analysis: Reading bytecode took : 0min 00s
[INFO    ] androguard.analysis: Adding DEX file version 35
[INFO    ] androguard.analysis: Reading bytecode took : 0min 00s
[INFO    ] androguard.analysis: End of creating cross references (XREF) run time: 0min 00s
Added file to session: SHA256::689673bed0f4d6121a63f3c9fd88efb538ec316561d426120c440d8be89f6256
Loaded APK file...
>>> a
<androguard.core.bytecodes.apk.APK object at 0x7f3b27bb8390>
>>> d
[<androguard.core.bytecodes.dvm.DalvikVMFormat object at 0x7f3b1ae9d978>, <androguard.core.bytecodes.dvm.DalvikVMFormat object at 0x7f3b1ae36b00>]
>>> dx
<analysis.Analysis VMs: 2, Classes: 85, Methods: 340, Strings: 122>

Androguard version 3.4.0a1 started

然后通过 python 编程获取所有方法的字节表示：

In [1]: for method in dx.get_methods():
   ...:     if method.is_external():
   ...:         continue
   ...:     m = method.get_method()
   ...:     if m.get_code():
   ...:         print(m.get_code().get_bc().get_raw())

其输出结果中将包含很多的二进制数据，如下：

bytearray(b'p\x10\t\x00\x00\x00\x0e\x00')
bytearray(b'p\x10\t\x00\x00\x00\x0e\x00')
bytearray(b'p\x10\xf3\x00\x00\x00\x0e\x00')
bytearray(b'\x12\x01i\x01E\x00\x1a\x00C\x01i\x00C\x00\x1a\x00\xa1\x02i\x00F\x00i\x01D\x00\x0e\x00')
bytearray(b'p\x10\x00\x00\x00\x00\x0e\x00')
bytearray(b'\x1d\x02b\x00C\x00\x1a\x01\x08\x00n \x03\x01\x10\x00\n\x008\x00\x1e\x00"\x00G\x00o\x10\x03\x00\x02\x00\x0c\x01q\x10\x06\x01\x01\x00\x0c\x01p \t\x01\x10\x00b\x01C\x00n \x0f\x01\x10\x00\x0c\x00n\x10\x11\x01\x00\x00\x0c\x00i\x00C\x00\x12\x10\x1e\x02\x0f\x00b\x00C\x00\x1a\x01\x08\x00n \xfe\x00\x10\x00\n\x00;\x00\xf5\xff"\x00G\x00o\x10\x03\x00\x02\x00\x0c\x01q\x10\x06\x01\x01\x00\x0c\x01p \t\x01\x10\x00\x1a\x01\x08\x00n \x0f\x01\x10\x00\x0c\x00b\x01C\x00n \x0f\x01\x10\x00\x0c\x00n\x10\x11\x01\x00\x00\x0c\x00i\x00C\x00(\xd4\r\x00\x1e\x02\'\x00')

Getting disassembled instructions

编写代码获取反汇编形式

In [2]: for method in dx.get_methods():
   ...:      if method.is_external():
   ...:          continue
   ...:      m = method.get_method()
   ...:      for idx, ins in m.get_instructions_idx():
   ...:          print(idx, ins.get_op_value(), ins.get_name(), ins.get_output())
   ...: 

输出为

0 112 invoke-direct v0, Ljava/lang/Object;-><init>()V
6 14 return-void 
0 112 invoke-direct v0, Ljava/lang/Object;-><init>()V
6 14 return-void 
0 18 const/4 v1, 0
2 105 sput-object v1, Lcom/wrapper/proxyapplication/WrapperProxyApplication;->shellApp Landroid/app/Application;

如果想根据具体的类名和方法名获取其反汇编形式，可以采取以下做法

In [3]: for m in dx.find_methods("Lcom/tencent/wemeet/app/MyWrapperProxyApplication;"):
   ...:      print(m.full_name)
   ...:      for idx, ins in m.get_method().get_instructions_idx():
   ...:         print(idx, ins.get_op_value(), ins.get_name(), ins.get_output())
   ...:         

输出中将会看到

Lcom/tencent/wemeet/app/MyWrapperProxyApplication; <init> ()V
0 112 invoke-direct v0, Lcom/wrapper/proxyapplication/WrapperProxyApplication;-><init>()V
6 14 return-void 
Lcom/tencent/wemeet/app/MyWrapperProxyApplication; initProxyApplication (Landroid/content/Context;)V
0 110 invoke-virtual v7, Landroid/content/Context;->getApplicationInfo()Landroid/content/pm/ApplicationInfo;
6 12 move-result-object v4
8 84 iget-object v0, v4, Landroid/content/pm/ApplicationInfo;->sourceDir Ljava/lang/String;
12 18 const/4 v1, 0
14 34 new-instance v2, Ljava/util/zip/ZipFile;
18 112 invoke-direct v2, v0, Ljava/util/zip/ZipFile;-><init>(Ljava/lang/String;)V
24 7 move-object v1, v2
26 57 if-nez v1, +00dh
30 113 invoke-static Landroid/os/Process;->myPid()I
36 10 move-result v4
38 113 invoke-static v4, Landroid/os/Process;->killProcess(I)V
44 18 const/4 v4, 0
46 113 invoke-static v4, Ljava/lang/System;->exit(I)V
52 113 invoke-static v7, v1, Lcom/wrapper/proxyapplication/Util;->PrepareSecurefiles(Landroid/content/Context; Ljava/util/zip/ZipFile;)I
58 110 invoke-virtual v1, Ljava/util/zip/ZipFile;->close()V
64 98 sget-object v4, Lcom/wrapper/proxyapplication/Util;->CPUABI Ljava/lang/String;
68 26 const-string v5, "x86"
72 51 if-ne v4, v5, +031h
76 34 new-instance v4, Ljava/lang/StringBuilder;
80 110 invoke-virtual v7, Landroid/content/Context;->getFilesDir()Ljava/io/File;
86 12 move-result-object v5
88 110 invoke-virtual v5, Ljava/io/File;->getAbsolutePath()Ljava/lang/String;
94 12 move-result-object v5
96 113 invoke-static v5, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;
102 12 move-result-object v5
104 112 invoke-direct v4, v5, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
110 26 const-string v5, "/prodexdir/"
114 110 invoke-virtual v4, v5, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
120 12 move-result-object v4
122 98 sget-object v5, Lcom/wrapper/proxyapplication/Util;->libname Ljava/lang/String;
126 110 invoke-virtual v4, v5, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
132 12 move-result-object v4
134 110 invoke-virtual v4, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
140 12 move-result-object v4
142 113 invoke-static v4, Ljava/lang/System;->load(Ljava/lang/String;)V
148 14 return-void 
150 13 move-exception v3
152 110 invoke-virtual v3, Ljava/io/IOException;->printStackTrace()V
158 40 goto -42h
160 13 move-exception v3
162 110 invoke-virtual v3, Ljava/io/IOException;->printStackTrace()V
168 40 goto -34h
170 98 sget-object v4, Lcom/wrapper/proxyapplication/Util;->libname Ljava/lang/String;
174 113 invoke-static v4, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V
180 40 goto -10h
Lcom/tencent/wemeet/app/MyWrapperProxyApplication; onCreate ()V
0 111 invoke-super v0, Lcom/wrapper/proxyapplication/WrapperProxyApplication;->onCreate()V
6 14 return-void 

Get processed bytecode from decompiler

In [9]: for method in dx.get_methods():
   ...:     if method.is_external():
   ...:         continue
   ...:     m = method.get_method()
   ...:     print(m.source())
   ...:     

通过上述代码，可以输出所有方法的源码，输出举例如下：

	private declared_synchronized boolean Fixappname()
    {
        try {
            if (!com.wrapper.proxyapplication.WrapperProxyApplication.className.startsWith(.)) {
                if (com.wrapper.proxyapplication.WrapperProxyApplication.className.indexOf(.) < 0) {
                    com.wrapper.proxyapplication.WrapperProxyApplication.className = new StringBuilder(String.valueOf(super.getPackageName())).append(.).append(com.wrapper.proxyapplication.WrapperProxyApplication.className).toString();
                }
            } else {
                com.wrapper.proxyapplication.WrapperProxyApplication.className = new StringBuilder(String.valueOf(super.getPackageName())).append(com.wrapper.proxyapplication.WrapperProxyApplication.className).toString();
            }
        } catch (String v0_11) {
            throw v0_11;
        }
        return 1;
    }

也可以使用 DAD 编译抽象语法树（AST），AST 可以轻松地用于对代码本身进行分析。其方法如下：

from pprint import pprint
    from androguard.decompiler.dad.decompile import DvMethod
    for method in dx.get_methods():
        if method.is_external():
            continue
        dv = DvMethod(method)
        dv.process(doAST=True)
        pprint(dv.get_ast())

其输出形式为：

{'body': ['BlockStatement',
          None,
          [['LocalDeclarationStatement',
            None,
            [['TypeName', ('.int', 0)], ['Local', 'v1_0']]],
           ['LocalDeclarationStatement',
            ['ClassInstanceCreation',
             (java/io/File, <init>, (Ljava/lang/String;)V),
             [['Local', 'p5']],
             ['TypeName', (java/io/File, 0)]],
            [['TypeName', (java/io/File, 0)], ['Local', 'v0_1']]],
           ['IfStatement',
            None,
            ['BinaryInfix',
             [['Parenthesis',
               [['Unary',
                 [['MethodInvocation',
                   [['Local', 'v0_1']],
                   (java/io/File, exists, ()Z),
                   exists,
                   True]],
                 '!',
                 False]]],
              ['Parenthesis',
               [['BinaryInfix',
                 [['MethodInvocation',
                   [['Local', 'v0_1']],
                   (java/io/File, length, ()J),
                   length,
                   True],
                  ['Local', 'p6']],
                 '!=']]]],
             '||'],
            [['BlockStatement',
              None,
              [['ExpressionStatement',
                ['Assignment',
                 [['Local', 'v1_0'], ['Literal', '0', ('.int', 0)]],
                 '']]]],
             ['BlockStatement',
              None,
              [['ExpressionStatement',
                ['Assignment',
                 [['Local', 'v1_0'], ['Literal', '1', ('.int', 0)]],
                 '']]]]]],
           ['ReturnStatement', ['Local', 'v1_0']]]],
 'comments': [],
 'flags': ['private', 'static'],
 'params': [[['TypeName', (java/lang/String, 0)], ['Local', 'p5']],
            [['TypeName', ('.long', 0)], ['Local', 'p6']]],
 'ret': ['TypeName', ('.boolean', 0)],
 'triple': (com/wrapper/proxyapplication/Util,
            isFileValid,
            (Ljava/lang/String;J)Z)}

以上 AST 等价于下面的源代码

private static boolean isFileValid(String p5, long p6)
    {
        int v1_0;
        java.io.File v0_1 = new java.io.File(p5);
        if ((!v0_1.exists()) || (v0_1.length() != p6)) {
            v1_0 = 0;
        } else {
            v1_0 = 1;
        }
        return v1_0;
    }