废话少说,上代码。
option_0 = { 'name' : ('-i', '--input'), 'help' : 'filename input (APK or android\'s binary xml)', 'nargs' : 1 }
option_1 = { 'name' : ('-o', '--output'), 'help' : 'filename output of the xml', 'nargs' : 1 }
option_2 = { 'name' : ('-v', '--version'), 'help' : 'version of the API', 'action' : 'count' }
options = [option_0, option_1, option_2]
def main(options, arguments):
if options.input != None:
buff = ""
ret_type = androconf.is_android(options.input) #读取文件头判断文件类型
if ret_type == "APK":
a = apk.APK(options.input)
buff = a.get_android_manifest_xml().toprettyxml(encoding="utf-8")
elif ".xml" in options.input:
ap = apk.AXMLPrinter(read(options.input))
buff = minidom.parseString(ap.get_buff()).toprettyxml(encoding="utf-8")
else:
print "Unknown file type"
return
if options.output != None: #创建输出文件
fd = codecs.open(options.output, "w", "utf-8")
fd.write( buff )
fd.close()
else: #否则输出到屏幕
print buff
elif options.version != None:
print "Androaxml version %s" % androconf.ANDROGUARD_VERSION
if __name__ == "__main__":
parser = OptionParser()
for option in options:
param = option['name']
del option['name']
parser.add_option(*param, **option)
options, arguments = parser.parse_args()
sys.argv[:] = arguments
main(options, arguments)
这是androaxml.py的全部源码。几个内容
第一,参数。一个input,可以是apk,或者AndroidManfest.xml。一个output,这是指定的输出文件名,如果不指定输出文件名,则输出到屏幕。
第二,如果为apk,则使用APK()解析
def get_android_manifest_xml(self):
"""
Return the xml object which corresponds to the AndroidManifest.xml file
:rtype: object
"""
try:
return self.xml["AndroidManifest.xml"]
except KeyError:
return None
如果是 AndroidManfest.xml,则使用AXMLPrinter
而在APK.__init__函数中有这样一段
if zipmodule == 0:
self.zip = ChilkatZip(self.__raw)
elif zipmodule == 2:
from androguard.patch import zipfile
self.zip = zipfile.ZipFile(StringIO.StringIO(self.__raw), mode=mode)
else:
import zipfile
self.zip = zipfile.ZipFile(StringIO.StringIO(self.__raw), mode=mode)
for i in self.zip.namelist():
if i == "AndroidManifest.xml":
self.axml[i] = AXMLPrinter(self.zip.read(i))
try:
self.xml[i] = minidom.parseString(self.axml[i].get_buff())
except:
self.xml[i] = None
对apk文件利用ChilkatZip或者ZipFile进行解压,然后从解压后的文件列表当中遍历获取 AndroidManfest.xml,再对 AndroidManfest.xml
调用AXMLPrinter,所以核心的处理在AXMLPrinter当中。
AXMLPrinter则是用AXMLParser对文件进行解析。
所以处理流程就清晰了
APK: 生成APK class实例 ——> 解压文件 ——> 遍历获取AndroidManfest.xml ——> AXMLPrinter实例 ——> AXMLParser实例解析
XML: AXMLPrinter实例 ——> AXMLParser实例解析
class AXMLParser(object):
def __init__(self, raw_buff):
self.reset()
self.valid_axml = True
self.buff = bytecode.BuffHandle(raw_buff)
axml_file = unpack('<L', self.buff.read(4))[0] #读取文件头
if axml_file == CHUNK_AXML_FILE: #判断文件头
self.buff.read(4)
self.sb = StringBlock(self.buff) #字符串池
self.m_resourceIDs = []
self.m_prefixuri = {}
self.m_uriprefix = {}
self.m_prefixuriL = []
self.visited_ns = []
else:
self.valid_axml = False
androconf.warning("Not a valid xml file")
AXMLParser.buff结构
self.__buff保存内容
self.__idx保存已解析的长度,也就是下次解析的起点
class AXMLPrinter(object):
def __init__(self, raw_buff):
self.axml = AXMLParser(raw_buff) #实例化AXMLParser
self.xmlns = False
self.buff = u''
#主处理逻辑
while True and self.axml.is_valid():
_type = self.axml.next()
# print "tagtype = ", _type
if _type == START_DOCUMENT:
self.buff += u'<?xml version="1.0" encoding="utf-8"?>\n'
elif _type == START_TAG:
self.buff += u'<' + self.getPrefix(self.axml.getPrefix()) + self.axml.getName() + u'\n'
self.buff += self.axml.getXMLNS()
for i in range(0, self.axml.getAttributeCount()):
self.buff += "%s%s=\"%s\"\n" % (self.getPrefix(
self.axml.getAttributePrefix(i)), self.axml.getAttributeName(i), self._escape(self.getAttributeValue(i)))
self.buff += u'>\n'
elif _type == END_TAG:
self.buff += "</%s%s>\n" % (self.getPrefix(self.axml.getPrefix()), self.axml.getName())
elif _type == TEXT:
self.buff += "%s\n" % self.axml.getText()
elif _type == END_DOCUMENT:
break
AXMLParser实例化完成后进入主处理逻辑
在前一篇文章反编译编译后的AndroidManifest 当中也有一段类似的处理逻辑,实现大同小异,都是读取tag,判断是什么chunk,然后然后处理,可以对比一下。
def next(self):
self.doNext()
return self.m_event
next函数调用doNext
def doNext(self):
if self.m_event == END_DOCUMENT: #文件结束
return
event = self.m_event
self.reset()
while True:
chunkType = -1
# Fake END_DOCUMENT event.
if event == END_TAG: #tag结束标志
pass
# START_DOCUMENT
if event == START_DOCUMENT: #Start Tag Chunk
chunkType = CHUNK_XML_START_TAG
else:
if self.buff.end(): #文件是否结束
self.m_event = END_DOCUMENT
break
chunkType = unpack('<L', self.buff.read(4))[0] #读取后四位
if chunkType == CHUNK_RESOURCEIDS: #ResourceId Chunk
chunkSize = unpack('<L', self.buff.read(4))[0]
# FIXME
if chunkSize < 8 or chunkSize % 4 != 0: #长度是否合法
androconf.warning("Invalid chunk size")
for i in range(0, chunkSize / 4 - 2):
self.m_resourceIDs.append(unpack('<L', self.buff.read(4))[0])
continue
# FIXME
if chunkType < CHUNK_XML_FIRST or chunkType > CHUNK_XML_LAST: #无法识别的tag
androconf.warning("invalid chunk type")
# Fake START_DOCUMENT event.
if chunkType == CHUNK_XML_START_TAG and event == -1: #第一次读到Start Tag Chunk时,event为-1
self.m_event = START_DOCUMENT #将event设置为START_DOCUMENT之后退出
break #返回到主处理逻辑
self.buff.read(4) # /*chunkSize*/
lineNumber = unpack('<L', self.buff.read(4))[0]
self.buff.read(4) # 0xFFFFFFFF
if chunkType == CHUNK_XML_START_NAMESPACE or chunkType == CHUNK_XML_END_NAMESPACE:
if chunkType == CHUNK_XML_START_NAMESPACE: #Start Namespace Chunk
prefix = unpack('<L', self.buff.read(4))[0]
uri = unpack('<L', self.buff.read(4))[0]
self.m_prefixuri[prefix] = uri
self.m_uriprefix[uri] = prefix
self.m_prefixuriL.append((prefix, uri))
self.ns = uri
else: #End Namespace Chunk
self.ns = -1
self.buff.read(4)
self.buff.read(4)
(prefix, uri) = self.m_prefixuriL.pop()
#del self.m_prefixuri[ prefix ]
#del self.m_uriprefix[ uri ]
continue
self.m_lineNumber = lineNumber
if chunkType == CHUNK_XML_START_TAG: #第二次读取到Start Tag Chunk,此时event为START_DOCUMENT
self.m_namespaceUri = unpack('<L', self.buff.read(4))[0]
self.m_name = unpack('<L', self.buff.read(4))[0]
# FIXME
self.buff.read(4) # flags
attributeCount = unpack('<L', self.buff.read(4))[0]
self.m_idAttribute = (attributeCount >> 16) - 1
attributeCount = attributeCount & 0xFFFF
self.m_classAttribute = unpack('<L', self.buff.read(4))[0]
self.m_styleAttribute = (self.m_classAttribute >> 16) - 1
self.m_classAttribute = (self.m_classAttribute & 0xFFFF) - 1
for i in range(0, attributeCount * ATTRIBUTE_LENGHT):
self.m_attributes.append(unpack('<L', self.buff.read(4))[0])
for i in range(ATTRIBUTE_IX_VALUE_TYPE, len(self.m_attributes), ATTRIBUTE_LENGHT):
self.m_attributes[i] = self.m_attributes[i] >> 24
self.m_event = START_TAG
break
if chunkType == CHUNK_XML_END_TAG:
self.m_namespaceUri = unpack('<L', self.buff.read(4))[0]
self.m_name = unpack('<L', self.buff.read(4))[0]
self.m_event = END_TAG
break
if chunkType == CHUNK_XML_TEXT:
self.m_name = unpack('<L', self.buff.read(4))[0]
# FIXME
self.buff.read(4)
self.buff.read(4)
self.m_event = TEXT
break
doNext函数很长。关注的重点在while循环中。当读取到 ResourceId Chunk和 Namespace Chunk
则continue。而第一次读到Start Tag Chunk的时候则会退出,返回到AXMLPrinter的主处理逻辑当中。
再看一下AXMLPrinter
while True and self.axml.is_valid():
_type = self.axml.next()
# print "tagtype = ", _type
if _type == START_DOCUMENT:
self.buff += u'<?xml version="1.0" encoding="utf-8"?>\n'
elif _type == START_TAG:
self.buff += u'<' + self.getPrefix(self.axml.getPrefix()) + self.axml.getName() + u'\n'
self.buff += self.axml.getXMLNS()
for i in range(0, self.axml.getAttributeCount()):
self.buff += "%s%s=\"%s\"\n" % (self.getPrefix(
self.axml.getAttributePrefix(i)), self.axml.getAttributeName(i), self._escape(self.getAttributeValue(i)))
self.buff += u'>\n'
elif _type == END_TAG:
self.buff += "</%s%s>\n" % (self.getPrefix(self.axml.getPrefix()), self.axml.getName())
elif _type == TEXT:
self.buff += "%s\n" % self.axml.getText()
elif _type == END_DOCUMENT:
break
self.buff是准备写入解析后的xml文件的字符串。第一次执行next函数,成功读取
ResourceId Chunk和
Namespace Chunk
之后遇到Start Tag Chunk,修改m_event之后退出。在buff字符串写入u'<?xml version="1.0" encoding="utf-8"?>\n'
然后继续执行next函数,之后再遇到Start Tag Chunk时不会直接退出,而是执行相应的解析操作。
从理论上将字符串池、ResourceId Chunk和Namespace Chunk都位于第一个Start Tag Chunk之前
而这些chunk也并不会直接出现在解析后的xml文件中。
所以先将他们解析,放入准备好的变量容器。第一次遇到Start Tag Chunk说明之前的内容已经处理完毕了,之后就可以将
Start Tag Chunk解析后的结果写入结果字符串。
当结果字符串构造完毕之后,输出到文件或者屏幕即可。