Android Apk加壳原理分析

    0x00

    阅读本文前，建议读者首先阅读Android加壳原理，参考文章Android中的Apk的加固(加壳)原理解析和实现。如果没有看过这篇文章，本文理解起来比较困难。

    0x01

    下面我们来分析脱壳代码为什么要这样写，核心脱壳代码在ProxyApplication类里面，首先执行成员方法attachBaseContext，然后执行成员方法onCreate。

    那么attachBaseContext是什么时候被执行的呢，为什么先于onCreate执行呢？那就需要看Android的源码了，我们选用的是Android2.3源码。

    我们首先看一张图，这张图表述了从桌面启动一个应用Activity的启动过程。

   

                       图  1

    其中当执行到ApplicationThread.bindApplication时，会向ActivityThreadl类的Handler对象mH发送消息。

        public final void bindApplication(String processName,
                ApplicationInfo appInfo, List<ProviderInfo> providers,
                ComponentName instrumentationName, String profileFile,
                Bundle instrumentationArgs, IInstrumentationWatcher instrumentationWatcher,
                int debugMode, boolean isRestrictedBackupMode, Configuration config,
                Map<String, IBinder> services) {

            if (services != null) {
                // Setup the service cache in the ServiceManager
                ServiceManager.initServiceCache(services);
            }

            AppBindData data = new AppBindData();
            data.processName = processName;
            data.appInfo = appInfo;
            data.providers = providers;
            data.instrumentationName = instrumentationName;
            data.profileFile = profileFile;
            data.instrumentationArgs = instrumentationArgs;
            data.instrumentationWatcher = instrumentationWatcher;
            data.debugMode = debugMode;
            data.restrictedBackupMode = isRestrictedBackupMode;
            data.config = config;
            queueOrSendMessage(H.BIND_APPLICATION, data);
        }

    代码位于frameworks\base\core\java\android\app\ActivityThread.java。

    queueOrSendMessage向ActivityThreadl类的Handler对象mH发送消息。

private final void queueOrSendMessage(int what, Object obj, int arg1, int arg2) {
        synchronized (this) {
            if (DEBUG_MESSAGES) Slog.v(
                TAG, "SCHEDULE " + what + " " + mH.codeToString(what)
                + ": " + arg1 + " / " + obj);
            Message msg = Message.obtain();
            msg.what = what;
            msg.obj = obj;
            msg.arg1 = arg1;
            msg.arg2 = arg2;
            mH.sendMessage(msg);
        }
    }

    代码位于 frameworks\base\core\java\android\app\ ActivityThread.java。

    handler处理BIND_APPLICATION的流程如下。

 private final class H extends Handler {
		......
        }
        public void handleMessage(Message msg) {
            if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + msg.what);
            switch (msg.what) {
			......
                case BIND_APPLICATION:
                    AppBindData data = (AppBindData)msg.obj;
                    handleBindApplication(data);
                    break;
			......
        }

    }

     代码位于 frameworks\base\core\java\android\app\ ActivityThread.java。

    继续看handleBindApplication，其中data就是ApplicationThread.bindApplication生成的AppBindData对象。

    private final void handleBindApplication(AppBindData data) {
	mBoundApplication = data;
	......
        data.info = getPackageInfoNoCheck(data.appInfo);
	......
        Application app = data.info.makeApplication(data.restrictedBackupMode, null);
        mInitialApplication = app;
	......

        try {
            mInstrumentation.callApplicationOnCreate(app);
        } catch (Exception e) {
            if (!mInstrumentation.onException(app, e)) {
                throw new RuntimeException(
                    "Unable to create application " + app.getClass().getName()
                    + ": " + e.toString(), e);
            }
        }
    }

     代码位于 frameworks\base\core\java\android\app\ ActivityThread.java。

    首先把data赋值给了AppBindData对象mBoundApplication，然后通过getPackageInfoNoCheck得到的LoadedApk对象复制给data.info，之后调用data.info.makeApplication生成Application对象，我们下面来分析下data.info.makeApplication这个方法。

    public Application makeApplication(boolean forceDefaultAppClass,
            Instrumentation instrumentation) {
        if (mApplication != null) {
            return mApplication;
        }

        Application app = null;

        String appClass = mApplicationInfo.className;
        if (forceDefaultAppClass || (appClass == null)) {
            appClass = "android.app.Application";
        }

        try {
            java.lang.ClassLoader cl = getClassLoader();
            ContextImpl appContext = new ContextImpl();
            appContext.init(this, null, mActivityThread);
            app = mActivityThread.mInstrumentation.newApplication(
                    cl, appClass, appContext);
            appContext.setOuterContext(app);
        } catch (Exception e) {
            if (!mActivityThread.mInstrumentation.onException(app, e)) {
                throw new RuntimeException(
                    "Unable to instantiate application " + appClass
                    + ": " + e.toString(), e);
            }
        }
        mActivityThread.mAllApplications.add(app);
        mApplication = app;

		......
        
        return app;
    }

    代码位于frameworks\base\core\jav