52破解安卓专项-使用Android Killer实现多开

最新推荐文章于 2024-09-20 19:52:23 发布

Brinmon

最新推荐文章于 2024-09-20 19:52:23 发布

阅读量870

点赞数 5

分类专栏： Android逆向篇文章标签： android ctf Reverse 安卓逆向

本文链接：https://blog.csdn.net/qq_65474192/article/details/139133250

版权

Android逆向篇专栏收录该内容

9 篇文章 0 订阅

订阅专栏

文章链接：
《安卓逆向这档事》二、初识APK文件结构、双开、汉化、基础修 - 『移动安全区』 - 吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

修改包名实现apk多开：非全局替换，重打包修改apk包名 - 『移动安全区』 - 吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

实现apk汉化：

arsc汉化
xml汉化
Dex汉化

0.简单修改包名实现多开

重打包工具：Android Killer
apktool版本：2.9

首先将要反编译的apk安装进模拟器
将目标apk在不做任何修改的情况下在Android Killer 重新打包后，继续安装回模拟器
发现这个apk一直处于安装状态始终无法安装完成！

不知道原因所以就查看一下安卓的系统Log查看一下，在重复刚刚的操作！

C:\Users\Administrator>adb -s 127.0.0.1  logcat
--------- beginning of main
05-09 23:52:13.770  1424  1424 W auditd  : type=1403 audit(0.0:2): auid=4294967295 ses=4294967295 lsm=selinux res=1
05-09 23:52:13.780  1066  1066 I chatty  : uid=0(root) /init expire 1 line
05-09 23:52:13.800     1     1 I chatty  : uid=0(root) /init expire 6 lines
05-09 23:52:13.985  1424  1424 W auditd  : type=2000 audit(0.0:1): state=initialized audit_enabled=0 res=1
05-09 23:52:14.357  1429  1429 I SELinux : SELinux: Loaded service_contexts from:
....

安装过程中出现如下状况：


User
05-10 00:13:36.567  4580  4580 D su      : su invoked.
05-10 00:13:36.570  4581  4581 D su      : starting daemon client 0 0
05-10 00:13:36.573  4582  4582 D su      : connecting client 4579
05-10 00:13:36.576  4585  4585 D su      : remote pid: 4579
05-10 00:13:36.579  4586  4586 D su      : remote pts_slave:
05-10 00:13:36.582  4587  4587 D su      : remote uid: 0
05-10 00:13:36.585  4588  4588 D su      : remote req pid: 4577
05-10 00:13:36.588  4589  4589 D su      : remote args: 3
05-10 00:13:36.591  4591  4591 D su      : waiting for child exit
05-10 00:13:36.591  4593  4593 D su      : su invoked.
05-10 00:13:36.594  4594  4594 D su      : Allowing root/system/radio.
05-10 00:13:36.597  4595  4595 D su      : 0 /system/bin/sh executing 0 chmod 777 /mnt/shared/App/20240510001337851.apk using binary /system/bin/sh : sh -c chmod 777 /mnt/shared/App/20240510001337851.apk
05-10 00:13:36.606  4596  4596 D su      : sending code
05-10 00:13:36.609  4598  4598 D su      : client exited 0
05-10 00:13:36.609  4597  4597 D su      : child exited
05-10 00:13:37.043  1716  1749 W PackageManager: Package com.zj.wuaipojie signatures do not match previously installed version; ignoring!
05-10 00:13:37.043  1580  1766 E         : Couldn't opendir /data/app/vmdl546505291.tmp: No such file or directory
05-10 00:13:37.043  1580  1766 E installd: Failed to delete /data/app/vmdl546505291.tmp: No such file or directory
05-10 00:13:52.384  1716  1847 E LightsService: Light requested not available on this device. 0
05-10 00:13:52.570  1716  1736 E BatteryExternalStatsWorker: no controller energy info supplied for wifi
05-10 00:13:52.571  1716  1736 D KernelUidCpuTimeReader: Removing uids 10049-10049
05-10 00:13:52.617  1716  1847 I chatty  : uid=1000(system) PhotonicModulat identical 14 lines
05-10 00:13:52.633  1716  1847 E LightsService: Light requested not available on this device. 0
05-10 00:13:36.567 4580 4580 D su : su invoked. 05-10 00:13:36.570 4581 4581 D su : starting daemon client 0 0 05-10 00:13:36.573 4582 4582 D su : connecting client 4579 05-10 00:13:36.576 4585 4585 D su : remote pid: 4579 05-10 00:13:36.579 4586 4586 D su : remote pts_slave: 05-10 00:13:36.582 4587 4587 D su : remote uid: 0 05-10 00:13:36.585 4588 4588 D su : remote req pid: 4577 05-10 00:13:36.588 4589 4589 D su : remote args: 3 05-10 00:13:36.591 4591 4591 D su : waiting for child exit 05-10 00:13:36.591 4593 4593 D su : su invoked. 05-10 00:13:36.594 4594 4594 D su : Allowing root/system/radio. 05-10 00:13:36.597 4595 4595 D su : 0 /system/bin/sh executing 0 chmod 777 /mnt/shared/App/20240510001337851.apk using binary /system/bin/sh : sh -c chmod 777 /mnt/shared/App/20240510001337851.apk 05-10 00:13:36.606 4596 4596 D su : sending code 05-10 00:13:36.609 4598 4598 D su : client exited 0 05-10 00:13:36.609 4597 4597 D su : child exited 05-10 00:13:37.043 1716 1749 W PackageManager: Package com.zj.wuaipojie signatures do not match previously installed version; ignoring! 05-10 00:13:37.043 1580 1766 E : Couldn't opendir /data/app/vmdl546505291.tmp: No such file or directory 05-10 00:13:37.043 1580 1766 E installd: Failed to delete /data/app/vmdl546505291.tmp: No such file or directory 05-10 00:13:52.384 1716 1847 E LightsService: Light requested not available on this device. 0 05-10 00:13:52.570 1716 1736 E BatteryExternalStatsWorker: no controller energy info supplied for wifi 05-10 00:13:52.571 1716 1736 D KernelUidCpuTimeReader: Removing uids 10049-10049 05-10 00:13:52.617 1716 1847 I chatty : uid=1000(system) PhotonicModulat identical 14 lines 05-10 00:13:52.633 1716 1847 E LightsService: Light requested not available on this device. 0

很显然我也看不懂所以直接问chatgpt看出了什么！
Chatgpt的回答：
这些日志看起来是来自一个Android系统的，记录了与su命令、包管理和设备灯光相关的活动。
关键点如下：

su调用：调用了su命令，授予了执行命令的root权限。
包签名不匹配：警告显示一个包（com.zj.wuaipojie）的签名与先前安装的版本不匹配。
包安装错误：出现了与包安装相关的错误（Couldn't opendir /data/app/vmdl546505291.tmp: No such file or directory）。

最主要的核心问题出来了！如果安装相同包名的apk时会进行签名校验判断已经在手机中的apk的签名是否和要安装的签名一致，如果不一致就会安装失败！
由于apk经过Android Killer 重新打包，所以他的签名就被修改了！再安装就会出现签名冲突问题！
报错：

05-10 00:13:37.043  1716  1749 W PackageManager: Package com.zj.wuaipojie signatures do not match previously installed version; ignoring!

1.开始修改包名并安装

修改：AndroidManifest.xml
原：

<?xml version="1.0" encoding="utf-8" standalone="no"?><manifest xmlns:android="http://schemas.android.com/apk/res/android" android:compileSdkVersion="32" android:compileSdkVersionCodename="12" package="com.zj.wuaipojie" platformBuildVersionCode="32" platformBuildVersionName="12">

改：

<?xml version="1.0" encoding="utf-8" standalone="no"?><manifest xmlns:android="http://schemas.android.com/apk/res/android" android:compileSdkVersion="32" android:compileSdkVersionCodename="12" package="com11.zj.wuaipojie" platformBuildVersionCode="32" platformBuildVersionName="12">

成功实现多开：
由于这个apk比较简单并没有太多的核心层的调用所以只需要修改AndroidManifest.xml文件里的的包名就可以实现多开了！

2.修改较复杂的apk的包名

05-10 00:42:08.241  5448  5448 D su      : su invoked.
05-10 00:42:08.244  5449  5449 D su      : starting daemon client 0 0
05-10 00:42:08.246  5450  5450 D su      : connecting client 5447
05-10 00:42:08.249  5453  5453 D su      : remote pid: 5447
05-10 00:42:08.252  5454  5454 D su      : remote pts_slave:
05-10 00:42:08.255  5455  5455 D su      : remote uid: 0
05-10 00:42:08.258  5456  5456 D su      : remote req pid: 5445
05-10 00:42:08.261  5457  5457 D su      : remote args: 3
05-10 00:42:08.264  5459  5459 D su      : waiting for child exit
05-10 00:42:08.264  5461  5461 D su      : su invoked.
05-10 00:42:08.267  5462  5462 D su      : Allowing root/system/radio.
05-10 00:42:08.269  5463  5463 D su      : 0 /system/bin/sh executing 0 chmod 777 /mnt/shared/App/20240510004209534.apk using binary /system/bin/sh : sh -c chmod 777 /mnt/shared/App/20240510004209534.apk
05-10 00:42:08.277  5464  5464 D su      : sending code
05-10 00:42:08.280  5465  5465 D su      : client exited 0
05-10 00:42:08.280  5466  5466 D su      : child exited
05-10 00:42:08.584  1716  1768 I ABIPicker: selected abi x86_64(0) for net111.meishi360.app
05-10 00:42:04.817  1716  1736 E BatteryExternalStatsWorker: no controller energy info supplied for wifi
05-10 00:42:08.632  1716  1749 W PackageParser: Unknown element under <manifest>: queries at /data/app/vmdl1658167738.tmp/base.apk Binary XML file line #30
05-10 00:42:08.636  1716  1749 W PackageManager: Package net111.meishi360.app attempting to redeclare permission net.meishi360.app.openadsdk.permission.TT_PANGOLIN already owned by net.meishi360.app
05-10 00:42:08.637  1580  1766 E         : Couldn't opendir /data/app/vmdl1658167738.tmp: No such file or directory
05-10 00:42:08.637  1580  1766 E installd: Failed to delete /data/app/vmdl1658167738.tmp: No such file or directory
05-10 00:42:08.755  1567  1657 D gralloc_nox: gralloc_alloc: Creating ashmem region of size 81920
05-10 00:42:08.757  1567  1705 D gralloc_nox: gralloc_alloc: Creating ashmem region of size 81920
05-10 00:42:08.758  1567  1705 D gralloc_nox: gralloc_alloc: Creating ashmem region of size 81920
05-10 00:42:08.763  1567  2730 D gralloc_nox: gralloc_alloc: Creating ashmem region of size 81920
05-10 00:42:10.752  1716  1855 I NotificationService: cancelToast pkg=com.android.launcher3 callback=android.app.ITransientNotification$Stub$Proxy@9a1fa4c
05-10 00:42:10.752  1716  1855 W NotificationService: Toast already cancelled. pkg=com.android.launcher3 callback=android.app.ITransientNotification$Stub$Proxy@9a1fa4c
05-10 00:42:11.037  1567  1657 W SurfaceFlinger: Attempting to destroy on removed layer: bd7fcdd ToastWithoutNotification#0
05-10 00:42:14.929  1550  1550 I healthd : type=1400 audit(0.0:2408): avc: denied { read } for name="present" dev="sysfs" ino=9280 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1

依旧看不懂直接找chatgpt：
这些日志显示了另一次su命令的调用，以及与包管理和通知服务相关的活动。
关键点包括：

su调用：再次调用了su命令，授予了root权限。
包解析错误：出现了包解析错误，可能是由于manifest文件中的未知元素或权限重复声明引起的。
未知元素和权限重复声明：包解析时发现了未知元素，还有一个包试图重新声明已经由另一个包拥有的权限。
通知服务错误：有一些与通知服务相关的警告和取消通知的操作。
系统权限拒绝：出现了一个系统权限拒绝的错误，与sysfs文件系统中的读操作相关。

在手机安装打包后的apk，在没有卸载原来的apk时，发现安装过程中出错，新apk安装不进去。查看adb logcat,发现有些provider、intent名称已经被原apk注册进系统，权限有冲突所以apk安装被中止。

看教程：非全局替换，重打包修改apk包名 - 『移动安全区』 - 吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn
这里有两份已经完全修改包名成功后的xml文件和一份原xml文件
使用010 Editor进行文件对比：

发现确实只有xml文件中的包名全部修改了！

现在再使用Android Killer修改xml文件中所有的包名！！
使用Android Killer自带的文本替换功能，直接全部修改：net.meishi360.app-》net111.meishi360.app

打算去安装却发现失败了不知道原因QAQ：
貌似是段错误QAQ,可以安装不可以打开！

05-10 01:03:40.358  6393  6393 I crash_dump64: performing dump of process 6369 (target tid = 6369)
05-10 01:03:40.361  6393  6393 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
05-10 01:03:40.361  6393  6393 F DEBUG   : Build fingerprint: 'samsung/beyond1qlteue/beyond1q:9/LMY48Z/900230926:user/release-keys'
05-10 01:03:40.361  6393  6393 F DEBUG   : Revision: '0'
05-10 01:03:40.361  6393  6393 F DEBUG   : ABI: 'x86_64'
05-10 01:03:40.361  6393  6393 F DEBUG   : pid: 6369, tid: 6369, name: 1.meishi360.app  >>> net111.meishi360.app <<<
05-10 01:03:40.361  6393  6393 F DEBUG   : signal 11 (SIGSEGV), code 128 (SI_KERNEL), fault addr 0x0
05-10 01:03:40.361  6393  6393 F DEBUG   :     rax 67448c22f92a7c19  rbx 00007ffc461c7801  rcx 00007ffc461c7c10  rdx 00007ffc461c7930
05-10 01:03:40.361  6393  6393 F DEBUG   :     r8  0000000000000006  r9  0000000000000000  r10 0000000100000000  r11 00007ffc461c7bd0
05-10 01:03:40.361  6393  6393 F DEBUG   :     r12 6e6e75522f676e61  r13 0000000000000000  r14 0000000000000000  r15 6e6e75522f676e61
05-10 01:03:40.361  6393  6393 F DEBUG   :     rdi 6e6e75522f676e61  rsi 0000000000000000
05-10 01:03:40.361  6393  6393 F DEBUG   :     rbp 0000000000000000  rsp 00007ffc461c77d0  rip 000070a2f8429491
05-10 01:03:40.362  6393  6393 F DEBUG   :
05-10 01:03:40.362  6393  6393 F DEBUG   : backtrace:
05-10 01:03:40.362  6393  6393 F DEBUG   :     #00 pc 00000000000d0491  /system/lib64/libart.so (art::ArtMethod::GetOatQuickMethodHeader(unsigned long)+33)
05-10 01:03:40.362  6393  6393 F DEBUG   :     #01 pc 00000000004db2c0  /system/lib64/libart.so (_ZN3art12StackVisitor9WalkStackILNS0_16CountTransitionsE0EEEvb+528)
05-10 01:03:40.362  6393  6393 F DEBUG   :     #02 pc 00000000004b04c6  /system/lib64/libart.so (art::QuickExceptionHandler::FindCatch(art::ObjPtr<art::mirror::Throwable>)+198)
05-10 01:03:40.362  6393  6393 F DEBUG   :     #03 pc 00000000004fa19b  /system/lib64/libart.so (art::Thread::QuickDeliverException()+843)
05-10 01:03:40.362  6393  6393 F DEBUG   :     #04 pc 000000000057dbb5  /system/lib64/libart.so (artDeliverPendingExceptionFromCode+5)
05-10 01:03:40.362  6393  6393 F DEBUG   :     #05 pc 00000000005cdfd1  /system/lib64/libart.so (art_quick_generic_jni_trampoline+449)
05-10 01:03:40.362  6393  6393 F DEBUG   :     #06 pc 00000000005cdf7f  /system/lib64/libart.so (art_quick_generic_jni_trampoline+367)
05-10 01:03:40.362  6393  6393 F DEBUG   :     #07 pc 000000000071e967  /data/dalvik-cache/x86_64/system@framework@boot-framework.art

问chatgpt：
这段日志记录了一个应用程序(net111.meishi360.app)的崩溃。崩溃的原因是一个信号(SIGSEGV)，即段错误，导致了进程的异常终止。下面是一些关键的信息：