Android apk反编译及AS代码混淆方法

Android apk反编译及AS代码混淆方法

反编译工具下载地址：http://download.csdn.net/download/shenyuanqing/9187933

一.反编译

1.用压缩包管理软件（如WinRAR、WinZIP等）解压apk得到classes.dex文件，把该文件放到dex2jar文件夹里。

2.用dex2jar工具软件得到相应的jar文件。

（1）打开命令行界面。

（2）定位到dex2jar.bat所在目录。

（3）输入命令dex2jar.bat classes.dex即可生成jar文件（classes_dex2jar.jar）。

3.用jd-gui工具软件打开jar文件，就可查看源码。

(1)File/Open File

 

真是一览无余啊，安全工作刻不容缓。

二.混淆

1.app/build.gradle/buildTypes把minifyEnabled从false改成ture来启动Proguard混淆功能（AS1.2）。

    buildTypes {
        release {
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }
    }

2.在proguard-rules.pro文件中配置混淆规则（根据自己项目情况）。

# Add project specific ProGuard rules here.
# By default, the flags in this file are appended to flags specified
# in /Users/zhouping/Documents/code/android-sdk-macosx/tools/proguard/proguard-android.txt
# You can edit the include path and order by changing the proguardFiles
# directive in build.gradle.
#
# For more details, see
#   http://developer.android.com/guide/developing/tools/proguard.html

# Add any project specific keep options here:

# If your project uses WebView with JS, uncomment the following
# and specify the fully qualified class name to the JavaScript interface
# class:
#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
#   public *;
#}
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.support.v4.app.FragmentActivity
-keep public class * extends android.support.v4.app.Fragment
-keep class * extends java.lang.annotation.Annotation { *; }
#-keep class com.lidroid.xutils.** {*;}
-keep class cn.lkhealth.epos.pub.common.SerialPort {*;}
##---------------Begin: proguard configuration for Gson  ----------
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature

# Gson specific classes
-keep class sun.misc.Unsafe { *; }
-keep class com.google.gson.stream.** { *; }
-keep class com.google.gson.examples.android.model.** { *; }
-keep class com.google.gson.** { *;}

# Application classes that will be serialized/deserialized over Gson
-keep class cn.lkhealth.epos.about.bean.**{ *; }
-keep class cn.lkhealth.epos.cashier.bean.**{ *; }
-keep class cn.lkhealth.epos.order.bean.**{ *; }
-keep class cn.lkhealth.epos.pub.bean.**{ *; }
##---------------End: proguard configuration for Gson  ----------

3.混淆后效果如下图：

可以看到变量、方法名等都由字母来代替了，虽然代码结构没有变，但至少增加了破解的难度了。