xpu01

基于Xposed框架安卓脱壳软件

实现与使用

通过反射调用getDex方法取得com.android.dex.Dex类（获取dex），不支持8.0系统以上版本，高系统可以配合虚拟机来使用。

关于类抽取（nop）填充还原代码实现

请看nop.java：

  1. private String Ldex(Context mContext,String stord)throws Throwable{//脱壳 保存目录, 脱多个dex 带遍历类 nop 回填
  2.     String[] strArr;
  3.     Log("遍历dump 加载Dex数组...");
  4.     ArrayList arrayList = new ArrayList();
  5.     ClassLoader classLoader = mContext.getClassLoader();
  6.     Field declaredField = classLoader.getClass().getSuperclass().getDeclaredField("pathList");
  7.     declaredField.setAccessible(true);
  8.     Object[] objArr2 = (Object[]) fsd(declaredField.get(classLoader), "dexElements");
  9.     //publishProgress(objArr2);
  10.     Method declaredMethod3 = classLoader.getClass().getSuperclass().getSuperclass().getDeclaredMethod("findClass", new Class[]{String.class});
  11.     declaredMethod3.setAccessible(true);
  12.     for (Object obj : objArr2)
  13.     {
  14.         Object d = fsd(obj, "dexFile");
  15.         if (d != null)
  16.         {
  17.             Log("遍历类...");
  18.             Method declaredMethod4 = d.getClass().getDeclaredMethod("entries", new Class[0]);
  19.             if (!(declaredMethod4.invoke(d, new Object[0]) == null || (strArr = (String[]) fsd(declaredMethod4.invoke(d, new Object[0]), "mNameList")) == null || strArr.length == 0))
  20.             {
  21.                 Log("提取Dex");
  22.                 for (String str4 : strArr)
  23.                 {
  24.                     try
  25.                     {
  26.                         Class cls2 = (Class) declaredMethod3.invoke(classLoader, new Object[]{str4});
  27.                         Object invoke2 = cls2.getClass().getDeclaredMethod("getDex", new Class[0]).invoke(cls2, new Object[0]);
  28.                         if (!arrayList.contains(invoke2))
  29.                         {
  30.                             arrayList.add(invoke2);
  31.                         }
  32.                     } catch (Throwable th2) {}
  33.                 }
  34.                 continue;
  35.             }
  36.         }
  37.     }
  39.     if (arrayList.size() == 0)
  40.     {
  41.         return "找不到Dex！";
  42.     }
  44.     File file = new File(stord);
  45.     file.mkdirs();
  46.     int i = 1;
  47.     Iterator it = arrayList.iterator();
  49.     while (true)
  50.     {
  51.         int i2 = i;
  52.         if (it.hasNext())
  53.         {
  54.             Object next = it.next();
  55.             byte[] bArr2 = (byte[]) next.getClass().getDeclaredMethod("getBytes", new Class[0]).invoke(next, new Object[0]);
  56.             RandomAccessFile randomAccessFile2 = new RandomAccessFile(new File(file, "Dexdump" + (i2 == 1 ? "" : Integer.valueOf(i2)) + ".dex"), "rw");
  58.             randomAccessFile2.write(bArr2);
  59.             randomAccessFile2.close();
  60.             i = i2 + 1;
  61.         }
  62.         else
  63.         {
  64.             return "脱壳成功，共写出 " + (i2 - 1) + " 个dex，文件夹位于 "+ stord;
  65.         }
  66.     }
  67.     }