首頁‎ > ‎

Android 逆向工程重編譯 — UCam

專案目的


UCam(全能相機)是一款免費優秀的軟體(App),例如︰智能相機、全景相機、防抖動、軟體防手震等豐富功能。由於 Android 4.4(API 19)導入了「儲存空間存取架構」(Storage Access Framework,SAF),早期版本在新的裝置無法存取外部記憶卡(SD 卡)。

本專案使用逆向工程方法產生 Smali(dex2jar + jd-gui),新增儲存空間挑選器提示使用者選擇儲存位置;並引入 DocumentsProvider API 改寫儲存檔案機制,最後重新編譯 Smali 輸出 Apk,驗證逆向工程重編譯操作正確無誤。

專案成果


AppUtils.init(Landroid/content/Context;)V
new-instance v0, Landroid/content/Intent;
const-class v1, Lcom/example/test/StoragePermissionsActivity;      
sget-object v2, Lcom/ucamera/ucam/utils/AppUtils;->mContext:Landroid/content/Context;        
invoke-direct {v0, v2, v1}, Landroid/content/Intent;-><init>(Landroid/content/Context;Ljava/lang/Class;)V
invoke-virtual {v2, v0}, Landroid/content/Context;->startActivity(Landroid/content/Intent;)V

StoragePermissionsActivity.triggerStorageAccessFrameowrk()V
new-instance v1, Landroid/content/Intent;
const-string v0, "android.intent.action.OPEN_DOCUMENT_TREE"
invoke-direct {v1, v0}, Landroid/content/Intent;-><init>(Ljava/lang/String;)V
.local v1, "intent":Landroid/content/Intent;
const/16 v0, 0x2a
invoke-virtual {p0, v1, v0}, Lcom/example/test/StoragePermissionsActivity;->startActivityForResult(Landroid/content/Intent;I)V

StorageUtils.updateImage(Landroid/content/ContentResolver;Landroid/net/Uri;Ljava/lang/String;JLandroid/location/Location;I[BII)Z
invoke-static {p0, v0}, Landroid/support/v4/provider/DocumentFile;->fromTreeUri(Landroid/content/Context;Landroid/net/Uri;)Landroid/support/v4/provider/DocumentFile;
move-result-object v6
.local v6, "document":Landroid/support/v4/provider/DocumentFile;
const-string v0, "image"
invoke-virtual {v6, v0, v1}, Landroid/support/v4/provider/DocumentFile;->createFile(Ljava/lang/String;Ljava/lang/String;)Landroid/support/v4/provider/DocumentFile;
move-result-object v7
invoke-virtual {v7}, Landroid/support/v4/provider/DocumentFile;->getUri()Landroid/net/Uri;
move-result-object v0
const-string v1, "w"
 invoke-virtual {v5, v0, v1}, Landroid/content/ContentResolver;->openOutputStream(Landroid/net/Uri;Ljava/lang/String;)Ljava/io/OutputStream;
move-result-object v8
.local v8, "out":Ljava/io/OutputStream;
invoke-virtual {v8, p2}, Ljava/io/OutputStream;->write([B)V
invoke-virtual {v8}, Ljava/io/OutputStream;->close()V

註:專案展示內容取自軟體片段,純粹用於示範逆向工程應用的例子。

更新日期:2017/01/02