Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kotlin 编码中,拼接的字符串没法进行加密 #155

Open
liyeatgithub opened this issue Feb 28, 2024 · 2 comments
Open

kotlin 编码中,拼接的字符串没法进行加密 #155

liyeatgithub opened this issue Feb 28, 2024 · 2 comments

Comments

@liyeatgithub
Copy link

项目使用kotlin编码,反编译之后,发现一旦使用拼接的字符串,如"this is a $it" 或者 "abc"+"bcd",等。就没办法进行字符串加密。反编译apk之后。发现这些字符串仍然存在。编译之后,kotlin会将这些字符串转化为StringBuilder的形式。导致Stringfog没有生效。反编译之后还是原始字符串。大家有遇到这个问题么?怎么解决呢?

@rhettor
Copy link

rhettor commented Dec 15, 2024

我最近也碰到这个问题,排查半天发现是集成项目编译的JDK版本问题。新建项目默认为JavaVersion.VERSION_11,改为JavaVersion.VERSION_1_8就正常了,记得同时要改kotlinOptions中的jvmTarget。至于这是什么原因就不清楚了

@rhettor
Copy link

rhettor commented Dec 15, 2024

通过javap -c -v对比两个版本的字节码发现在JAVA8JAVA11(字符串还带有\u0001)中字符串存放在Constant pool,但是在获取的时候有所不同:

JAVA8 -> 通过ldc指令直接获取常量池中的字符串
JAVA11 -> 通过invokedynamic调用BootstrapMethods中的java/lang/invoke/StringConcatFactory.makeConcatWithConstants方法(此方法是在JAVA9中改善StringBuilder拼接问题)

造成ASM在visitMethodInsn()方法中无法找到java/lang/StringBuilder的调用,以及visitLdcInsn()方法中无法找到常量的获取。因此只能在visitInvokeDynamicInsn()方法中处理makeConcatWithConstants

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants