diff --git a/.classpath b/.classpath new file mode 100644 index 0000000..ad593f2 --- /dev/null +++ b/.classpath @@ -0,0 +1,10 @@ + + + + + + + + + + diff --git a/.project b/.project new file mode 100644 index 0000000..fbece2a --- /dev/null +++ b/.project @@ -0,0 +1,33 @@ + + + ZjDroid + + + + + + com.android.ide.eclipse.adt.ResourceManagerBuilder + + + + + com.android.ide.eclipse.adt.PreCompilerBuilder + + + + + org.eclipse.jdt.core.javabuilder + + + + + com.android.ide.eclipse.adt.ApkBuilder + + + + + + com.android.ide.eclipse.adt.AndroidNature + org.eclipse.jdt.core.javanature + + diff --git a/.settings/org.eclipse.jdt.core.prefs b/.settings/org.eclipse.jdt.core.prefs new file mode 100644 index 0000000..8000cd6 --- /dev/null +++ b/.settings/org.eclipse.jdt.core.prefs @@ -0,0 +1,11 @@ +eclipse.preferences.version=1 +org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.6 +org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve +org.eclipse.jdt.core.compiler.compliance=1.6 +org.eclipse.jdt.core.compiler.debug.lineNumber=generate +org.eclipse.jdt.core.compiler.debug.localVariable=generate +org.eclipse.jdt.core.compiler.debug.sourceFile=generate +org.eclipse.jdt.core.compiler.problem.assertIdentifier=error +org.eclipse.jdt.core.compiler.problem.enumIdentifier=error +org.eclipse.jdt.core.compiler.source=1.6 diff --git a/AndroidManifest.xml b/AndroidManifest.xml new file mode 100644 index 0000000..25e55bf --- /dev/null +++ b/AndroidManifest.xml @@ -0,0 +1,37 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/README.md b/README.md index efbcb42..873147b 100644 --- a/README.md +++ b/README.md @@ -2,3 +2,67 @@ ZjDroid ======= Android app dynamic reverse tool based on Xposed framework. + + +一、ZjDroid工具介绍 + +ZjDroid是基于Xposed Framewrok的动态逆向分析模块,逆向分析者可以通过ZjDroid完成以下工作: +1、DEX文件的内存dump +2、基于Dalvik关键指针的内存BackSmali,有效破解加固应用 +3、敏感API的动态监控 +4、指定内存区域数据dump +5、获取应用加载DEX信息。 +6、获取指定DEX文件加载类信息。 +7、dump Dalvik java堆信息。 +8、在目标进程动态运行lua脚本。 + + +二、ZjDroid相关命令 + +1、获取APK当前加载DEX文件信息: +adb shell am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"dump_dexinfo"}' + +2、获取指定DEX文件包含可加载类名: +adb shell am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"dump_class","dexpath":"*****"}' + +4、根据Dalvik相关内存指针动态反编译指定DEX,并以文件形式保存。 +adb shell am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"backsmali","dexpath":"*****"}' + +该方式可以脱壳目前大部分流行的加固防护。(由于手机性能问题,运行较忙) +例外情况: +由于ApkProtect特定防修改检测,需要做如下修改即可解固该保护: +(1)在设备上创建特定目录(如/data/local)并 chmod 为777 +(2)复制zjdroid.apk到该目录,并修改文件名为zjdroid.jar + (3) 修改/data/data/de.robv.android.xposed.installer/conf/modules.list 模块代码文件修改为"zjdroid.jar" +从启设备即可。 + +5、Dump指定DEX内存中的数据并保存到文件(数据为odex格式,可在pc上反编译)。 +adb shell am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"dump_dex","dexpath":"*****"}' + + +6、Dump指定内存空间区域数据到文件 +adb shell am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"dump_mem","start":1234567,"length":123}' + +7、Dump Dalvik堆栈信息到文件,文件可以通过java heap分析工具分析处理。 +adb shell am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"dump_heap"}' + +8、运行时动态调用Lua脚本 +该功能可以通过Lua脚本动态调用java代码。 +使用场景: +可以动态调用解密函数,完成解密。 +可以动态触发特定逻辑。 +adb shell am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"invoke","filepath":"****"}' + +luajava相关使用方法: +http://www.keplerproject.org/luajava/ + +8、敏感API调用监控 + + +三、相关命令执行结果查看: + +1、命令执行结果: +adb shell logcat -s zjdroid-shell-{package name} + +2、敏感API调用监控输出结果: +adb shell logcat -s zjdroid-apimonitor-{package name} diff --git a/XposedBridgeApi-54.jar b/XposedBridgeApi-54.jar new file mode 100644 index 0000000..fefd4ec Binary files /dev/null and b/XposedBridgeApi-54.jar differ diff --git a/assets/xposed_init b/assets/xposed_init new file mode 100644 index 0000000..dd6a13f --- /dev/null +++ b/assets/xposed_init @@ -0,0 +1 @@ +com.android.reverse.mod.ReverseXposedModule \ No newline at end of file diff --git a/ic_launcher-web.png b/ic_launcher-web.png new file mode 100644 index 0000000..a18cbb4 Binary files /dev/null and b/ic_launcher-web.png differ diff --git a/lib/.gitignore b/lib/.gitignore new file mode 100644 index 0000000..85797d6 --- /dev/null +++ b/lib/.gitignore @@ -0,0 +1 @@ +/sdk_sources_15 diff --git a/lib/full_framework_15.jar b/lib/full_framework_15.jar new file mode 100644 index 0000000..36129b6 Binary files /dev/null and b/lib/full_framework_15.jar differ diff --git a/libs/android-support-v4.jar b/libs/android-support-v4.jar new file mode 100644 index 0000000..cf12d28 Binary files /dev/null and b/libs/android-support-v4.jar differ diff --git a/libs/antlr-3.5.2-complete.jar b/libs/antlr-3.5.2-complete.jar new file mode 100644 index 0000000..260de76 Binary files /dev/null and b/libs/antlr-3.5.2-complete.jar differ diff --git a/libs/armeabi/libdvmnative.so b/libs/armeabi/libdvmnative.so new file mode 100644 index 0000000..ed67d4a Binary files /dev/null and b/libs/armeabi/libdvmnative.so differ diff --git a/libs/armeabi/libluajava.so b/libs/armeabi/libluajava.so new file mode 100644 index 0000000..d5ed9d6 Binary files /dev/null and b/libs/armeabi/libluajava.so differ diff --git a/libs/commons-cli-1.2.jar b/libs/commons-cli-1.2.jar new file mode 100644 index 0000000..ce4b9ff Binary files /dev/null and b/libs/commons-cli-1.2.jar differ diff --git a/libs/guava-17.0.jar b/libs/guava-17.0.jar new file mode 100644 index 0000000..661fc74 Binary files /dev/null and b/libs/guava-17.0.jar differ diff --git a/lint.xml b/lint.xml new file mode 100644 index 0000000..7edd00c --- /dev/null +++ b/lint.xml @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/proguard-project.txt b/proguard-project.txt new file mode 100644 index 0000000..f2fe155 --- /dev/null +++ b/proguard-project.txt @@ -0,0 +1,20 @@ +# To enable ProGuard in your project, edit project.properties +# to define the proguard.config property as described in that file. +# +# Add project specific ProGuard rules here. +# By default, the flags in this file are appended to flags specified +# in ${sdk.dir}/tools/proguard/proguard-android.txt +# You can edit the include path and order by changing the ProGuard +# include property in project.properties. +# +# For more details, see +# http://developer.android.com/guide/developing/tools/proguard.html + +# Add any project specific keep options here: + +# If your project uses WebView with JS, uncomment the following +# and specify the fully qualified class name to the JavaScript interface +# class: +#-keepclassmembers class fqcn.of.javascript.interface.for.webview { +# public *; +#} diff --git a/project.properties b/project.properties new file mode 100644 index 0000000..ce39f2d --- /dev/null +++ b/project.properties @@ -0,0 +1,14 @@ +# This file is automatically generated by Android Tools. +# Do not modify this file -- YOUR CHANGES WILL BE ERASED! +# +# This file must be checked in Version Control Systems. +# +# To customize properties used by the Ant build system edit +# "ant.properties", and override values to adapt the script to your +# project structure. +# +# To enable ProGuard to shrink and obfuscate your code, uncomment this (available properties: sdk.dir, user.home): +#proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt + +# Project target. +target=android-18 diff --git a/res/drawable-hdpi/ic_launcher.png b/res/drawable-hdpi/ic_launcher.png new file mode 100644 index 0000000..b1d506a Binary files /dev/null and b/res/drawable-hdpi/ic_launcher.png differ diff --git a/res/drawable-hdpi/logo.png b/res/drawable-hdpi/logo.png new file mode 100644 index 0000000..0bc3f97 Binary files /dev/null and b/res/drawable-hdpi/logo.png differ diff --git a/res/drawable-mdpi/ic_launcher.png b/res/drawable-mdpi/ic_launcher.png new file mode 100644 index 0000000..b1d506a Binary files /dev/null and b/res/drawable-mdpi/ic_launcher.png differ diff --git a/res/drawable-xhdpi/ic_launcher.png b/res/drawable-xhdpi/ic_launcher.png new file mode 100644 index 0000000..b1d506a Binary files /dev/null and b/res/drawable-xhdpi/ic_launcher.png differ diff --git a/res/drawable-xxhdpi/ic_launcher.png b/res/drawable-xxhdpi/ic_launcher.png new file mode 100644 index 0000000..b1d506a Binary files /dev/null and b/res/drawable-xxhdpi/ic_launcher.png differ diff --git a/res/layout/activity_main.xml b/res/layout/activity_main.xml new file mode 100644 index 0000000..43cddab --- /dev/null +++ b/res/layout/activity_main.xml @@ -0,0 +1,38 @@ + + + + + + +