zoukankan      html  css  js  c++  java
  • 加固前奏2-替换application

    运行加载过程
    ActivityThread.JAVA
    Application app = data.info.makeApplication(data.restrictedBackupMode, null);
                                ->进入LoadedApk.java
                                        String appClass = mApplicationInfo.className;
                                        app.attachBaseContext()        //可控函数
                                        ...
                                        mActivityThread.mAllApplications.add(app);
                                        mApplication = app;
                                <-退出
    mInitialApplication = app;
    mInstrumentation.callApplicationOnCreate(app);
                                ->    app.onCreate()                //可控函数

    onCreate中实现

            Object currentActivityThread = javaRef.invokeStaticMethod("android.app.ActivityThread", "currentActivityThread",
                    new Class[]{}, new Object[]{});
    				
            Object mBoundApplication = javaRef.getFieldValue("android.app.ActivityThread", "mBoundApplication", currentActivityThread);
            Object loadedApk = javaRef.getFieldValue("android.app.ActivityThread$AppBindData", "info", mBoundApplication);
    
            javaRef.setFieldValue("android.app.LoadedApk", "mApplication", loadedApk, null);
            ApplicationInfo applicationInfo_loadapk = (ApplicationInfo) javaRef.getFieldValue("android.app.LoadedApk", "mApplicationInfo", loadedApk);
            String desAppName = "com.cc.shell.MyApplication";
            applicationInfo_loadapk.className = desAppName;
    
            Application oldApplication = (Application) javaRef.getFieldValue("android.app.ActivityThread", "mInitialApplication", currentActivityThread);
    
            ArrayList<Application> mAllApplications = (ArrayList<Application>) javaRef.getFieldValue("android.app.ActivityThread",
                    "mAllApplications", currentActivityThread);
            mAllApplications.remove(oldApplication);
    
            Application realApp = (Application) javaRef.invokeMethod("android.app.LoadedApk", "makeApplication", loadedApk
                    , new Class[]{boolean.class, Instrumentation.class}, new Object[]{false, null});
    
            realApp.onCreate();
    
            javaRef.setFieldValue("com.android.ActivityThread", "mInitialApplication", currentActivityThread, realApp);
  • 相关阅读:
    Mac OS X下GnuPlot的安装
    为PHP编译imap扩展
    jQuery做个TextBox自动完成条
    sql 查询模块
    WinForm控件查找奇思
    支持拼音检索的TextBox扩展控件使用
    自定义控件重写Listbox实现item图标变换和item点击事件
    支持拼音检索的TextBox扩展控件
    (转)SendMessage API
    使用C#获取CPU及硬盘序列号的源代码
  • 原文地址:https://www.cnblogs.com/lyxin/p/10052313.html
Copyright © 2011-2022 走看看