zoukankan      html  css  js  c++  java
  • 加固前奏2-替换application

    运行加载过程
    ActivityThread.JAVA
    Application app = data.info.makeApplication(data.restrictedBackupMode, null);
                                ->进入LoadedApk.java
                                        String appClass = mApplicationInfo.className;
                                        app.attachBaseContext()        //可控函数
                                        ...
                                        mActivityThread.mAllApplications.add(app);
                                        mApplication = app;
                                <-退出
    mInitialApplication = app;
    mInstrumentation.callApplicationOnCreate(app);
                                ->    app.onCreate()                //可控函数

    onCreate中实现

            Object currentActivityThread = javaRef.invokeStaticMethod("android.app.ActivityThread", "currentActivityThread",
                    new Class[]{}, new Object[]{});
    				
            Object mBoundApplication = javaRef.getFieldValue("android.app.ActivityThread", "mBoundApplication", currentActivityThread);
            Object loadedApk = javaRef.getFieldValue("android.app.ActivityThread$AppBindData", "info", mBoundApplication);
    
            javaRef.setFieldValue("android.app.LoadedApk", "mApplication", loadedApk, null);
            ApplicationInfo applicationInfo_loadapk = (ApplicationInfo) javaRef.getFieldValue("android.app.LoadedApk", "mApplicationInfo", loadedApk);
            String desAppName = "com.cc.shell.MyApplication";
            applicationInfo_loadapk.className = desAppName;
    
            Application oldApplication = (Application) javaRef.getFieldValue("android.app.ActivityThread", "mInitialApplication", currentActivityThread);
    
            ArrayList<Application> mAllApplications = (ArrayList<Application>) javaRef.getFieldValue("android.app.ActivityThread",
                    "mAllApplications", currentActivityThread);
            mAllApplications.remove(oldApplication);
    
            Application realApp = (Application) javaRef.invokeMethod("android.app.LoadedApk", "makeApplication", loadedApk
                    , new Class[]{boolean.class, Instrumentation.class}, new Object[]{false, null});
    
            realApp.onCreate();
    
            javaRef.setFieldValue("com.android.ActivityThread", "mInitialApplication", currentActivityThread, realApp);
  • 相关阅读:
    网络通信协议八之(传输层)TCP协议详解
    MongoDB数据库连接失败
    Flask web开发之路十四
    Flask web开发之路十三
    Flask web开发之路十二
    Flask web开发之路十一
    Flask web开发之路十
    NEERC 1999 Advertisement /// oj22646
    upper_bound() lower_bound() 用法
    palindrome 回文 /// Manacher算法
  • 原文地址:https://www.cnblogs.com/lyxin/p/10052313.html
Copyright © 2011-2022 走看看