前面走马观花的看了几个模块的源码,看到是用python(会加载自定义的java类)写的。产生2个问题:在命令行中输入command,drozer是如何去执行的;python是如何与java交互的。
drozer console connect:
当我们在命令行输入以上字符串时,在drozer中是如此来执行的:
1 Console().run(sys.argv[2::])
——>2 def run(self, argv=None)
——>3 self.__invokeCommand(arguments)
——>4 getattr(self, "do_" + command)(arguments)
——>5 def do_connect(self, arguments)
——> 6.1 response = server.startSession(device, password)
——>6.1.1 self.sendAndReceive(SystemRequestFactory.startSession(device_id))
——>6.1.1.1 startSession(device_id)
6.1.1.2self.sendAndReceive(builder)
——>6.1.1.2.1 message_id = self.send(message)
6.1.1.2.2 elif response.id == message_id: return response
6.2 if response.type == Message.SYSTEM_RESPONSE and response.system_response.status==Message.SystemResponse.SUCCESS: session_id =response.system_response.session_id
——>6.2.1 session = Session(server, session_id, arguments)
6.2.2 session.cmdloop()
当输入drozer console connect时,首先会把提取argv[2::]即connect。在步骤2里的run函数里经过转换去执行do_connect方法即步骤5。上面这几步都是次要的,接下来才是主题。步骤6.1建立会话过程;若会话建立成功即步骤6.2,进入6.2.2等待命令的输入,至此drozer console connect 命令全部执行完毕。需要理解什么是会话?
看上面的执行步骤我们可以看到,会话是在步骤6.1.1过程中建立的。在步骤6.1.1.1中封装开始会话请求信息及加入设备ID,budiler。
<span style="white-space:pre"> </span>builder = SystemRequestFactory(Message.SystemRequest.START_SESSION) #注意这里请求的参数是start_session builder.addDeviceId(device_id) return builder
至此,步骤6.1.1变成变成步骤6.1.1.2。sendAndReceive中的操作:发送msg和接收到对应的msg才返回。详细分析发送和接收过程:首先给msg自动分配唯一标识符message_id,并通过socket将msg发送给agent;接收msg,通过message_id来识别是否为之前发送出去msg的返回信息。ok,会话建立过程就是给agent发送Message.SystemRequest.START_SESSION。
继续步骤6.2.1,初始化session,在此期间会输出drozer的由字母组成的头像(在最后)。接着进入步骤6.2.2cmdloop(),在preloop()中输出drozer console的版本号,接着循环等待用户输入命令。
run app.service.send:
上面的cmdloop在等待用户的输入,输入以上的字符串。读取字符串到argv中argv[0] = run,argv[1] = app.service.send。根据list[0]会先进入Session类中的do_run方法(Session类中有很多do_xx方法)。然后判断argv[1]是不是模块命令(module.run(argv[1:]))进入drozer.module.base.py中Module类(每个命令都是继承自Module类:class Send(Module, common.ServiceBinding))中的run方法:
<span style="font-size:18px;"> parser = self.__prepare_parser() parser.description = self.usage.formatted_description() parser.usage = self.usage.formatted_usage(parser) if "-h" in args or "--help" in args: return parser.print_help() else: arguments = parser.parse_args(args) if hasattr(self, 'execute'): <span style="color:#ff0000;">result = self.execute</span></span>
至此,self.execute(arguments)就去执行类app.service.send下的execute方法了。之前分析过app.service.send的执行过程中会加载自定义的java类来发送和接收service的msg,注意send类的定义class Send(Module, common.ServiceBinding):
<span style="font-size:18px;"> def obtain_binder(self): if self.binder == None: ServiceBinder = self.context.loadClass("common/ServiceBinder.apk", "ServiceBinder") self.binder = self.context.new(ServiceBinder) return self.binder</span>
首先会调用loader.py文件中的ClassLoader里的loadclass方法(class ServiceBinding(loader.ClassLoader))。
def loadClass(self, source, klass, relative_to=None): """ Load a Class from a local apk file (source) on the running Dalvik VM. """ if relative_to == None: relative_to = os.path.join(os.path.dirname(__file__), "..") elif relative_to.find(".py") >= 0 or relative_to.find(".pyc") >= 0: relative_to = os.path.dirname(relative_to) if not Module.cached_klass(".".join([source, klass])): loader = utils.ClassLoader(source, self.__get_cache_path(), self.__get_constructor(), self.klass('java.lang.ClassLoader').getSystemClassLoader(), relative_to=relative_to) loader.android_path = lambda: Configuration.library("android.jar") loader.dx_path = lambda: Configuration.executable("dx.bat") if platform.system() == "Windows" else Configuration.executable("dx") loader.javac_path = lambda: Configuration.executable("javac") Module.cache_klass(".".join([source, klass]), loader.loadClass(klass)) return Module.get_cached_klass(".".join([source, klass]))
loadClass()先利用反射得到ClassLoader来初始化loader,然后利用loader将klass(自定义的java类)装载进dvm。先看反射步骤:.klass('java.lang.ClassLoader')
Module类中的klass方法:
def klass(self, class_name): """ Resolves a class name, and returns an object reference for the class. """ if not Module.cached_klass(class_name): Module.cache_klass(class_name, self.reflector.resolve(class_name)) return Module.get_cached_klass(class_name)
通过Module.cached_klass判断当前类名是否已在Module__klass中,若不存在则调用self.reflector.resolve来加载并在cache_klass中记录(一个cached,一个是cache)。reflector.resolve: <—— reflector.py
def resolve(self, class_name): """ Resolves a Java class, given its fully qualified name, and returns a ReflectedObject that can be used to instantiate it with #construct. """ response = self.sendAndReceive(ReflectionRequestFactory.resolve(class_name)) if response is None: raise ReflectionException("expected a response to RESOLVE") elif response.reflection_response.status == Message.ReflectionResponse.SUCCESS: return ReflectedType.fromArgument(response.reflection_response.result, reflector=self) else: raise ReflectionException(response.reflection_response.errormessage)
分两步:resolve(class_name)组合msg;sendAndReceive发送msg要求Reflection calss_name。到此为止得到java.lang.ClassLoader,然后再loader.loadClass(klass)
def loadClass(self, klass): return self.getClassLoader().loadClass(klass); def getClassLoader(self): """ Gets a DexClassLoader on the agent, given compiled source or an apk file from the local system. """ self.source = self.__get_source(self.source_or_relative_path, relative_to=self.relative_to) if self.source != None: file_path = "/".join([self.cache_path, self.__get_cached_apk_name()]) file_io = self.construct('java.io.File', file_path) if not self.__verify_file(file_io, self.source): source_data = [ReflectedPrimitive("byte", (ord(i) if ord(i) < 128 else ord(i) - 0x100), reflector=None) for i in self.source] file_stream = self.construct("java.io.FileOutputStream", file_path) file_stream.write(source_data, 0, len(source_data)) file_stream.close() return self.construct('dalvik.system.DexClassLoader', file_path, self.cache_path, None, self.system_class_loader) else: raise RuntimeError("drozer could not find or compile a required extension library. ")
ok,仔细分析发现上面对于涉及到java的操作都是利用sendAndReceive来实现的(关于message如何定义查看https://github.com/mwrlabs/mercury-common/blob/master/protobuf.proto)。
startSession:sendAndReceive()——>Message.SystemRequest.START_SESSION
reflector.resolve:sendAndReceive()——>Message.ReflectionRequest.RESOLVE
construct : sendAndReceive()——> Message.REFLECTION_REQUEST
.....
sendAndReceive是通过socket把msg发送给agent的,实际还是由agent来执行。
参考资料:Android开源审计框架drozer--源码浅析
版权声明:本文为博主原创文章,未经博主允许不得转载。