Android安全-[下载][讨论][推荐][原创]安卓dex不落地加载实现方法

此代码网络上可能是独一份
更多资源：https://bbs.kanxue.com/homepage-854079.htm

工具和样例下载位置最低部

# 不多说直接上代码：
此方法放在Application的attachBaseContext()中使用

private void test() {
        try {
            ClassLoader classLoader = getBaseContext().getClassLoader();
            ByteBuffer[] byteBuffer = {readFileByBB()};//dex文件列表
             
            Class<?> forName = Class.forName("dalvik.system.InMemoryDexClassLoader");
            Constructor<?> declaredConstructor = forName.getDeclaredConstructor(byteBuffer.getClass(),ClassLoader.class);//所有构造函数，包括公共的、私有的和受保护的构造函数
            Object newInstance = declaredConstructor.newInstance(byteBuffer,classLoader);//InMemoryDexClassLoader
             
            Class<?> superclass = forName.getSuperclass();
            Field field = forName.getSuperclass().getDeclaredField("pathList");
            field.setAccessible(true);//可读取
            Object pathListObj = field.get(newInstance);
            Class<?> DexPathList = Class.forName("dalvik.system.DexPathList");
            ArrayList<IOException> arrayList = new ArrayList<>();
            Method method = DexPathList.getMethod("makeInMemoryDexElements", byteBuffer.getClass(),List.class);
            Object invoke = method.invoke(null,byteBuffer, arrayList);//DexPathList$Element
            int length = Array.getLength(invoke);
            Object[] list = new Object[length];
            for (int i = 0; i < length; i++) {
                Object object = Array.get(invoke, 0);//DexPathList$Element[]
                list[i] = object;
            }
             
            make_dex_elements(classLoader,list);
             
            Class<?> loadClass = classLoader.loadClass("com.TestApp");
            System.out.println("----"+loadClass.getName());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

关键代码

private void make_dex_elements(ClassLoader classLoader, Object[] list) {
        Class<?> BaseDexClassLoader = classLoader.getClass().getSuperclass();
        try {
            Field field = BaseDexClassLoader.getDeclaredField("pathList");//BaseDexClassLoader.pathList
            field.setAccessible(true);
            Object DexPathList = field.get(classLoader);//DexPathList
            Class<? extends Object> class1 = DexPathList.getClass();//dalvik.system.DexPathList
             
            Field dexElements = class1.getDeclaredField("dexElements");
            dexElements.setAccessible(true);
            Object object = dexElements.get(DexPathList);//DexPathList$Element[] dexElements 属性值
             
            int length = Array.getLength(object);
            Class<?> forName = Class.forName("dalvik.system.DexPathList$Element");
             
            Object[] mergedArray = (Object[]) Array.newInstance(forName, length+list.length);
             
            System.arraycopy(list, 0, mergedArray, 0, list.length);
             
            // 将第二个数组的元素复制到新数组中
            System.arraycopy(object, 0, mergedArray, list.length, length);
             
            dexElements.set(DexPathList,mergedArray);
             
            System.out.println("----");
        } catch (Exception e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        System.out.println("----");
         
    }

在onCreate中调用以下方法

public void replaceApplicationContext(Application application) {
        Log.w("NDK_JIAGU", "replaceApplicationContext");
        try {
            // 先获取到ContextImpl对象
            Context contextImpl = application.getBaseContext();
 
            // 替换ContextImpl的代理Application
            Reflect.invokeMethod(contextImpl.getClass(), contextImpl,
                    new Object[]{sDelegateApplication}, "setOuterContext",
                    Context.class);
 
            // 替换ActivityThread的代理Application
            Object mMainThread = Reflect.getFieldValue(contextImpl.getClass(), contextImpl,
                    "mMainThread");
            Reflect.setFieldValue("android.app.ActivityThread", mMainThread, "mInitialApplication",
                    sDelegateApplication);
            // 替换ActivityThread的mAllApplications
            ArrayList<Application> mAllApplications =
                    (ArrayList<Application>) Reflect.getFieldValue("android.app.ActivityThread",
                            mMainThread, "mAllApplications");
            mAllApplications.add(sDelegateApplication);
            mAllApplications.remove(application);
 
            // 替换LoadedApk的代理Application
            Object loadedApk = Reflect.getFieldValue(contextImpl.getClass(), contextImpl,
                    "mPackageInfo");
            Reflect.setFieldValue("android.app.LoadedApk", loadedApk, "mApplication",
                    sDelegateApplication);
 
            // 替换LoadedApk中的mApplicationInfo中name
            ApplicationInfo applicationInfo =
                    (ApplicationInfo) Reflect.getFieldValue("android.app.LoadedApk",
                            loadedApk
                            , "mApplicationInfo");
            applicationInfo.className = sDelegateApplication.getClass().getName();
            sDelegateApplication.onCreate();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

以代码复制即可完成不落地加载
最后再说一句这不重要，重要的是如何反逆向，使用java加载dex的壳，毫无抵抗力，不如使用C/C++完成以上操作

百度网盘：85aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6H3j5h3&6Q4x3X3g2T1j5h3W2V1N6g2)9J5k6h3y4G2L8g2)9J5c8Y4y4Q4x3V1j5I4i4K6g2X3j5g2S2n7K9X3u0g2y4%4m8B7x3V1k6F1h3q4S2d9L8i4g2j5c8q4N6%4 提取码: gngf
蓝奏云：
d11K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4y4I4i4K6u0W2L8r3q4F1P5X3!0#2k6g2)9J5k6h3y4G2L8g2)9J5c8X3t1H3x3U0q4&6P5X3u0Z5K9h3j5`. 密码:hvgg

加密工具使用方法：https://bbs.kanxue.com/thread-276989.htm
3.3.1：https://bbs.kanxue.com/thread-276989.htm
3.3.5：版本已实现不落地加载，和加解密速度优化

最后于 6小时前被富到流油^-^编辑，原因：

上传的附件：

样例.apk （844.93kb，5次下载）

更多【Android安全-[下载][讨论][推荐][原创]安卓dex不落地加载实现方法】相关视频教程：www.yxfzedu.com

Android安全-[下载][讨论][推荐][原创]安卓dex不落地加载实现方法

相关文章推荐

Markdown Editor

友情链接

课程目录

技术交流QQ群