Android逆向-黑域app启动方案分析

407 阅读1分钟

黑域介绍 之后更名为黑阀闭源商业化了 jianyv.com/br/br.pdf jianyv.com/br/

adb -d shell sh /sdcard/Android/data/me.piebridge.brevent/brevent.sh

<?xml version="1.0" encoding="UTF-8"?>
<manifest android:compileSdkVersion="29" android:compileSdkVersionCodename="10" android:installLocation="1" android:versionCode="464" android:versionName="4.1.9" package="me.piebridge.brevent" platformBuildVersionCode="29" platformBuildVersionName="10" xmlns:android="http://schemas.android.com/apk/res/android">
  <uses-sdk android:minSdkVersion="24" android:targetSdkVersion="29" />
  <permission android:description="@string/perm_disabled_description" android:icon="@drawable/perm_disabled" android:label="@string/perm_disabled_label" android:name="me.piebridge.brevent.permission.BREVENT_DISABLED" android:protectionLevel="0x1" />
  <uses-permission android:name="android.permission.INTERNET" />
  <uses-permission-sdk-23 android:name="android.permission.ACCESS_NETWORK_STATE" />
  <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
  <uses-permission android:name="android.permission.READ_LOGS" />
  <uses-permission android:name="android.permission.PACKAGE_USAGE_STATS" />
  <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
  <uses-permission android:name="com.android.launcher.permission.INSTALL_SHORTCUT" />
  <uses-permission android:name="android.permission.DUMP" />
  <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
  <uses-permission android:name="com.android.vending.BILLING" />
  <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
  <uses-permission android:name="android.permission.WAKE_LOCK" />
  <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" />
  <uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" />
  <application android:allowBackup="false" android:extractNativeLibs="false" android:icon="@mipmap/con" android:label="@string/brevent" android:name="me.piebridge.brevent.ui.JianyuApplication" android:theme="@style/theme.pixel">
    <activity android:configChanges="0xfa0" android:name="me.piebridge.brevent.ui.BreventActivity" android:windowSoftInputMode="0x2">
      <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
      </intent-filter>
      <meta-data android:name="android.app.shortcuts" android:resource="@xml/shortcuts" />
    </activity>
    <activity android:configChanges="0xfa0" android:label="@string/menu_settings" android:name="me.piebridge.brevent.ui.BreventSettings" android:windowSoftInputMode="0x2" />
    <activity android:configChanges="0xfa0" android:name="me.piebridge.brevent.ui.BreventLauncher" android:windowSoftInputMode="0x2" />
    <activity android:configChanges="0xfa0" android:label="@string/menu_guide" android:name="me.piebridge.brevent.ui.BreventGuide" android:windowSoftInputMode="0x2" />
    <activity android:configChanges="0xfa0" android:label="@string/context_menu_appops" android:name="me.piebridge.brevent.ui.BreventOps" android:windowSoftInputMode="0x2" />
    <activity android:configChanges="0xfa0" android:label="@string/context_menu_appops" android:name="me.piebridge.brevent.ui.BreventOps2" android:windowSoftInputMode="0x2" />
    <activity android:configChanges="0xfa0" android:label="@string/menu_command" android:name="me.piebridge.brevent.ui.BreventCmd" android:windowSoftInputMode="0x2">
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.COMMAND" />
        <category android:name="android.intent.category.DEFAULT" />
      </intent-filter>
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.DEVELOPER" />
        <category android:name="android.intent.category.DEFAULT" />
      </intent-filter>
    </activity>
    <activity android:configChanges="0xfa0" android:exported="false" android:name="me.piebridge.brevent.ui.BreventLicenses" android:theme="@style/dialog.pixel" android:windowSoftInputMode="0x2">
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.VIEW_LICENSE" />
        <category android:name="android.intent.category.DEFAULT" />
      </intent-filter>
    </activity>
    <activity android:enabled="false" android:label="@string/shortcut_instant" android:name="me.piebridge.brevent.ui.BreventShortcutInstant">
      <intent-filter>
        <action android:name="android.intent.action.CREATE_SHORTCUT" />
        <category android:name="android.intent.category.DEFAULT" />
      </intent-filter>
    </activity>
    <activity android:exported="false" android:name="android.app.NativeActivity">
      <meta-data android:name="android.app.lib_name" android:value="reader" />
    </activity>
    <activity android:configChanges="0xfa0" android:label="@string/package_installer" android:launchMode="3" android:name="me.piebridge.brevent.ui.InstallActivity" android:theme="@style/dialog.pixel" android:windowSoftInputMode="0x2">
      <intent-filter android:label="@string/package_installer">
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data android:host="*" android:mimeType="application/zip" android:scheme="file" />
        <data android:host="*" android:mimeType="application/zip" android:scheme="content" />
        <data android:host="*" android:mimeType="application/octet-stream" android:scheme="file" />
        <data android:host="*" android:mimeType="application/octet-stream" android:scheme="content" />
      </intent-filter>
      <intent-filter android:label="@string/package_installer">
        <action android:name="android.intent.action.SEND" />
        <category android:name="android.intent.category.DEFAULT" />
        <data android:mimeType="application/zip" />
        <data android:mimeType="application/octet-stream" />
      </intent-filter>
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.PACKAGE_INSTALLER" />
      </intent-filter>
    </activity>
    <receiver android:enabled="@bool/enable_usb_checking" android:name="me.piebridge.brevent.ui.BreventUsbReceiver">
      <intent-filter>
        <action android:name="android.hardware.usb.action.USB_STATE" />
      </intent-filter>
    </receiver>
    <receiver android:name="me.piebridge.brevent.ui.BreventBootReceiver">
      <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED" />
      </intent-filter>
    </receiver>
    <receiver android:directBootAware="true" android:name="me.piebridge.brevent.ui.BreventDirectBootReceiver">
      <intent-filter>
        <action android:name="android.intent.action.LOCKED_BOOT_COMPLETED" />
      </intent-filter>
    </receiver>
    <receiver android:directBootAware="true" android:name="me.piebridge.brevent.ui.BreventServerReceiver" android:permission="android.permission.DEVICE_POWER">
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.HOME_TID" />
      </intent-filter>
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.ADD_PACKAGE" />
      </intent-filter>
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.BREVENT" />
      </intent-filter>
    </receiver>
    <service android:directBootAware="true" android:name="me.piebridge.brevent.ui.BreventIntentService" />
    <provider android:authorities="me.piebridge.brevent.fileprovider" android:exported="false" android:grantUriPermissions="true" android:name="io.jianyu.stats.StatsFileProvider">
      <meta-data android:name="android.support.FILE_PROVIDER_PATHS" android:resource="@xml/filepaths" />
    </provider>
    <provider android:authorities="me.piebridge.brevent.brevent.binder" android:enabled="true" android:exported="true" android:multiprocess="false" android:name="me.piebridge.brevent.ui.BreventBinderProvider" android:permission="android.permission.DEVICE_POWER" />
    <activity android:configChanges="0xfa0" android:exported="true" android:launchMode="1" android:name="me.piebridge.payment.WxApiActivity" />
    <activity-alias android:exported="true" android:name="me.piebridge.brevent.wxapi.WXEntryActivity" android:targetActivity="me.piebridge.payment.WxApiActivity" />
    <activity-alias android:exported="true" android:name="me.piebridge.brevent.wxapi.WXPayEntryActivity" android:targetActivity="me.piebridge.payment.WxApiActivity" />
    <meta-data android:name="firebase_analytics_collection_enabled" android:value="false" />
    <meta-data android:name="firebase_data_collection_default_enabled" android:value="false" />
    <meta-data android:name="firebase_messaging_auto_init_enabled" android:value="false" />
    <meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />
    <meta-data android:name="google_analytics_ssaid_collection_enabled" android:value="false" />
    <receiver android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementReceiver" />
    <service android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementService" />
    <service android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementJobService" android:permission="android.permission.BIND_JOB_SERVICE" />
    <service android:directBootAware="true" android:exported="false" android:name="com.google.firebase.components.ComponentDiscoveryService">
      <meta-data android:name="com.google.firebase.components:com.google.firebase.analytics.connector.internal.AnalyticsConnectorRegistrar" android:value="com.google.firebase.components.ComponentRegistrar" />
      <meta-data android:name="com.google.firebase.components:com.google.firebase.iid.Registrar" android:value="com.google.firebase.components.ComponentRegistrar" />
      <meta-data android:name="com.google.firebase.components:com.google.firebase.installations.FirebaseInstallationsRegistrar" android:value="com.google.firebase.components.ComponentRegistrar" />
    </service>
    <receiver android:exported="true" android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver" android:permission="com.google.android.c2dm.permission.SEND">
      <intent-filter>
        <action android:name="com.google.android.c2dm.intent.RECEIVE" />
      </intent-filter>
    </receiver>
    <provider android:authorities="me.piebridge.brevent.firebaseinitprovider" android:exported="false" android:initOrder="100" android:name="com.google.firebase.provider.FirebaseInitProvider" />
    <meta-data android:name="com.google.android.gms.version" android:value="@integer/google_play_services_version" />
    <meta-data android:name="com.android.vending.splits" android:value="@xml/splits0" />
    <meta-data android:name="com.android.vending.derived.apk.id" android:value="1" />
  </application>
</manifest>

motionelf-v0.5.2.apk

写入motionelf_server 这个文件 chmod 420

#!/system/bin/sh

path=/data/data/me.piebridge.brevent/brevent.sh
comp=me.piebridge.brevent/.ui.BreventActivity

if [ ! -r $path ]; then
    am start -n $comp
    sleep 3
fi

/system/bin/sh $path

if [ $? -eq 0 ]; then
    am start -n $comp
fi

/*
 * Copyright 2017 By_syk
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.example.administrator.myapplication;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class BreventAdbHelper {
    public static void main(String[] args) {
        // 检查设备是否处于调试模式并通过USB连接电脑
        
        final String CMD_CHECK_DEVICE = "adb devices";
        System.out.println("> executing:\n" + CMD_CHECK_DEVICE);
        String result = execAdbCmd(CMD_CHECK_DEVICE);
        int deviceNum = result.trim().split("\n").length - 1;
        if (deviceNum == 0) {
            System.out.println("> result:\nno device/emulator");
            return;
        } else if (deviceNum > 1) {
            System.out.println("> result:\nmore than one device/emulator");
            return;
        }
        
        // 检查设备是否已安装「ADB Clipboard GetSet」
        
        final String CMD_CHECK_APK_ADB = "adb shell dumpsys package com.by_syk.adbclipboard";
        System.out.println("> executing:\n" + CMD_CHECK_APK_ADB);
        result = execAdbCmd(CMD_CHECK_APK_ADB);
        if (!result.contains("versionName=")) {
            System.out.println("> result:\ncom.by_syk.adbclipboard not installed");
            return;
        }
        
        // 启动设备上的「黑域」
        
        final String CMD_CHECK_BREVENT = "adb shell am start -n me.piebridge.brevent/me.piebridge.brevent.ui.BreventActivity";
        System.out.println("> executing:\n" + CMD_CHECK_BREVENT);
        result = execAdbCmd(CMD_CHECK_BREVENT);
        if (!result.contains("Starting:")) {
            System.out.println("> result:\nme.piebridge.brevent not installed");
            return;
        }
        
        // 从设备获取黑域复制到剪切板的ADB命令并执行
        
        final String CMD_CLIP_GET = "adb shell am broadcast -a adbclipget";
        System.out.println("> executing:\n" + CMD_CLIP_GET);
        result = execAdbCmd(CMD_CLIP_GET);
        // result=-1: Activity.RESULT_OK, result=0: Activity.RESULT_CANCELED 
        Matcher matcher = Pattern.compile("result=-1, data=\"(.+?)\"").matcher(result);
        if (matcher.find()) {
            String breventCmd = matcher.group(1);
            if (breventCmd.contains("adb")) {
                System.out.println("> executing:\n" + breventCmd);
                result = execAdbCmd(breventCmd);
                if (result.contains("brevent_server started")) {
                    System.out.println("> result:\nall done");
                } else {
                    System.out.println("> result:\n" + result);
                }
                return;
            }
        }
        System.out.println("> result:\nno Brevent command found in clipboard");
    }
    
    private static String execAdbCmd(String cmd) {
        String result = "";
        
        Runtime runtime = Runtime.getRuntime();
        Process process = null;
        BufferedReader bufferedReader = null;
        try {
            process = runtime.exec(cmd);
            bufferedReader = new BufferedReader(new InputStreamReader(process.getInputStream(), "utf-8"));
            String buffer;
            while ((buffer = bufferedReader.readLine()) != null) {
                result += buffer + "\n";
            }
            if (result.length() > 0) {
                result = result.substring(0, result.length() - 1);
            }
        } catch (IOException e) {
            e.printStackTrace();
        } finally {
            if (bufferedReader != null) {
                try {
                    bufferedReader.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
            if (process != null) {
                process.destroy();
                process = null;
            }
        }
        
        return result;
    }
}