#include <jni.h> #include <string.h> #include <stdlib.h> #include <stdio.h> #include <android/log.h> #include <sys/stat.h> #include <unistd.h> #include <sys/types.h> #include <elf.h> #include <sys/mman.h> #include <assert.h> /*************************************************************************************** * * 宏定义 * ****************************************************************************************/ //输出调试信息到logcat #define DEBUG #define LOG_TAG "LOG_ANDROID_SHELL" #define LOGI(...) __android_log_print(ANDROID_LOG_INFO,LOG_TAG,__VA_ARGS__) #define LOGE(...) __android_log_print(ANDROID_LOG_ERROR,LOG_TAG,__VA_ARGS__) //求一维数组元素个数 # define NELEM(x) ((int) (sizeof(x) / sizeof((x)[0]))) //Application类，壳入口 #define JNIREG_CLASS "com/lzy/androidshell/MainApplication" /*************************************************************************************** * * 范例代码 * ****************************************************************************************/ //解密dex JNIEXPORT void JNICALL sub_1111(JNIEnv* env, jobject thiz, jobject context) { jclass native_clazz = env->GetObjectClass(context); jmethodID methodID_func = env->GetMethodID(native_clazz, "getPackageName", "()Ljava/lang/String;"); jstring packagename = (jstring) (env->CallObjectMethod(context, methodID_func)); const char *str = env->GetStringUTFChars(packagename, 0); char destination[128]; const char *blank = "/data/data/", *c = "/.cache/"; strcpy(destination, blank); strcat(destination, str); strcat(destination, c); LOGI("stringcccccccccccccccc %s", destination); env->ReleaseStringUTFChars(packagename, str); jint a = mkdir(destination, 777); LOGI("Created a file in android! %d", a); const char *pre = "chmod 755 "; char cmd[128]; strcpy(cmd, pre); strcat(cmd, destination); LOGI("cmd %s", cmd); jstring jcmd = CharTojstring(env, cmd); //exec jclass Runtime = env->FindClass("java/lang/Runtime"); jmethodID Runtime_func = env->GetStaticMethodID(Runtime, "getRuntime", "()Ljava/lang/Runtime;"); jobject class_obj = env->CallStaticObjectMethod(Runtime, Runtime_func); jclass class_java = env->GetObjectClass(class_obj); jmethodID exec_func = env->GetMethodID(class_java, "exec", "(Ljava/lang/String;)Ljava/lang/Process;"); jobject method_obj = env->CallObjectMethod(class_obj, exec_func, jcmd); jclass class_method_obj = env->GetObjectClass(method_obj); jmethodID waitfor_func = env->GetMethodID(class_method_obj, "waitFor", "()I"); jint result = env->CallIntMethod(method_obj, waitfor_func); LOGI("CallIntMethod %d", result); jclass native_clazz2 = env->GetObjectClass(context); jmethodID methodID_func2 = env->GetMethodID(native_clazz2, "getPackageName", "()Ljava/lang/String;"); jstring packagename2 = (jstring) (env->CallObjectMethod(context, methodID_func2)); const char *str2 = env->GetStringUTFChars(packagename2, 0); char destination2[128]; const char *blank2 = "/data/data/", *c2 = "/.cache/classdex.jar"; strcpy(destination2, blank2); strcat(destination2, str2); strcat(destination2, c2); LOGI("string %s", destination2); LOGI("log test ok "); env->ReleaseStringUTFChars(packagename2, str2); jstring jdestination = CharTojstring(env, destination2); jmethodID methodID_getApplicationInfo = env->GetMethodID(native_clazz2, "getApplicationInfo", "()Landroid/content/pm/ApplicationInfo;"); jobject ApplicationInfo = env->CallObjectMethod(context, methodID_getApplicationInfo); jclass cls_ApplicationInfo = env->GetObjectClass(ApplicationInfo); jfieldID JarFieldId = env->GetFieldID(cls_ApplicationInfo, "publicSourceDir", "Ljava/lang/String;"); jstring SourceDir = (jstring) (env->GetObjectField(ApplicationInfo, JarFieldId)); const char *strs = env->GetStringUTFChars(SourceDir, 0); char destinations[128]; strcpy(destinations, strs); jbyteArray bytes = env->NewByteArray(65536); LOGI("HAHAHAHHAHAHAHA %s", destinations); env->ReleaseStringUTFChars(SourceDir, strs); LOGI("HAHAHAHHAHAHAHA222222222222222"); char *classdex_jar2 = "assets/ErickyProtect.so"; jstring jclassdex_jar = CharTojstring(env, classdex_jar2); jclass cls_JarFile = env->FindClass("java/util/jar/JarFile"); jmethodID methodID_JarFile = env->GetMethodID(cls_JarFile, "<init>", "(Ljava/lang/String;)V"); jobject localJarFile = env->NewObject(cls_JarFile, methodID_JarFile, SourceDir); //localjarFile getEntry method jmethodID methodID_getentry = env->GetMethodID(cls_JarFile, "getEntry", "(Ljava/lang/String;)Ljava/util/zip/ZipEntry;"); jobject LocalZipEntry = env->CallObjectMethod(localJarFile, methodID_getentry, jclassdex_jar); //localjarFile getInputStream method jmethodID methodID_getInputStream = env->GetMethodID(cls_JarFile, "getInputStream", "(Ljava/util/zip/ZipEntry;)Ljava/io/InputStream;"); jobject BufferinputstreamParam = env->CallObjectMethod(localJarFile, methodID_getInputStream, LocalZipEntry); //new a File class jclass cls_File = env->FindClass("java/io/File"); jmethodID methodID_File = env->GetMethodID(cls_File, "<init>", "(Ljava/lang/String;)V"); jobject localFile = env->NewObject(cls_File, methodID_File, jdestination); //new BufferedInputStream jclass cls_BufferedInputStream = env->FindClass( "java/io/BufferedInputStream"); jmethodID methodID_BufferedInputStream = env->GetMethodID( cls_BufferedInputStream, "<init>", "(Ljava/io/InputStream;)V"); jobject localBufferedInputStream = env->NewObject(cls_BufferedInputStream, methodID_BufferedInputStream, BufferinputstreamParam); //new FileoutputStream jclass cls_FileOutputStream = env->FindClass("java/io/FileOutputStream"); jmethodID methodID_FileOutputStream = env->GetMethodID(cls_FileOutputStream, "<init>", "(Ljava/io/File;)V"); jobject BufferoutputstreamParam = env->NewObject(cls_FileOutputStream, methodID_FileOutputStream, localFile); //new BufferedOutputStream jclass cls_BufferedOutputStream = env->FindClass( "java/io/BufferedOutputStream"); jmethodID methodID_BufferedOutputStream = env->GetMethodID( cls_BufferedOutputStream, "<init>", "(Ljava/io/OutputStream;)V"); jobject localBufferedOutputStream = env->NewObject(cls_BufferedOutputStream, methodID_BufferedOutputStream, BufferoutputstreamParam); //some preparations jmethodID methodID_write = env->GetMethodID(cls_BufferedOutputStream, "write", "([BII)V"); jmethodID methodID_read = env->GetMethodID(cls_BufferedInputStream, "read", "([B)I"); jmethodID output_flush = env->GetMethodID(cls_BufferedOutputStream, "flush", "()V"); jmethodID output_close = env->GetMethodID(cls_BufferedOutputStream, "close", "()V"); jmethodID input_close = env->GetMethodID(cls_BufferedInputStream, "close", "()V"); while (true) { jint i = env->CallIntMethod(localBufferedInputStream, methodID_read, bytes); LOGI("IIIIIIIIII %d", i); if (i <= 0) { env->CallVoidMethod(localBufferedOutputStream, output_flush); env->CallVoidMethod(localBufferedOutputStream, output_close); env->CallVoidMethod(localBufferedInputStream, input_close); return; } env->CallVoidMethod(localBufferedOutputStream, methodID_write, bytes, 0, i); LOGI("afterwrite %d", i); } } //动态加载DEX JNIEXPORT jobject JNICALL sub_2222(JNIEnv* env, jobject thiz, jobject context) { jclass native_clazz = env->GetObjectClass(context); jmethodID methodID_func = env->GetMethodID(native_clazz, "getPackageName", "()Ljava/lang/String;"); jstring packagename = (jstring) (env->CallObjectMethod(context, methodID_func)); char *aa = "android.app.ActivityThread", *bb = "currentActivityThread"; jstring jaa = CharTojstring(env, aa); jstring jbb = CharTojstring(env, bb); jobjectArray pareTyple; jobjectArray pareVaules; jobject currentActivityThread = invokeStaticMethodss(env, jaa, jbb, pareTyple, pareVaules); char *cc = "android.app.ActivityThread", *dd = "mPackages"; jstring jcc = CharTojstring(env, cc); jstring jdd = CharTojstring(env, dd); jclass class_hashmap = env->FindClass("java/util/HashMap"); jmethodID hashmap_construct_method = env->GetMethodID(class_hashmap, "<init>", "()V"); jobject obj_hashmap = env->NewObject(class_hashmap, hashmap_construct_method, ""); obj_hashmap = getFieldOjbect(env, jcc, currentActivityThread, jdd); jclass class_WeakReference = env->FindClass("java/lang/ref/WeakReference"); if (class_WeakReference == NULL) { LOGI("class_WeakReference Not Found "); } jmethodID WeakReference_get_method = env->GetMethodID(class_WeakReference, "get", "()Ljava/lang/Object;"); if (WeakReference_get_method == NULL) { LOGI("WeakReference_get_method Not Found "); } jmethodID get_func = env->GetMethodID(class_hashmap, "get", "(Ljava/lang/Object;)Ljava/lang/Object;"); if (get_func == NULL) { LOGI("get_func Not Found "); } jobject get_obj = env->CallObjectMethod(obj_hashmap, get_func, packagename); if (get_obj == NULL) { LOGI("get_obj Not Found "); } jobject get_get_obj = env->CallObjectMethod(get_obj, WeakReference_get_method); if (get_get_obj == NULL) { LOGI("get_get_obj Not Found "); } //Strings prepared const char *str = env->GetStringUTFChars(packagename, 0); char parameter1[128]; char parameter2[128]; char parameter3[128]; const char *qz = "/data/data/", *hz1 = "/.cache/classdex.jar", *hz2 = "/.cache", *hz3 = "/.cache/"; strcpy(parameter1, qz); strcat(parameter1, str); strcat(parameter1, hz1); strcpy(parameter2, qz); strcat(parameter2, str); strcat(parameter2, hz2); strcpy(parameter3, qz); strcat(parameter3, str); strcat(parameter3, hz3); LOGI("protect parameter1 %s", parameter1); LOGI("protect parameter2 %s", parameter2); LOGI("protect parameter3 %s", parameter3); env->ReleaseStringUTFChars(packagename, str); jstring jparameter1 = CharTojstring(env, parameter1); jstring jparameter2 = CharTojstring(env, parameter2); jstring jparameter3 = CharTojstring(env, parameter3); char *loadapk = "android.app.LoadedApk", *mClassLoader = "mClassLoader"; jstring jloadapk = CharTojstring(env, loadapk); jstring jmClassLoader = CharTojstring(env, mClassLoader); jclass class_DexClassloader = env->FindClass("dalvik/system/DexClassLoader"); if (class_DexClassloader == NULL) { LOGI("class_DexClassloader Not Found "); } jmethodID DexClassloader_construct_method = env->GetMethodID(class_DexClassloader, "<init>", "(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/ClassLoader;)V"); if (DexClassloader_construct_method == NULL) { LOGI("DexClassloader_construct_method Not Found "); } jobject obj_DexClassloader = env->NewObject(class_DexClassloader, DexClassloader_construct_method, jparameter1, jparameter2, jparameter3, getFieldOjbect(env, jloadapk, get_get_obj, jmClassLoader)); if (obj_DexClassloader == NULL) { LOGI("obj_DexClassloader Not Found "); } setFieldOjbect(env, jloadapk, jmClassLoader, get_get_obj, obj_DexClassloader); return get_get_obj; } //char* 到 jstring 转换 jstring CharTojstring(JNIEnv* env, char* str) { jsize len = strlen(str); jclass clsstring = env->FindClass("java/lang/String"); jstring strencode = env->NewStringUTF("GB2312"); jmethodID mid = env->GetMethodID(clsstring, "<init>", "([BLjava/lang/String;)V"); jbyteArray barr = env->NewByteArray(len); env->SetByteArrayRegion(barr, 0, len, (jbyte*) str); return (jstring) env->NewObject(clsstring, mid, barr, strencode); } //调用指令类的静态函数 jobject invokeStaticMethodss(JNIEnv *env, jstring class_name, jstring method_name, jobjectArray pareTyple, jobjectArray pareVaules) { jclass context = env->FindClass("java/lang/Class"); jmethodID forName_func = env->GetStaticMethodID(context, "forName", "(Ljava/lang/String;)Ljava/lang/Class;"); jobject class_obj = env->CallStaticObjectMethod(context, forName_func, class_name); jclass class_java = env->GetObjectClass(class_obj); jmethodID getMethod_func = env->GetMethodID(class_java, "getMethod", "(Ljava/lang/String;[Ljava/lang/Class;)Ljava/lang/reflect/Method;"); jobject method_obj = env->CallObjectMethod(class_obj, getMethod_func, method_name, pareTyple); jclass class_method_obj = env->GetObjectClass(method_obj); jmethodID invoke_func = env->GetMethodID(class_method_obj, "invoke", "(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;"); jobject invoke_obj = env->CallObjectMethod(method_obj, invoke_func, NULL, pareVaules); env->DeleteLocalRef(class_java); env->DeleteLocalRef(method_obj); return invoke_obj; } //获取类的成员变量的值 jobject getFieldOjbect(JNIEnv *env, jstring class_name, jobject obj, jstring fieldName) { jclass context = env->FindClass("java/lang/Class"); jmethodID forName_func = env->GetStaticMethodID(context, "forName", "(Ljava/lang/String;)Ljava/lang/Class;"); jobject class_obj = env->CallStaticObjectMethod(context, forName_func, class_name); jclass class_java = env->GetObjectClass(class_obj); jmethodID getField_func = env->GetMethodID(class_java, "getDeclaredField", "(Ljava/lang/String;)Ljava/lang/reflect/Field;"); jobject method_obj = env->CallObjectMethod(class_obj, getField_func, fieldName); jclass class_method_obj = env->GetObjectClass(method_obj); jmethodID setaccess_func = env->GetMethodID(class_method_obj, "setAccessible", "(Z)V"); env->CallVoidMethod(method_obj, setaccess_func, true); jmethodID get_func = env->GetMethodID(class_method_obj, "get", "(Ljava/lang/Object;)Ljava/lang/Object;"); jobject get_obj = env->CallObjectMethod(method_obj, get_func, obj); env->DeleteLocalRef(class_java); env->DeleteLocalRef(method_obj); return get_obj; } //修改类的成员变量的值 void setFieldOjbect(JNIEnv *env, jstring class_name, jstring fieldName, jobject obj, jobject filedVaule) { jclass context = env->FindClass("java/lang/Class"); jmethodID forName_func = env->GetStaticMethodID(context, "forName", "(Ljava/lang/String;)Ljava/lang/Class;"); jobject class_obj = env->CallStaticObjectMethod(context, forName_func, class_name); jclass class_java = env->GetObjectClass(class_obj); jmethodID getField_func = env->GetMethodID(class_java, "getDeclaredField", "(Ljava/lang/String;)Ljava/lang/reflect/Field;"); jobject method_obj = env->CallObjectMethod(class_obj, getField_func, fieldName); jclass class_method_obj = env->GetObjectClass(method_obj); jmethodID setaccess_func = env->GetMethodID(class_method_obj, "setAccessible", "(Z)V"); env->CallVoidMethod(method_obj, setaccess_func, true); jmethodID set_func = env->GetMethodID(class_method_obj, "set", "(Ljava/lang/Object;Ljava/lang/Object;)V"); env->CallVoidMethod(method_obj, set_func, obj, filedVaule); env->DeleteLocalRef(class_java); env->DeleteLocalRef(method_obj); }