【Android 安全】DEX 加密 ( Application 替换 | Android 应用启动原理 | Instrumentation 源码分析 )

dex 解密时 , 需要将 代理 Application 替换为 真实 Application ; 替换 Application 首先要理解系统如何注册应用的 Application 的 ;

一、Instrumentation 源码分析

Instrumentation.java 类参考源码 : 6.0.1_r16/xref/frameworks/base/core/java/android/app/Instrumentation.java 常用方法 :

• newActivity : 创建 Activity ;
• newApplication : 创建 Application ;
• sendKeyDownUpSync : 模拟按键 ;

上一篇博客中讲解了 LoadedApk 中调用 makeApplication 方法创建应用的 Application , 在该方法中通过调用 Instrumentation 的 newApplication 方法创建 Application ;

在 Application newApplication(ClassLoader cl, String className, Context context) 中 , 调用了其重载函数 Application newApplication(Class clazz, Context context) , 前者包含 3 3 3 个参数 , 后者包含 2 2 2 个参数 ;

    public Application newApplication(ClassLoader cl, String className, Context context)
            throws InstantiationException, IllegalAccessException, 
            ClassNotFoundException {
        return newApplication(cl.loadClass(className), context);
    }

完整源码参考 : 6.0.1_r16/xref/frameworks/base/core/java/android/app/Instrumentation.java

在 Application newApplication(Class clazz, Context context) 函数中就执行了两行代码 , 调用 clazz.newInstance() 反射创建 Application 对象 , 然后调用 Application 的 attach 函数 , 传入 Context 上下文对象 ;

    static public Application newApplication(Class clazz, Context context)
            throws InstantiationException, IllegalAccessException, 
            ClassNotFoundException {
        Application app = (Application)clazz.newInstance();
        app.attach(context);
        return app;
    }

完整源码参考 : 6.0.1_r16/xref/frameworks/base/core/java/android/app/Instrumentation.java

Application 的 void attach(Context context) 方法中 , 调用了 attachBaseContext(context) 方法 , 由此可以看出在 Application 中 , attachBaseContext 函数要比 onCreate 先执行 ;

在 Application 使用反射方法创建出来之后 , 马上就会调用 attach 方法 , 进而先调用 attachBaseContext 方法 ;

public class Application extends ContextWrapper implements ComponentCallbacks2 {
    /**
     * @hide
     */
    /* package */ final void attach(Context context) {
        attachBaseContext(context);
        mLoadedApk = ContextImpl.getImpl(context).mPackageInfo;
    }
}

源码参考 : xref/frameworks/base/core/java/android/app/Application.java

二、Instrumentation 创建 Application 相关的部分源码

public class Instrumentation {

    /**
     * Perform instantiation of the process's {@link Application} object.  The
     * default implementation provides the normal system behavior.
     * 
     * @param cl The ClassLoader with which to instantiate the object.
     * @param className The name of the class implementing the Application
     *                  object.
     * @param context The context to initialize the application with
     * 
     * @return The newly instantiated Application object.
     */
    public Application newApplication(ClassLoader cl, String className, Context context)
            throws InstantiationException, IllegalAccessException, 
            ClassNotFoundException {
        return newApplication(cl.loadClass(className), context);
    }
    
    /**
     * Perform instantiation of the process's {@link Application} object.  The
     * default implementation provides the normal system behavior.
     * 
     * @param clazz The class used to create an Application object from.
     * @param context The context to initialize the application with
     * 
     * @return The newly instantiated Application object.
     */
    static public Application newApplication(Class clazz, Context context)
            throws InstantiationException, IllegalAccessException, 
            ClassNotFoundException {
        Application app = (Application)clazz.newInstance();
        app.attach(context);
        return app;
    }
}

完整源码参考 : 6.0.1_r16/xref/frameworks/base/core/java/android/app/Instrumentation.java