[ { "path": ".gitignore", "content": "*.iml\n.DS_Store\n.externalNativeBuild\n.gradle\n.idea\n/build\n/captures\n/local.properties\n" }, { "path": "README.md", "content": "# 一个脱简单壳的Xposed模块\n\n## 用法\n\n- 搭建Xposed环境\n- 在XposedEntry.java中的targetPackages数组添加需要脱壳的包名\n- 编译本模块并安装到手机\n- 激活模块后，打开目标应用，随便操作一会儿，等待/data/data/packageName下产生dex文件，可查看logcat看进展：logcat -s Xposed\n- 把dex文件都复制到电脑上，用jadx反编译，如果有反编译失败的，先用dex2jar转成jar再用jadx反编译可解决部分失败情况\n\n## 原理\n\n在加载包的时候，匹配是否目标包名及是否加壳，如果是，就hook java.lang.ClassLoader类的loadClass方法，应用如下操作：\n\n- 获得loadClass返回的Class对象\n- 反射调用Class对象的getDex方法获得Dex对象\n- 将Dex对象提交给写文件的线程，在此过程会去除重复的Dex对象并把不同的字节集加到队列\n- 线程异步从队列中读取字节集写到文件中，避免了同步写可能导致ANR\n\n## 限制\n- 只在Android 5.1.1版本的手机上验证过，其它的版本不一定有对应的getBytes和geDex方法\n- 只验证过腾讯乐固、360加固、梆梆加固、百度加固的免费加固工具，都可以脱掉，付费版本没有用过\n\n## 参考\n参考项目：https://github.com/a813630449/dumpDex\n\n" }, { "path": "app/.gitignore", "content": "/build\n" }, { "path": "app/build.gradle", "content": "/*\n * Copyright (c) 2019 - Oak Chen \n * 2019-07-26 Oak Chen\n */\n\napply plugin: 'com.android.application'\n\nandroid {\n compileSdkVersion 28\n buildToolsVersion \"28.0.3\"\n defaultConfig {\n applicationId \"com.sfysoft.android.xposed.shelling\"\n minSdkVersion 19\n //noinspection OldTargetApi\n targetSdkVersion 28\n versionCode 1\n versionName \"1.0\"\n }\n buildTypes {\n release {\n minifyEnabled false\n proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'\n }\n }\n}\n\ndependencies {\n implementation fileTree(dir: 'libs', include: ['*.jar'])\n implementation 'androidx.appcompat:appcompat:1.0.2'\n compileOnly 'de.robv.android.xposed:api:82'\n compileOnly 'de.robv.android.xposed:api:82:sources'\n}\n" }, { "path": "app/proguard-rules.pro", "content": "# Add project specific ProGuard rules here.\n# You can control the set of applied configuration files using the\n# proguardFiles setting in build.gradle.\n#\n# For more details, see\n# http://developer.android.com/guide/developing/tools/proguard.html\n\n# If your project uses WebView with JS, uncomment the following\n# and specify the fully qualified class name to the JavaScript interface\n# class:\n#-keepclassmembers class fqcn.of.javascript.interface.for.webview {\n# public *;\n#}\n\n# Uncomment this to preserve the line number information for\n# debugging stack traces.\n#-keepattributes SourceFile,LineNumberTable\n\n# If you keep the line number information, uncomment this to\n# hide the original source file name.\n#-renamesourcefileattribute SourceFile\n" }, { "path": "app/src/main/AndroidManifest.xml", "content": "\n\n\n\n \n\n \n \n \n \n\n" }, { "path": "app/src/main/assets/xposed_init", "content": "com.sfysoft.android.xposed.shelling.XposedEntry\n" }, { "path": "app/src/main/java/com/sfysoft/android/xposed/shelling/XposedEntry.java", "content": "/*\n * Copyright (c) 2019 - Oak Chen \n * 2019-07-26 Oak Chen Created\n */\n\npackage com.sfysoft.android.xposed.shelling;\n\nimport android.annotation.SuppressLint;\n\nimport java.io.File;\nimport java.io.FileOutputStream;\nimport java.io.IOException;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\nimport java.util.HashSet;\nimport java.util.LinkedList;\nimport java.util.Queue;\nimport java.util.Set;\n\nimport de.robv.android.xposed.IXposedHookLoadPackage;\nimport de.robv.android.xposed.XC_MethodHook;\nimport de.robv.android.xposed.XposedBridge;\nimport de.robv.android.xposed.XposedHelpers;\nimport de.robv.android.xposed.callbacks.XC_LoadPackage;\n\n/**\n * Xposed entry to shelling app\n *\n * @author Oak Chen\n */\npublic class XposedEntry implements IXposedHookLoadPackage {\n private static final boolean DEBUG = false;\n // 加固应用的初始类，对应AndroidManifests.xml里的 byteSet = new LinkedList<>();\n // 跟踪哪些类已经解码过，避免重复写到文件中\n private final Set dexSet = new HashSet<>();\n // 保存线程自动关闭前的空闲时间，以毫秒计\n private final long idleMsToQuit;\n // dex文件保存目录\n private String savingDirectory;\n private Thread currentThread;\n private long threadId;\n\n DexOutputTask(String savingDirectory) {\n // 默认5分钟后没有数据，就自动结束\n this(savingDirectory, 300000);\n }\n\n DexOutputTask(String savingDirectory,\n @SuppressWarnings(\"SameParameterValue\") long idleMsToQuit) {\n this.savingDirectory = savingDirectory;\n this.idleMsToQuit = idleMsToQuit;\n }\n\n @Override\n public void run() {\n currentThread = Thread.currentThread();\n threadId = currentThread.getId();\n\n File savingDir = new File(savingDirectory);\n if (!savingDir.exists()) {\n if (!savingDir.mkdirs()) {\n log(\"Can not mkdir \" + savingDirectory);\n return;\n }\n }\n\n for (int i = 0; ; ) {\n byte[] bytes;\n synchronized (byteSet) {\n bytes = byteSet.poll();\n if (bytes == null) {\n try {\n long start = System.currentTimeMillis();\n byteSet.wait(idleMsToQuit);\n // 若是超时则退出，结束线程\n if (System.currentTimeMillis() - start >= idleMsToQuit) {\n break;\n } else {\n // 有新的数据，返回重新读取\n continue;\n }\n } catch (InterruptedException e) {\n continue;\n }\n }\n }\n\n i++;\n @SuppressLint(\"DefaultLocale\") String targetFile =\n savingDirectory + String.format(\"/%05d-%02d.dex\", threadId, i);\n log(\"Thread: \" + threadId + \", File: \" + targetFile);\n try (FileOutputStream fileOutputStream = new FileOutputStream(targetFile)) {\n fileOutputStream.write(bytes);\n } catch (IOException e) {\n log(e);\n }\n }\n\n log(\"Thread: \" + threadId + \", Dex size: \" + dexSet.size());\n synchronized (byteSet) {\n byteSet.clear();\n }\n synchronized (dexSet) {\n dexSet.clear();\n }\n savingDirectory = null;\n }\n\n void write(Object dex) {\n if (dex == null) {\n return;\n }\n\n if (currentThread == null || !currentThread.isAlive()) {\n log(\"Thread \" + threadId + \" is not running\");\n return;\n }\n\n // 避免重复保存同一个dex\n synchronized (dexSet) {\n if (dexSet.contains(dex)) {\n return;\n }\n dexSet.add(dex);\n }\n\n byte[] bytes;\n try {\n bytes = (byte[]) getBytes.invoke(dex);\n } catch (IllegalAccessException | InvocationTargetException e) {\n log(e);\n return;\n }\n\n if (bytes == null) {\n return;\n }\n\n synchronized (byteSet) {\n byteSet.offer(bytes);\n byteSet.notifyAll();\n }\n }\n }\n }\n}\n" }, { "path": "app/src/main/res/drawable/ic_launcher_background.xml", "content": "\n\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n" }, { "path": "app/src/main/res/drawable-v24/ic_launcher_foreground.xml", "content": "\n\n\n \n \n \n \n \n \n \n \n \n\n" }, { "path": "app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml", "content": "\n\n\n\n \n \n\n" }, { "path": "app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml", "content": "\n\n\n\n \n \n\n" }, { "path": "app/src/main/res/values/colors.xml", "content": "\n\n\n\n #008577\n #00574B\n #D81B60\n\n" }, { "path": "app/src/main/res/values/strings.xml", "content": "\n\n\n Shelling\n Dump dex from app protected by free tools from baidu, 360, tencent, bangcle.com\n\n" }, { "path": "app/src/main/res/values/styles.xml", "content": "\n\n\n\n \n \n\n\n" }, { "path": "app/src/main/res/values-zh-rCN/strings.xml", "content": "\n\n\n\n 脱壳\n 从加固过的应用中提取dex文件，适用于百度、360、腾讯、梆梆等提供的免费版加固工具\n" }, { "path": "build.gradle", "content": "/*\n * Copyright (c) 2019 - Oak Chen \n * 2019-07-26 Oak Chen\n */\n\n// Top-level build file where you can add configuration options common to all sub-projects/modules.\n\nbuildscript {\n repositories {\n google()\n jcenter()\n \n }\n dependencies {\n classpath 'com.android.tools.build:gradle:4.2.0'\n \n // NOTE: Do not place your application dependencies here; they belong\n // in the individual module build.gradle files\n }\n}\n\nallprojects {\n repositories {\n google()\n jcenter()\n \n }\n}\n\ntask clean(type: Delete) {\n delete rootProject.buildDir\n}\n" }, { "path": "gradle/wrapper/gradle-wrapper.properties", "content": "#\r\n# Copyright (c) 2019 - Oak Chen \r\n# 2019-07-26 Oak Chen\r\n#\r\n\r\n#Fri Jul 26 15:05:01 CST 2019\r\ndistributionBase=GRADLE_USER_HOME\r\ndistributionPath=wrapper/dists\r\nzipStoreBase=GRADLE_USER_HOME\r\nzipStorePath=wrapper/dists\r\ndistributionUrl=https\\://services.gradle.org/distributions/gradle-6.7.1-all.zip\r\n" }, { "path": "gradle.properties", "content": "#\n# Copyright (c) 2019 - Oak Chen \n# 2019-07-26 Oak Chen\n#\n\n# Project-wide Gradle settings.\n# IDE (e.g. Android Studio) users:\n# Gradle settings configured through the IDE *will override*\n# any settings specified in this file.\n# For more details on how to configure your build environment visit\n# http://www.gradle.org/docs/current/userguide/build_environment.html\n# Specifies the JVM arguments used for the daemon process.\n# The setting is particularly useful for tweaking memory settings.\norg.gradle.jvmargs=-Xmx1536m\n# When configured, Gradle will run in incubating parallel mode.\n# This option should only be used with decoupled projects. More details, visit\n# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects\n# org.gradle.parallel=true\n# AndroidX package structure to make it clearer which packages are bundled with the\n# Android operating system, and which are packaged with your app's APK\n# https://developer.android.com/topic/libraries/support-library/androidx-rn\nandroid.useAndroidX=true\n# Automatically convert third-party libraries to use AndroidX\nandroid.enableJetifier=true\n\n" }, { "path": "gradlew", "content": "#!/usr/bin/env sh\n\n##############################################################################\n##\n## Gradle start up script for UN*X\n##\n##############################################################################\n\n# Attempt to set APP_HOME\n# Resolve links: $0 may be a link\nPRG=\"$0\"\n# Need this for relative symlinks.\nwhile [ -h \"$PRG\" ] ; do\n ls=`ls -ld \"$PRG\"`\n link=`expr \"$ls\" : '.*-> \\(.*\\)$'`\n if expr \"$link\" : '/.*' > /dev/null; then\n PRG=\"$link\"\n else\n PRG=`dirname \"$PRG\"`\"/$link\"\n fi\ndone\nSAVED=\"`pwd`\"\ncd \"`dirname \\\"$PRG\\\"`/\" >/dev/null\nAPP_HOME=\"`pwd -P`\"\ncd \"$SAVED\" >/dev/null\n\nAPP_NAME=\"Gradle\"\nAPP_BASE_NAME=`basename \"$0\"`\n\n# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.\nDEFAULT_JVM_OPTS=\"\"\n\n# Use the maximum available, or set MAX_FD != -1 to use that value.\nMAX_FD=\"maximum\"\n\nwarn () {\n echo \"$*\"\n}\n\ndie () {\n echo\n echo \"$*\"\n echo\n exit 1\n}\n\n# OS specific support (must be 'true' or 'false').\ncygwin=false\nmsys=false\ndarwin=false\nnonstop=false\ncase \"`uname`\" in\n CYGWIN* )\n cygwin=true\n ;;\n Darwin* )\n darwin=true\n ;;\n MINGW* )\n msys=true\n ;;\n NONSTOP* )\n nonstop=true\n ;;\nesac\n\nCLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar\n\n# Determine the Java command to use to start the JVM.\nif [ -n \"$JAVA_HOME\" ] ; then\n if [ -x \"$JAVA_HOME/jre/sh/java\" ] ; then\n # IBM's JDK on AIX uses strange locations for the executables\n JAVACMD=\"$JAVA_HOME/jre/sh/java\"\n else\n JAVACMD=\"$JAVA_HOME/bin/java\"\n fi\n if [ ! -x \"$JAVACMD\" ] ; then\n die \"ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME\n\nPlease set the JAVA_HOME variable in your environment to match the\nlocation of your Java installation.\"\n fi\nelse\n JAVACMD=\"java\"\n which java >/dev/null 2>&1 || die \"ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.\n\nPlease set the JAVA_HOME variable in your environment to match the\nlocation of your Java installation.\"\nfi\n\n# Increase the maximum file descriptors if we can.\nif [ \"$cygwin\" = \"false\" -a \"$darwin\" = \"false\" -a \"$nonstop\" = \"false\" ] ; then\n MAX_FD_LIMIT=`ulimit -H -n`\n if [ $? -eq 0 ] ; then\n if [ \"$MAX_FD\" = \"maximum\" -o \"$MAX_FD\" = \"max\" ] ; then\n MAX_FD=\"$MAX_FD_LIMIT\"\n fi\n ulimit -n $MAX_FD\n if [ $? -ne 0 ] ; then\n warn \"Could not set maximum file descriptor limit: $MAX_FD\"\n fi\n else\n warn \"Could not query maximum file descriptor limit: $MAX_FD_LIMIT\"\n fi\nfi\n\n# For Darwin, add options to specify how the application appears in the dock\nif $darwin; then\n GRADLE_OPTS=\"$GRADLE_OPTS \\\"-Xdock:name=$APP_NAME\\\" \\\"-Xdock:icon=$APP_HOME/media/gradle.icns\\\"\"\nfi\n\n# For Cygwin, switch paths to Windows format before running java\nif $cygwin ; then\n APP_HOME=`cygpath --path --mixed \"$APP_HOME\"`\n CLASSPATH=`cygpath --path --mixed \"$CLASSPATH\"`\n JAVACMD=`cygpath --unix \"$JAVACMD\"`\n\n # We build the pattern for arguments to be converted via cygpath\n ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`\n SEP=\"\"\n for dir in $ROOTDIRSRAW ; do\n ROOTDIRS=\"$ROOTDIRS$SEP$dir\"\n SEP=\"|\"\n done\n OURCYGPATTERN=\"(^($ROOTDIRS))\"\n # Add a user-defined pattern to the cygpath arguments\n if [ \"$GRADLE_CYGPATTERN\" != \"\" ] ; then\n OURCYGPATTERN=\"$OURCYGPATTERN|($GRADLE_CYGPATTERN)\"\n fi\n # Now convert the arguments - kludge to limit ourselves to /bin/sh\n i=0\n for arg in \"$@\" ; do\n CHECK=`echo \"$arg\"|egrep -c \"$OURCYGPATTERN\" -`\n CHECK2=`echo \"$arg\"|egrep -c \"^-\"` ### Determine if an option\n\n if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition\n eval `echo args$i`=`cygpath --path --ignore --mixed \"$arg\"`\n else\n eval `echo args$i`=\"\\\"$arg\\\"\"\n fi\n i=$((i+1))\n done\n case $i in\n (0) set -- ;;\n (1) set -- \"$args0\" ;;\n (2) set -- \"$args0\" \"$args1\" ;;\n (3) set -- \"$args0\" \"$args1\" \"$args2\" ;;\n (4) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" ;;\n (5) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" \"$args4\" ;;\n (6) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" \"$args4\" \"$args5\" ;;\n (7) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" \"$args4\" \"$args5\" \"$args6\" ;;\n (8) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" \"$args4\" \"$args5\" \"$args6\" \"$args7\" ;;\n (9) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" \"$args4\" \"$args5\" \"$args6\" \"$args7\" \"$args8\" ;;\n esac\nfi\n\n# Escape application args\nsave () {\n for i do printf %s\\\\n \"$i\" | sed \"s/'/'\\\\\\\\''/g;1s/^/'/;\\$s/\\$/' \\\\\\\\/\" ; done\n echo \" \"\n}\nAPP_ARGS=$(save \"$@\")\n\n# Collect all arguments for the java command, following the shell quoting and substitution rules\neval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS \"\\\"-Dorg.gradle.appname=$APP_BASE_NAME\\\"\" -classpath \"\\\"$CLASSPATH\\\"\" org.gradle.wrapper.GradleWrapperMain \"$APP_ARGS\"\n\n# by default we should be in the correct project dir, but when run from Finder on Mac, the cwd is wrong\nif [ \"$(uname)\" = \"Darwin\" ] && [ \"$HOME\" = \"$PWD\" ]; then\n cd \"$(dirname \"$0\")\"\nfi\n\nexec \"$JAVACMD\" \"$@\"\n" }, { "path": "gradlew.bat", "content": "@if \"%DEBUG%\" == \"\" @echo off\r\n@rem ##########################################################################\r\n@rem\r\n@rem Gradle startup script for Windows\r\n@rem\r\n@rem ##########################################################################\r\n\r\n@rem Set local scope for the variables with windows NT shell\r\nif \"%OS%\"==\"Windows_NT\" setlocal\r\n\r\nset DIRNAME=%~dp0\r\nif \"%DIRNAME%\" == \"\" set DIRNAME=.\r\nset APP_BASE_NAME=%~n0\r\nset APP_HOME=%DIRNAME%\r\n\r\n@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.\r\nset DEFAULT_JVM_OPTS=\r\n\r\n@rem Find java.exe\r\nif defined JAVA_HOME goto findJavaFromJavaHome\r\n\r\nset JAVA_EXE=java.exe\r\n%JAVA_EXE% -version >NUL 2>&1\r\nif \"%ERRORLEVEL%\" == \"0\" goto init\r\n\r\necho.\r\necho ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.\r\necho.\r\necho Please set the JAVA_HOME variable in your environment to match the\r\necho location of your Java installation.\r\n\r\ngoto fail\r\n\r\n:findJavaFromJavaHome\r\nset JAVA_HOME=%JAVA_HOME:\"=%\r\nset JAVA_EXE=%JAVA_HOME%/bin/java.exe\r\n\r\nif exist \"%JAVA_EXE%\" goto init\r\n\r\necho.\r\necho ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%\r\necho.\r\necho Please set the JAVA_HOME variable in your environment to match the\r\necho location of your Java installation.\r\n\r\ngoto fail\r\n\r\n:init\r\n@rem Get command-line arguments, handling Windows variants\r\n\r\nif not \"%OS%\" == \"Windows_NT\" goto win9xME_args\r\n\r\n:win9xME_args\r\n@rem Slurp the command line arguments.\r\nset CMD_LINE_ARGS=\r\nset _SKIP=2\r\n\r\n:win9xME_args_slurp\r\nif \"x%~1\" == \"x\" goto execute\r\n\r\nset CMD_LINE_ARGS=%*\r\n\r\n:execute\r\n@rem Setup the command line\r\n\r\nset CLASSPATH=%APP_HOME%\\gradle\\wrapper\\gradle-wrapper.jar\r\n\r\n@rem Execute Gradle\r\n\"%JAVA_EXE%\" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% \"-Dorg.gradle.appname=%APP_BASE_NAME%\" -classpath \"%CLASSPATH%\" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%\r\n\r\n:end\r\n@rem End local scope for the variables with windows NT shell\r\nif \"%ERRORLEVEL%\"==\"0\" goto mainEnd\r\n\r\n:fail\r\nrem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of\r\nrem the _cmd.exe /c_ return code!\r\nif not \"\" == \"%GRADLE_EXIT_CONSOLE%\" exit 1\r\nexit /b 1\r\n\r\n:mainEnd\r\nif \"%OS%\"==\"Windows_NT\" endlocal\r\n\r\n:omega\r\n" }, { "path": "settings.gradle", "content": "/*\n * Copyright (c) 2019 - Oak Chen \n * 2019-07-26 Oak Chen\n */\n\ninclude ':app'\n" } ]