Apktool源碼解析——第一篇

著名的apktool是android逆向界用的最普遍的一個工具，這個項目的原始地址在這里http://code.google.com/p/android-apktool/，但是你們都懂的在天朝谷歌是無法訪問的，所以直接上github的 https://github.com/brutall/brut.apktool。

在brut.apktool路徑是主要代碼所在，當然還有brut.apktool.smali是反編譯smali的目錄，目測還有brut.j.common,brut.j.dir,brut.j.utils是用到java的一些類。

brut.apktool路徑下的apktool-cli還不知道是干嘛的，總之下面的apktool-lib正是我們最需要了解的。

 

android目錄是利用XmlPullParser實現的專門用於android當中xml的解碼工具包。

brut/androlib目錄正是我們研究的主題。

com/mindprod/ledatastream目錄是le數據支持庫。

org/xmlpull/mxp1_serializer目錄是XmlPullParser的Xml解析庫。

androlib目錄一覽。

先看一下ApkDecoder這個類。

    public ApkDecoder(File apkFile, Androlib androlib) {
        mAndrolib = androlib;
        setApkFile(apkFile);
    }

    public void setApkFile(File apkFile) {
        mApkFile = new ExtFile(apkFile);
        mResTable = null;
    }

mResTable這個一直很迷惑，很多地方用到了它，但是目前還不住到具體是干嘛的，先不研究這個，繼續往下看。

   public void setOutDir(File outDir) throws AndrolibException {
        mOutDir = outDir;
    }

    public void setApi(int api) {
        mApi = api;
    }

這兩個方法一看名字就不言而喻，這里就不啰嗦了。多看了幾行代碼發現，這代碼質量相當高，簡直不要太優質，比起什么AxmlPrinter2的代碼好看多了，呵呵！

下面就是反編譯的核心方法了，客觀請往下看。

 public void decode() throws AndrolibException, IOException,DirectoryException {
        File outDir = getOutDir();

        if (!mForceDelete && outDir.exists()) {//如果輸出目錄不是因為刪除而不存在就拋出異常
            throw new OutDirExistsException();
        }

        if (!mApkFile.isFile() || !mApkFile.canRead()) {//如果apk文件不是文件類型或者不能讀也拋出異常
            throw new InFileNotFoundException();
        }

        try {
            OS.rmdir(outDir);//暫不明
        } catch (BrutException ex) {
            throw new AndrolibException(ex);
        }
        outDir.mkdirs();

        LOGGER.info("Using Apktool " + Androlib.getVersion() + " on " + mApkFile.getName());

        if (hasResources()) {//判斷依據mApkFile.getDir().contraincontainsFile("resources.arsc")
            setTargetSdkVersion();
            setAnalysisMode(mAnalysisMode, true);//如果后面的參數為true,將會影響mResTable的取值
            setCompressionMode();//mCompressResources賦值，res.arsc是個zip獲取它的壓縮模式是否是ZipEntry.DEFLATED默認

            switch (mDecodeResources) {//這里默認是FULL
                case DECODE_RESOURCES_NONE://不解碼直接解壓到指定res目錄
                    mAndrolib.decodeResourcesRaw(mApkFile, outDir);
                    break;
                case DECODE_RESOURCES_FULL://調用androilib.decodearesources方法，其實本質還是調AndrolibResources.decode()方法
                    mAndrolib.decodeResourcesFull(mApkFile, outDir, getResTable());
                    break;
            }
        } else {//沒有資源文件
            // if there's no resources.asrc, decode the manifest without looking
            // up attribute references
            if (hasManifest()) {//如果沒有res.asrc就不需要查找manifest中的引用屬性了
                switch (mDecodeResources) {
                    case DECODE_RESOURCES_NONE:
                        mAndrolib.decodeManifestRaw(mApkFile, outDir);
                        break;
                    case DECODE_RESOURCES_FULL://調mAndRes.decodeManifest(resTable, apkFile, outDir)
                        mAndrolib.decodeManifestFull(mApkFile, outDir,
                                getResTable());
                        break;
                }
            }
        }

        if (hasSources()) {//如果有源文件
            switch (mDecodeSources) {
                case DECODE_SOURCES_NONE://直接復制classes.dex
                    mAndrolib.decodeSourcesRaw(mApkFile, outDir, "classes.dex");
                    break;
                case DECODE_SOURCES_SMALI://反編譯成smali，SmaliDecoder.decode()
                    mAndrolib.decodeSourcesSmali(mApkFile, outDir, "classes.dex", mDebug, mDebugLinePrefix, mBakDeb, mApi);
                    break;
                case DECODE_SOURCES_JAVA://反編譯jarnew AndrolibJava().decode()
                    mAndrolib.decodeSourcesJava(mApkFile, outDir, mDebug);
                    break;
            }
        }

        if (hasMultipleSources()) {//如果有多個dex
            // foreach unknown dex file in root, lets disassemble it
            Set<String> files = mApkFile.getDirectory().getFiles(true);
            for (String file : files) {//反編譯多個dex
                if (file.endsWith(".dex")) {
                    if (! file.equalsIgnoreCase("classes.dex")) {
                        switch(mDecodeSources) {
                            case DECODE_SOURCES_NONE:
                                mAndrolib.decodeSourcesRaw(mApkFile, outDir, file);
                                break;
                            case DECODE_SOURCES_SMALI:
                                mAndrolib.decodeSourcesSmali(mApkFile, outDir, file, mDebug, mDebugLinePrefix, mBakDeb, mApi);
                                break;
                            case DECODE_SOURCES_JAVA:
                                mAndrolib.decodeSourcesJava(mApkFile, outDir, mDebug);
                                break;
                        }
                    }
                }
            }
        }

        mAndrolib.decodeRawFiles(mApkFile, outDir);//復制libs和assets
        mAndrolib.decodeUnknownFiles(mApkFile, outDir, mResTable);//發現一個問題，brutall的代碼沒有更新，新的在這里https://github.com/iBotPeaches/Apktool
        mAndrolib.writeOriginalFiles(mApkFile, outDir);//輸出原始文件，包括AndroidManifest.xml和簽名證書
        writeMetaFile();//寫如描述文件apktool.yml
    }

下面幾個方法不解釋咯

   public void setAnalysisMode(boolean mode, boolean pass) throws AndrolibException{
        mAnalysisMode = mode;

        // only set mResTable, once it exists
        if (pass) {
            if (mResTable == null) {
                mResTable = getResTable();
            }
            mResTable.setAnalysisMode(mode);
        }
    }

    public void setCompressionMode() throws AndrolibException, IOException {
        // read the resources.arsc checking for STORED vs DEFLATE
        // this will determine whether we compress on rebuild or not.
        ZipExtFile zef = new ZipExtFile(mApkFile.getAbsolutePath());
        ZipArchiveEntry ze = zef.getEntry("resources.arsc");
        if (ze != null) {
            int compression = ze.getMethod();
            mCompressResources = (compression == ZipEntry.DEFLATED);
        }
        zef.close();
    }

    public void setTargetSdkVersion() throws AndrolibException, IOException {
        if (mResTable == null) {
            mResTable = mAndrolib.getResTable(mApkFile);
        }

        Map<String, String> sdkInfo = mResTable.getSdkInfo();
        if (sdkInfo.get("targetSdkVersion") != null) {
            mApi = Integer.parseInt(sdkInfo.get("targetSdkVersion"));
        }
    }

public ResTable getResTable() throws AndrolibException {
        if (mResTable == null) {
            boolean hasResources = hasResources();
            boolean hasManifest = hasManifest();
            if (! (hasManifest || hasResources)) {//一個apk文件不能沒有AndroidManifest.xml和resource.arsc，否則就不是合法的apk文件
                throw new AndrolibException(
                        "Apk doesn't contain either AndroidManifest.xml file or resources.arsc file");
            }
            AndrolibResources.sKeepBroken = mKeepBrokenResources;
            mResTable = mAndrolib.getResTable(mApkFile, hasResources);
        }
        return mResTable;
    }

 

End！

 補充：
在decode()中有個writeMetaFile()方法沒講到，這里再看看。

   private void writeMetaFile() throws AndrolibException {
        Map<String, Object> meta = new LinkedHashMap<String, Object>();
        meta.put("version", Androlib.getVersion());//靜態方法？
        meta.put("apkFileName", mApkFile.getName());//apk名稱

        if (mDecodeResources != DECODE_RESOURCES_NONE && (hasManifest() || hasResources())) {//如果要反編譯資源並且有資源文件或者manifest文件
            meta.put("isFrameworkApk", mAndrolib.isFrameworkApk(getResTable()));
            putUsesFramework(meta);
            putSdkInfo(meta);
            putPackageInfo(meta);
            putVersionInfo(meta);
            putCompressionInfo(meta);
        }
        putUnknownInfo(meta);//加入Unknown文件目錄說明

　　　　 mAndrolib.writeMetaFile(mOutDir, meta); //將meta數據寫入apktool.yml寫入到輸出目錄
　　}

　　private void putUsesFramework(Map<String, Object> meta) throws AndrolibException {
        Set<ResPackage> pkgs = getResTable().listFramePackages();
        if (pkgs.isEmpty()) {
            return;
        }

        Integer[] ids = new Integer[pkgs.size()];
        int i = 0;
        for (ResPackage pkg : pkgs) {
            ids[i++] = pkg.getId();
        }
        Arrays.sort(ids);

        Map<String, Object> uses = new LinkedHashMap<String, Object>();
        uses.put("ids", ids);//ids

        if (mAndrolib.apkOptions.frameworkTag != null) {//tag
            uses.put("tag", mAndrolib.apkOptions.frameworkTag);
        }

        meta.put("usesFramework", uses);
    }

    private void putSdkInfo(Map<String, Object> meta) throws AndrolibException {
        Map<String, String> info = getResTable().getSdkInfo();//ResTable可以獲取sdk信息？
        if (info.size() > 0) {
            meta.put("sdkInfo", info);
        }
    }

    private void putPackageInfo(Map<String, Object> meta) throws AndrolibException {
        String renamed = getResTable().getPackageRenamed();//還可以獲取package信息？
        String original = getResTable().getPackageOriginal();
        int id = getResTable().getPackageId();

        HashMap<String, String> packages = new HashMap<String, String>();

        // only put rename-manifest-package into apktool.yml, if the change will be required
        if (!renamed.equalsIgnoreCase(original)) {
            packages.put("rename-manifest-package", renamed);
        }
        packages.put("forced-package-id", String.valueOf(id));
        meta.put("packageInfo", packages);
    }

    private void putVersionInfo(Map<String, Object> meta) throws AndrolibException {
        Map<String, String> info = getResTable().getVersionInfo();//獲取版本信息
        if (info.size() > 0) {
            meta.put("versionInfo", info);
        }
    }

    private void putUnknownInfo(Map<String, Object> meta) throws AndrolibException {
        Map<String,String> info = mAndrolib.mResUnknownFiles.getUnknownFiles();//Androlib會收集Unknwn文件
        if (info.size() > 0) {
            meta.put("unknownFiles", info);
        }
    }

    private void putCompressionInfo(Map<String, Object> meta) throws AndrolibException {
        meta.put("compressionType", getCompressionType());//壓縮方式
    }