Android逆向黑域在 /data/local/tmp 下启

作者: LiuJP | 来源:发表于2020-06-17 11:31 被阅读0次

Android逆向黑域在 /data/local/tmp 下启
ndk开发技巧
Android apk 安装相关的几个目录
Minicap
hook in java(2)
魅族手机应用卸载不完全无法安装应用解决方案
frida使用
tcpdump抓包命令
android studio profiler崩溃
shell脚本

黑域介绍
之后更名为黑阀闭源商业化了
https://jianyv.com/br/br.pdf
https://jianyv.com/br/

adb -d shell sh /sdcard/Android/data/me.piebridge.brevent/brevent.sh

<?xml version="1.0" encoding="UTF-8"?>
<manifest android:compileSdkVersion="29" android:compileSdkVersionCodename="10" android:installLocation="1" android:versionCode="464" android:versionName="4.1.9" package="me.piebridge.brevent" platformBuildVersionCode="29" platformBuildVersionName="10" xmlns:android="http://schemas.android.com/apk/res/android">
  <uses-sdk android:minSdkVersion="24" android:targetSdkVersion="29" />
  <permission android:description="@string/perm_disabled_description" android:icon="@drawable/perm_disabled" android:label="@string/perm_disabled_label" android:name="me.piebridge.brevent.permission.BREVENT_DISABLED" android:protectionLevel="0x1" />
  <uses-permission android:name="android.permission.INTERNET" />
  <uses-permission-sdk-23 android:name="android.permission.ACCESS_NETWORK_STATE" />
  <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
  <uses-permission android:name="android.permission.READ_LOGS" />
  <uses-permission android:name="android.permission.PACKAGE_USAGE_STATS" />
  <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
  <uses-permission android:name="com.android.launcher.permission.INSTALL_SHORTCUT" />
  <uses-permission android:name="android.permission.DUMP" />
  <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
  <uses-permission android:name="com.android.vending.BILLING" />
  <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
  <uses-permission android:name="android.permission.WAKE_LOCK" />
  <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" />
  <uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" />
  <application android:allowBackup="false" android:extractNativeLibs="false" android:icon="@mipmap/con" android:label="@string/brevent" android:name="me.piebridge.brevent.ui.JianyuApplication" android:theme="@style/theme.pixel">
    <activity android:configChanges="0xfa0" android:name="me.piebridge.brevent.ui.BreventActivity" android:windowSoftInputMode="0x2">
      <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
      </intent-filter>
      <meta-data android:name="android.app.shortcuts" android:resource="@xml/shortcuts" />
    </activity>
    <activity android:configChanges="0xfa0" android:label="@string/menu_settings" android:name="me.piebridge.brevent.ui.BreventSettings" android:windowSoftInputMode="0x2" />
    <activity android:configChanges="0xfa0" android:name="me.piebridge.brevent.ui.BreventLauncher" android:windowSoftInputMode="0x2" />
    <activity android:configChanges="0xfa0" android:label="@string/menu_guide" android:name="me.piebridge.brevent.ui.BreventGuide" android:windowSoftInputMode="0x2" />
    <activity android:configChanges="0xfa0" android:label="@string/context_menu_appops" android:name="me.piebridge.brevent.ui.BreventOps" android:windowSoftInputMode="0x2" />
    <activity android:configChanges="0xfa0" android:label="@string/context_menu_appops" android:name="me.piebridge.brevent.ui.BreventOps2" android:windowSoftInputMode="0x2" />
    <activity android:configChanges="0xfa0" android:label="@string/menu_command" android:name="me.piebridge.brevent.ui.BreventCmd" android:windowSoftInputMode="0x2">
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.COMMAND" />
        <category android:name="android.intent.category.DEFAULT" />
      </intent-filter>
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.DEVELOPER" />
        <category android:name="android.intent.category.DEFAULT" />
      </intent-filter>
    </activity>
    <activity android:configChanges="0xfa0" android:exported="false" android:name="me.piebridge.brevent.ui.BreventLicenses" android:theme="@style/dialog.pixel" android:windowSoftInputMode="0x2">
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.VIEW_LICENSE" />
        <category android:name="android.intent.category.DEFAULT" />
      </intent-filter>
    </activity>
    <activity android:enabled="false" android:label="@string/shortcut_instant" android:name="me.piebridge.brevent.ui.BreventShortcutInstant">
      <intent-filter>
        <action android:name="android.intent.action.CREATE_SHORTCUT" />
        <category android:name="android.intent.category.DEFAULT" />
      </intent-filter>
    </activity>
    <activity android:exported="false" android:name="android.app.NativeActivity">
      <meta-data android:name="android.app.lib_name" android:value="reader" />
    </activity>
    <activity android:configChanges="0xfa0" android:label="@string/package_installer" android:launchMode="3" android:name="me.piebridge.brevent.ui.InstallActivity" android:theme="@style/dialog.pixel" android:windowSoftInputMode="0x2">
      <intent-filter android:label="@string/package_installer">
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data android:host="*" android:mimeType="application/zip" android:scheme="file" />
        <data android:host="*" android:mimeType="application/zip" android:scheme="content" />
        <data android:host="*" android:mimeType="application/octet-stream" android:scheme="file" />
        <data android:host="*" android:mimeType="application/octet-stream" android:scheme="content" />
      </intent-filter>
      <intent-filter android:label="@string/package_installer">
        <action android:name="android.intent.action.SEND" />
        <category android:name="android.intent.category.DEFAULT" />
        <data android:mimeType="application/zip" />
        <data android:mimeType="application/octet-stream" />
      </intent-filter>
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.PACKAGE_INSTALLER" />
      </intent-filter>
    </activity>
    <receiver android:enabled="@bool/enable_usb_checking" android:name="me.piebridge.brevent.ui.BreventUsbReceiver">
      <intent-filter>
        <action android:name="android.hardware.usb.action.USB_STATE" />
      </intent-filter>
    </receiver>
    <receiver android:name="me.piebridge.brevent.ui.BreventBootReceiver">
      <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED" />
      </intent-filter>
    </receiver>
    <receiver android:directBootAware="true" android:name="me.piebridge.brevent.ui.BreventDirectBootReceiver">
      <intent-filter>
        <action android:name="android.intent.action.LOCKED_BOOT_COMPLETED" />
      </intent-filter>
    </receiver>
    <receiver android:directBootAware="true" android:name="me.piebridge.brevent.ui.BreventServerReceiver" android:permission="android.permission.DEVICE_POWER">
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.HOME_TID" />
      </intent-filter>
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.ADD_PACKAGE" />
      </intent-filter>
      <intent-filter>
        <action android:name="me.piebridge.brevent.intent.action.BREVENT" />
      </intent-filter>
    </receiver>
    <service android:directBootAware="true" android:name="me.piebridge.brevent.ui.BreventIntentService" />
    <provider android:authorities="me.piebridge.brevent.fileprovider" android:exported="false" android:grantUriPermissions="true" android:name="io.jianyu.stats.StatsFileProvider">
      <meta-data android:name="android.support.FILE_PROVIDER_PATHS" android:resource="@xml/filepaths" />
    </provider>
    <provider android:authorities="me.piebridge.brevent.brevent.binder" android:enabled="true" android:exported="true" android:multiprocess="false" android:name="me.piebridge.brevent.ui.BreventBinderProvider" android:permission="android.permission.DEVICE_POWER" />
    <activity android:configChanges="0xfa0" android:exported="true" android:launchMode="1" android:name="me.piebridge.payment.WxApiActivity" />
    <activity-alias android:exported="true" android:name="me.piebridge.brevent.wxapi.WXEntryActivity" android:targetActivity="me.piebridge.payment.WxApiActivity" />
    <activity-alias android:exported="true" android:name="me.piebridge.brevent.wxapi.WXPayEntryActivity" android:targetActivity="me.piebridge.payment.WxApiActivity" />
    <meta-data android:name="firebase_analytics_collection_enabled" android:value="false" />
    <meta-data android:name="firebase_data_collection_default_enabled" android:value="false" />
    <meta-data android:name="firebase_messaging_auto_init_enabled" android:value="false" />
    <meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />
    <meta-data android:name="google_analytics_ssaid_collection_enabled" android:value="false" />
    <receiver android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementReceiver" />
    <service android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementService" />
    <service android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementJobService" android:permission="android.permission.BIND_JOB_SERVICE" />
    <service android:directBootAware="true" android:exported="false" android:name="com.google.firebase.components.ComponentDiscoveryService">
      <meta-data android:name="com.google.firebase.components:com.google.firebase.analytics.connector.internal.AnalyticsConnectorRegistrar" android:value="com.google.firebase.components.ComponentRegistrar" />
      <meta-data android:name="com.google.firebase.components:com.google.firebase.iid.Registrar" android:value="com.google.firebase.components.ComponentRegistrar" />
      <meta-data android:name="com.google.firebase.components:com.google.firebase.installations.FirebaseInstallationsRegistrar" android:value="com.google.firebase.components.ComponentRegistrar" />
    </service>
    <receiver android:exported="true" android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver" android:permission="com.google.android.c2dm.permission.SEND">
      <intent-filter>
        <action android:name="com.google.android.c2dm.intent.RECEIVE" />
      </intent-filter>
    </receiver>
    <provider android:authorities="me.piebridge.brevent.firebaseinitprovider" android:exported="false" android:initOrder="100" android:name="com.google.firebase.provider.FirebaseInitProvider" />
    <meta-data android:name="com.google.android.gms.version" android:value="@integer/google_play_services_version" />
    <meta-data android:name="com.android.vending.splits" android:value="@xml/splits0" />
    <meta-data android:name="com.android.vending.derived.apk.id" android:value="1" />
  </application>
</manifest>

motionelf-v0.5.2.apk

写入motionelf_server 这个文件
chmod 420

#!/system/bin/sh

path=/data/data/me.piebridge.brevent/brevent.sh
comp=me.piebridge.brevent/.ui.BreventActivity

if [ ! -r $path ]; then
    am start -n $comp
    sleep 3
fi

/system/bin/sh $path

if [ $? -eq 0 ]; then
    am start -n $comp
fi

Android逆向黑域在 /data/local/tmp 下启
黑域介绍之后更名为黑阀闭源商业化了https://jianyv.com/br/br.pdfhttps://jian...
ndk开发技巧
/data/local/tmp/ 我们编译的Android可执行程序可以放入 /data/local/tmp/ 目...
Android apk 安装相关的几个目录
一、几个关键目录 1、/data/local/tmp /data/local/tmp 目录是转为android s...
Minicap
1、查看minicap用法：运行： LD_LIBRARY_PATH=/data/local/tmp /data/...
hook in java(2)
加载fridaalias activityFrida="adb shell 'su /data/local/tmp...
魅族手机应用卸载不完全无法安装应用解决方案
将apk上传到手机adb push /{path}/{app_name}.apk /data/local/tmp/...
frida使用
执行adb shell 'su -c /data/local/tmp/frida-server'启动手机frida...
tcpdump抓包命令
//保存到sdcard上，文件名是capture.pcap/data/local/tmp/tcpdump -i a...
android studio profiler崩溃
删除测试手机/data/local/tmp/perfd文件夹重新启动就不会崩溃
shell脚本
牙叔教程简单易懂目标用autojs执行shell脚本, 脚本所在目录为 /data/local/tmp 缘起...

Android逆向黑域在 /data/local/tmp 下启

相关文章

Android逆向黑域在 /data/local/tmp 下启

ndk开发技巧

Android apk 安装相关的几个目录

Minicap

hook in java(2)

魅族手机应用卸载不完全无法安装应用解决方案

frida使用

tcpdump抓包命令

android studio profiler崩溃

shell脚本

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读

Android逆向 黑域在 /data/local/tmp 下启

相关文章

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读

Android逆向黑域在 /data/local/tmp 下启