修改混淆jar中类方法

1.字节码出现类名与包名冲突

使用这个工具：jarjar工具

• 创建一个rule文件，如rule.txt，内容如下：

rule 原包名.** 目标包名.@1

例如：

rule a.b.c.** x.y.z.@1
rule a.b.c.** a.b.c.@1

然后运行jarjar工具，将要修改的jar包old.jar按照rule.txt的规则产生新的jar包new.jar

java -jar jarjar-1.4.jar process rule.txt old.jar new.jar

2. 利用javaassist修改对应方法

• 添加依赖

sourceCompatibility = 1.8

dependencies {
    compile 'io.reactivex.rxjava2:rxjava:2.1.16'
    compile fileTree('libs/javassist.jar')
}

• 导入类

public class Clazz {

    private String JAR_DIR = "";
    private String JAR_NAME = "";
    private String PKGNAME = "";
    private String CLASSNAME = "";

    private Clazz() {
    }

    public interface Builder {
        Clazz CLAZZ = new Clazz();
    }

    public interface Presenter {
        void onHack(CtClass ctClass) throws Exception;
    }

    public static Clazz initialize(String libDir, String libName) {
        Clazz clazz = Builder.CLAZZ;

        clazz.JAR_DIR = libDir;
        clazz.JAR_NAME = libName;
        return clazz;
    }


    @SuppressWarnings("ResultOfMethodCallIgnored")
    public void hackClass(String pkgName, String className, Presenter presenter) {

        PKGNAME = pkgName;
        CLASSNAME = className;

        // jar包路径
        // class位置
        // 输入class路径, jar uvf命令替换jar
//            String command = String.format("cd %s; jar uvf %s %s", JAR_DIR, JAR_NAME, clazzPath);
//            String[] cmd = {"/bin/sh", "-c", command};
        Observable.create((ObservableOnSubscribe<String>) emitter -> {
            // jar包路径
            String jar = getJarPath();
            File file = new File(jar);
            if (file.exists()) {
                emitter.onNext(jar);
                emitter.onComplete();
            } else {
                emitter.onError(new FileNotFoundException(jar + " NOT FOUND!"));
            }

        }).map(jarPath -> {
            ClassPool classPool = ClassPool.getDefault();

            classPool.insertClassPath(jarPath);

            // class位置
            String clazz = getClazzName();
            CtClass ctClass = classPool.get(clazz);

            if (presenter != null) {
                presenter.onHack(ctClass);
            }
            return ctClass.toBytecode();
        }).map(bytes -> {
            String clazzPath = getClazzPath();

            File dstFile = new File(clazzPath);
            if (!dstFile.getParentFile().exists()) {
                dstFile.getParentFile().mkdirs();
            }
            FileOutputStream output = new FileOutputStream(dstFile);

            output.write(bytes);
            output.flush();
            return dstFile.getAbsolutePath();
        }).map(savePath -> {  // 输入class路径, jar uvf命令替换jar
            String clazzPath = getClazzPath();

//            String command = String.format("cd %s; jar uvf %s %s", JAR_DIR, JAR_NAME, clazzPath);
//            String[] cmd = {"/bin/sh", "-c", command};
            String command = String.format("jar uvf %s %s", getJarPath(), clazzPath);

            return exec(command);

        }).subscribe(status -> {
            if (status == 0) {
                String command = String.format("rm -rf %s", getClazzRootPath());
                Runtime.getRuntime().exec(command);
            }
            System.out.printf("status: %d\t%s\n", status, Thread.currentThread().getName());
        });

    }

    private String getJarPath() {
        return String.format("%s/%s", JAR_DIR, JAR_NAME);
    }

    private String getClazzRootPath() {
        String rootPath;
        int index = PKGNAME.indexOf(".");
        if (index > 0) {
            rootPath = PKGNAME.substring(0, index);
        } else {
            rootPath = getClazzPath();
        }

        return rootPath;
    }

    private String getClazzPath() {
        String clazzPath;
        if (PKGNAME.isEmpty()) {
            clazzPath = String.format("%s.class", CLASSNAME);
        } else {
            clazzPath = String.format("%s/%s.class", PKGNAME.replace(".", "/"), CLASSNAME);
        }
        return clazzPath;
    }

    private String getClazzName() {
        String clazzName;
        if (PKGNAME.isEmpty()) {
            clazzName = CLASSNAME;
        } else {
            clazzName = String.format("%s.%s", PKGNAME, CLASSNAME);
        }
        return clazzName;
    }


    public static int exec(String... commands) throws IOException, InterruptedException {
        int status = 1;
        if (commands == null) {
            return status;
        }
        File wd = new File(".");
        Process proc = Runtime.getRuntime().exec("/bin/bash", null);
        if (proc != null) {
            BufferedReader in = new BufferedReader(new InputStreamReader(proc.getInputStream()));
            PrintWriter out = new PrintWriter(new BufferedWriter(new OutputStreamWriter(proc.getOutputStream())), true);
            for (String command : commands) {
                out.println(command);
            }
            out.println("exit");
            String line;
            while ((line = in.readLine()) != null) {
                System.out.println(line);
            }
            status = proc.waitFor();
            in.close();
            out.close();
            proc.destroy();
        }
        return status;
    }

    public static int exec2(String... commands) throws IOException, InterruptedException {
        int status = 1;
        if (commands == null) {
            return status;
        }
        String command = String.join(";", commands);
        String[] cmd = {"/bin/sh", "-c", command};
        Process proc = Runtime.getRuntime().exec(cmd);
        if (proc != null) {
            BufferedReader in = new BufferedReader(new InputStreamReader(proc.getInputStream()));
            String line;
            while ((line = in.readLine()) != null) {
                System.out.println(line);
            }
            status = proc.waitFor();
            in.close();
            proc.destroy();
        }
        return status;
    }


    public static String readContent(String path) throws IOException, NotFoundException {

        File file = new File(path);

        if (!file.exists()) {
            throw new NotFoundException("Not Found: " + file.getAbsolutePath());
        }
        BufferedReader in = new BufferedReader(new FileReader(file));
        String line;

        StringBuilder buffer = new StringBuilder();

        while ((line = in.readLine()) != null) {
            buffer.append(line).append("\n");
        }
        in.close();
        return buffer.toString();

    }
}

• 开始hook(写一个测试方法，修改charles.jar)

// dir: jar包目录
// charles.jar:  要修改的jar包名
 Clazz.initialize("dir", "charles.jar")
                .hackClass("com.xk72.charles", "oFTR", ctClass -> {

                    CtMethod ctMethod = ctClass.getDeclaredMethod("lktV", null);
                    ctMethod.setBody("{return \"Crack by me!\";}");

                });

3. 还原原包包名

按方法1修改即可。

END

• PS:

// 如果方法体过大，采用读文本的形式setBody
String content = Clazz.readContent("method.txt");
ctMethod.setBody(content);

method.txt内容如下：

{
  return "Crack by me!";
}