1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

+------------------+     +------------------+     +------------------+
|  解压 APK        | --> |  检查 DEX 大小    | --> |  DEX < 1MB?      |
|  (unzip/apktool) |     |  ls -la *.dex    |     |  是 -> 可能加固   |
+------------------+     +------------------+     +------------------+
         |                                               |
         +-------->  检查 lib/ SO 文件  -----> 匹配厂商特征库
         |                                               |
         +-------->  检查 assets 目录   -----> 匹配加密文件特征
         |                                               |
         +-------->  检查 Manifest      -----> 匹配 Application 类名
                                                         |
                                                  APKiD 交叉验证

1
2

# 快速查看 Application 类名
aapt dump xmltree target.apk AndroidManifest.xml | grep "android:name"

1
2

# 列出所有 SO 文件
unzip -l target.apk | grep "\.so$"

1
2
3

# 正常 DEX 头为 "dex\n035"，被修改则说明加固
xxd classes.dex | head -1
# legu -> 腾讯乐固 | 全零 -> 梆梆/爱加密

1
2
3
4

pip install apkid
apkid target.apk          # 基本扫描
apkid -j target.apk       # JSON 输出
apkid -r ./apk_samples/   # 批量扫描

1
2
3
4
5
6
7
8

第一代 (2013-2015)         第二代 (2015-2018)         第三代 (2018-至今)
+-------------------+     +-------------------+     +-------------------+
| DEX 整体加密      |     | DEX 函数抽取      |     | 指令级 VMP        |
| - 运行时解密还原  | --> | - 函数体替为 nop  | --> | - 字节码虚拟化    |
| - 内存中完整 DEX  |     | - 运行时动态填回  |     | - 自定义解释器    |
+-------------------+     +-------------------+     +-------------------+
  脱壳: 内存 dump           脱壳: FART 主动调用        脱壳: 逆向虚拟机
  难度: ★★☆☆☆             难度: ★★★☆☆             难度: ★★★★★

1
2
3
4
5
6
7

$ apkid target.apk
[+] target.apk!classes.dex
 |-> compiler : dexlib 2.x
 |-> packer : Tencent Legu
[+] target.apk!lib/armeabi-v7a/libshella-2.10.3.1.so
 |-> packer : Tencent Legu
 |-> anti_disassembly : Tencent Legu

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

#!/usr/bin/env python3
"""APK 加固厂商识别脚本"""
import zipfile, sys
from pathlib import Path

SIGNATURES = {
    "360加固":   {"so": ["libjiagu", "libprotectClass"],
                  "assets": [".jiagu"], "app": ["com.stub.StubApp"]},
    "腾讯乐固": {"so": ["liblegu", "libshella", "libshellx"],
                  "assets": ["legu_data", "tosversion"], "app": ["com.tencent.StubShell"]},
    "梆梆安全": {"so": ["libSecShell", "libsecexe", "libsecmain"],
                  "assets": ["bangcle_classes"], "app": ["com.bangcle", "com.secshell"]},
    "网易易盾": {"so": ["libnesec"],
                  "assets": ["nesec.dat", "classes.dex.ys"], "app": ["com.netease.nis"]},
    "爱加密":   {"so": ["libijiami", "libexecmain"],
                  "assets": ["ijiami.dat"], "app": ["com.ijiami"]},
    "娜迦":     {"so": ["libchaosvmp", "libddog", "libnagavm"],
                  "assets": ["nagain"], "app": ["com.nagain"]},
    "几维安全": {"so": ["libkwscmm", "libkwscr"],
                  "assets": ["kiwi.dat"], "app": ["com.kiwisec"]},
}

def identify(apk_path):
    results = {}
    with zipfile.ZipFile(apk_path) as zf:
        files = zf.namelist()
        for name, sigs in SIGNATURES.items():
            score, matches = 0, []
            for f in files:
                fl = f.lower()
                for p in sigs["so"]:
                    if p.lower() in fl and f.endswith(".so"):
                        score += 3; matches.append(f"SO: {f}")
                for p in sigs["assets"]:
                    if p.lower() in fl and "assets" in fl:
                        score += 2; matches.append(f"Assets: {f}")
            # 检查 DEX 大小
            for f in files:
                if f == "classes.dex" and zf.getinfo(f).file_size < 500*1024:
                    score += 1; matches.append("DEX < 500KB")
            if score > 0:
                results[name] = {"score": score, "matches": matches}
    return results

if __name__ == "__main__":
    apk = sys.argv[1] if len(sys.argv) > 1 else exit("用法: python detect.py <apk>")
    for name, data in sorted(identify(apk).items(), key=lambda x: -x[1]["score"]):
        level = "高" if data["score"] >= 5 else "中" if data["score"] >= 3 else "低"
        print(f"[{level}] {name} (分数:{data['score']})")
        for m in data["matches"]:
            print(f"    - {m}")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

// rasp_detect.js - 运行时检测加固类型
Java.perform(function() {
    var packer_map = {
        "libjiagu": "360加固", "liblegu": "腾讯乐固", "libshella": "腾讯乐固",
        "libSecShell": "梆梆安全", "libnesec": "网易易盾",
        "libijiami": "爱加密", "libchaosvmp": "娜迦", "libkwscmm": "几维安全",
    };
    Process.enumerateModules().forEach(function(mod) {
        for (var key in packer_map) {
            if (mod.name.indexOf(key) !== -1) {
                console.log("[!] " + mod.name + " -> " + packer_map[key]
                    + " (base:" + mod.base + " size:" + mod.size + ")");
            }
        }
    });
});

1
2
3
4
5

决策流程:
  识别加固 --> 一代壳 --> Frida dump DEX --> Jadx 反编译
          --> 二代壳 --> FART 脱壳 --> 回填 CodeItem --> Jadx
          --> 三代壳 --> 值得脱壳? -- 是 --> 逆向 VMP (数天~数周)
                                    -- 否 --> Hook API / 抓包 / 内存搜索

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

正常函数 CFG:               OLLVM 平坦化后 CFG:
   +-----+                     +----------+
   | 入口 |                     |  分发器   |<-------+
   +--+--+                     | (switch)  |        |
      |                        +--+--+--+--+        |
   +--v--+                       |  |  |  |         |
   | 判断 |                  +---+  |  |  +---+     |
   +--+--+                  v      v  v      v     |
      |                    BB1   BB2  BB3   BB4    |
   +--v--+                  +------+--+------+     |
   | 返回 |                        +---------------+
   +-----+

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

原始 SO 函数:                VMP 保护后:
  func_a:                    func_a:
    mov r0, #1                 push {r0-r12}
    add r1, r0, #2             ldr r0, =vm_bytecode_a
    str r1, [sp]               bl  vm_dispatcher    ----+
    bx lr                      pop {r0-r12}             |
                               bx lr                    |
                                                        |
                             vm_dispatcher:    <---------+
                               ; 读取自定义字节码
                               ; 查 opcode handler 表
                               ; 分发执行
                               ; 循环直到 VM_EXIT

1
2
3

# 用 readelf 检查 .init_array（校验逻辑常藏在这里）
readelf -d libnative.so | grep INIT
readelf -x .init_array libnative.so

1
2
3
4
5
6
7
8
9

RASP 保护层次
+----------------------------------------------+
| 应用层: Root/Magisk/KernelSU 检测, 模拟器检测 |
+----------------------------------------------+
| 框架层: Frida/Xposed 检测, 签名校验, DEX CRC  |
+----------------------------------------------+
| 系统层: ptrace 反调试, /proc/self/maps,       |
|         TracerPid, SELinux 状态               |
+----------------------------------------------+

1
2
3
4
5
6
7
8

# 解压并检查 DEX 大小 -- 小于 500KB 基本确认加固
unzip -l target.apk | grep "classes.dex"

# 列出所有 SO 文件
unzip -l target.apk | grep "\.so$"

# 查看 DEX 文件头
unzip -p target.apk classes.dex | xxd | head -1

1

apkid target.apk

1
2

aapt dump xmltree target.apk AndroidManifest.xml | grep "android:name"
# 比对本文「加固厂商识别指纹总表」中的 Application 类名

1
2
3
4
5
6
7
8

识别结果 --> 查阅「针对不同壳的脱壳策略」表
  |
  +-> 一代壳 -> Frida dump -> Jadx 反编译 -> 分析
  +-> 二代壳 -> FART 脱壳 -> 回填 CodeItem -> 分析
  +-> 三代壳 -> 评估是否值得脱壳
  |     +-- 是 -> 逆向 VMP 解释器（耗时数天到数周）
  |     +-- 否 -> Hook 关键 API / 网络抓包 / 内存搜索
  +-> 未加固 -> 直接 Jadx 反编译

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

$ apkid target.apk
[+] target.apk!classes.dex
 |-> packer : Qihoo 360 (DexProtector)
[+] target.apk!lib/armeabi-v7a/libjiagu.so
 |-> packer : Qihoo 360

$ unzip -l target.apk | grep "\.so$"
  lib/armeabi-v7a/libjiagu.so
  lib/armeabi-v7a/libjiagu_art.so
# 确认 360 加固，一代壳 -> Frida dump 即可

$ frida -U -f com.target.app -l frida_dex_dump.js --no-pause
# dump 后用 Jadx 打开分析