https://overkazaf.github.io/reverse_engineering/android/01-recipes/Android 与 Web 逆向工程实战手册Hugo 0.147.7 & FixIt v0.4.0-alpha.3-20251224074056-4fec1cdazh-CNoverkazaf@gmail.com (+5)overkazaf@gmail.com (+5)Fri, 30 May 2025 00:00:00 +0000https://overkazaf.github.io/reverse_engineering/android/01-recipes/anti-detection/Fri, 30 May 2025 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/01-recipes/anti-detection/<p>本节专注于 Android 应用中各类检测与防护机制的分析与绕过。内容涵盖调试器检测、设备指纹识别、验证码防护以及应用加固识别等攻防对抗技术，帮助安全研究人员理解和突破目标应用的安全防线。</p>https://overkazaf.github.io/reverse_engineering/android/01-recipes/scripts/Fri, 16 May 2025 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/01-recipes/scripts/<p>本节收录了 Android 逆向工程中常用的脚本与工具代码，涵盖 Frida Hook、eBPF 追踪、Objection 命令速查以及自动化辅助脚本。这些脚本可作为日常分析工作的快速参考和直接复用的代码库。</p>https://overkazaf.github.io/reverse_engineering/android/01-recipes/native/Wed, 07 May 2025 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/01-recipes/native/<p>本节介绍 Android Native 层开发的基础知识，包括 JNI 的调用机制与 SO 动态库的编译加载流程。理解这些底层原理是进行 Native 层逆向分析的必要前提。</p> <h2 class="heading-element" id="章节导航"><span>章节导航</span> <a href="#%e7%ab%a0%e8%8a%82%e5%af%bc%e8%88%aa" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><ul> <li><a href="jni_development">JNI 开发与调用原理</a> - Java 与 Native 代码的交互机制、数据类型映射与调用约定</li> <li><a href="so_compilation">SO 动态库编译与加载</a> - SO 文件的编译工具链、加载流程与链接机制详解</li> </ul>https://overkazaf.github.io/reverse_engineering/android/01-recipes/network/Fri, 14 Mar 2025 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/01-recipes/network/<p>本节聚焦 Android 应用的网络层安全分析，涵盖流量抓包、加密密钥提取以及 TLS 指纹识别与绕过技术。掌握这些技术是理解应用通信协议和突破传输层防护的关键。</p> <h2 class="heading-element" id="章节导航"><span>章节导航</span> <a href="#%e7%ab%a0%e8%8a%82%e5%af%bc%e8%88%aa" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><h3 class="heading-element" id="流量捕获与加密分析"><span>流量捕获与加密分析</span> <a href="#%e6%b5%81%e9%87%8f%e6%8d%95%e8%8e%b7%e4%b8%8e%e5%8a%a0%e5%af%86%e5%88%86%e6%9e%90" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h3><ul> <li><a href="network_sniffing">抓包分析 Android 应用的网络流量</a> - 网络抓包的环境搭建、证书安装与常见问题排查</li> <li><a href="crypto_analysis">分析并提取 Android 应用的加密密钥</a> - 定位并提取应用运行时使用的加密密钥</li> </ul> <h3 class="heading-element" id="tls-指纹识别"><span>TLS 指纹识别</span> <a href="#tls-%e6%8c%87%e7%ba%b9%e8%af%86%e5%88%ab" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h3><ul> <li><a href="ja3_fingerprinting">JA3 TLS 指纹识别技术详解</a> - JA3 指纹的原理、生成方式与检测应用</li> <li><a href="ja4_fingerprinting">JA4+ TLS/QUIC 指纹识别技术详解</a> - 新一代 JA4+ 指纹体系的技术细节与实践</li> <li><a href="tls_fingerprinting_guide">使用 TLS 指纹识别检测和绕过应用指纹</a> - TLS 指纹的检测机制与绕过策略</li> </ul>https://overkazaf.github.io/reverse_engineering/android/01-recipes/automation/Tue, 04 Feb 2025 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/01-recipes/automation/<p>本节围绕逆向工程的工程化落地，涵盖自动化采集、代理池搭建、容器化部署以及反爬虫对抗等内容。旨在将单点的逆向分析成果转化为可规模化运行的生产系统。</p>https://overkazaf.github.io/reverse_engineering/android/01-recipes/analysis/Mon, 09 Dec 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/01-recipes/analysis/<p>本节聚焦 Android 逆向中的核心分析技术，涵盖动态分析、协议逆向、签名算法破解以及各类代码混淆的对抗方法。无论是 Java 层的 VMP 保护还是 Native 层的 OLLVM 混淆，都能在此找到对应的实战方案。</p>https://overkazaf.github.io/reverse_engineering/android/01-recipes/unpacking/Mon, 04 Nov 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/01-recipes/unpacking/<p>本节专注于 Android 应用加固的脱壳与 SO 文件的反混淆技术。内容涵盖主流加固方案的脱壳方法、SO 文件修复、花指令去除以及字符串混淆对抗，帮助安全研究人员还原被保护的应用原始代码。</p>