https://overkazaf.github.io/reverse_engineering/tags/smali/Android 与 Web 逆向工程实战手册Hugo 0.147.7 & FixIt v0.4.0-alpha.3-20251224074056-4fec1cdazh-CNoverkazaf@gmail.com (+5)overkazaf@gmail.com (+5)Mon, 22 Jul 2024 00:00:00 +0000https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/selinux/Mon, 22 Jul 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/selinux/<h1 class="heading-element" id="selinux-安全机制"><span>SELinux 安全机制</span> <a href="#selinux-%e5%ae%89%e5%85%a8%e6%9c%ba%e5%88%b6" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>SELinux (Security-Enhanced Linux) 是 Android 安全模型的核心组件，从 Android 4.3 开始引入，Android 5.0 后全面强制执行。理解 SELinux 对于逆向工程、Root 检测绕过、应用沙箱分析至关重要。</p>https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/smali_syntax/Fri, 12 Jul 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/smali_syntax/<h1 class="heading-element" id="smali-语法入门"><span>Smali 语法入门</span> <a href="#smali-%e8%af%ad%e6%b3%95%e5%85%a5%e9%97%a8" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>Smali/Baksmali 是 Dalvik 虚拟机字节码的汇编器/反汇编器。Smali 是对 DEX 格式的一种人类可读的表示，允许我们精确地查看和修改应用的行为。理解 Smali 是进行 Android 应用静态 patching（修改后重打包）的关键。</p>https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/binder_ipc/Mon, 08 Jul 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/binder_ipc/<h1 class="heading-element" id="android-binder-跨进程通信机制"><span>Android Binder 跨进程通信机制</span> <a href="#android-binder-%e8%b7%a8%e8%bf%9b%e7%a8%8b%e9%80%9a%e4%bf%a1%e6%9c%ba%e5%88%b6" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>Binder 是 Android 系统中最核心、最独特的 IPC（Inter-Process Communication，跨进程通信）机制。可以说：<strong>无 Binder，不 Android</strong>。</p>https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/binary_analysis_toolkit/Sat, 06 Jul 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/binary_analysis_toolkit/<h1 class="heading-element" id="二进制分析工具链"><span>二进制分析工具链</span> <a href="#%e4%ba%8c%e8%bf%9b%e5%88%b6%e5%88%86%e6%9e%90%e5%b7%a5%e5%85%b7%e9%93%be" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>Unicorn、Capstone、Keystone 是现代二进制分析的三大基础框架，它们共同构成了许多高级工具（如 Unidbg、Qiling、Frida）的底层支撑。理解这些基础技术对于深入逆向工程至关重要。</p>https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/android_components/Wed, 26 Jun 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/android_components/<h1 class="heading-element" id="android-四大组件"><span>Android 四大组件</span> <a href="#android-%e5%9b%9b%e5%a4%a7%e7%bb%84%e4%bb%b6" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>Android 的应用框架核心由四个基本组件构成。每个组件都是一个独立的实体，系统和应用可以通过它进入你的 App。理解这四个组件的职责和生命周期是进行任何 Android 开发或逆向分析的基础。</p>https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/android_manifest/Sat, 01 Jun 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/android_manifest/<h1 class="heading-element" id="androidmanifestxml-深度解析"><span>AndroidManifest.xml 深度解析</span> <a href="#androidmanifestxml-%e6%b7%b1%e5%ba%a6%e8%a7%a3%e6%9e%90" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p><code>AndroidManifest.xml</code> 是 Android 应用的&quot;大脑&quot;和&quot;蓝图&quot;。它是一个强制性的配置文件，位于每个 APK 的根目录中。该文件向 Android 构建工具、操作系统和 Google Play 描述了应用的基本信息、组件、权限和硬件要求。对于逆向工程师来说，这是了解应用功能、入口点和安全边界的首要切入点。</p>https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/x86_and_arm_assembly_basics/Tue, 21 May 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/x86_and_arm_assembly_basics/<h1 class="heading-element" id="x86-与-arm-汇编基础指南"><span>x86 与 ARM 汇编基础指南</span> <a href="#x86-%e4%b8%8e-arm-%e6%b1%87%e7%bc%96%e5%9f%ba%e7%a1%80%e6%8c%87%e5%8d%97" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>汇编语言是与计算机硬件直接对话的低级编程语言，是逆向工程、系统编程和性能优化的基石。在当今世界，x86 和 ARM 是两种最主流的指令集架构 (ISA)。理解它们的核心概念与差异对于逆向工程师至关重要。</p>https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/totp/Sat, 13 Apr 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/totp/<h1 class="heading-element" id="totp-技术原理"><span>TOTP 技术原理</span> <a href="#totp-%e6%8a%80%e6%9c%af%e5%8e%9f%e7%90%86" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p><strong>TOTP (Time-Based One-Time Password)</strong> 是一种基于时间的一次性密码算法，广泛应用于双因素认证 (2FA) 和 API 防护场景。</p>https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/Sun, 23 Jun 2024 00:00:00 +0000overkazaf@gmail.com (+5)https://overkazaf.github.io/reverse_engineering/android/04-reference/foundations/<p>本章汇总了 Android 逆向工程所需的基础知识，包括系统组件、文件格式、汇编语言、运行时机制等核心概念。扎实的基础是进行高效逆向分析的前提，建议在实战之前系统性地掌握这些内容。</p>