由工作端反作弊而引发的对应用安全的思考

// 主工程 build.gradleandroid {    buildTypes {        release {            // 配置release包的签名            signingConfig signingConfigs.key              // 混淆是否开启 [true 开启 、 false 不开启]            minifyEnabled true              // 配置混淆规则文件            proguardFiles getDefaultProguardFile(\'proguard-android-optimize.txt\'), \'proguard-rules.pro\'        }    }}

    fun isTestVersion(): Boolean {        val tags = android.os.Build.TAGS        val debugVersionKey = "test-keys"        if (!tags.isNullOrEmpty() && tags.contains(debugVersionKey)) {            Log.e("Root检测", "命中版本: $debugVersionKey")            return true        }        return false    }

   fun checkCheatApk(): Boolean {        val superUserApkPath = "/system/app/Superuser.apk"        try {            val file = File(superUserApkPath)            if (file.exists()) {                return true            }        } catch (e: Exception) {            e.printStackTrace()        }
        return false    }

val process = Runtime.getRuntime().exec(arrayOf("busybox", "df"))// 当process执行没有结果时,则表示没有root.

  class ShellApplication : Application() {
    override fun attachBaseContext(base: Context) {        super.attachBaseContext(base)
        // 1. 解压加固后apk.        val unzipApk = unzipApk()        // 2. 对dex文件进行解密操作        unzipApk.forEach {            if (it.name.endsWith(".dex")) {                val originalBytes = decrypt(it.toBytes())                val fileOutputStream = FileOutputStream(it)                fileOutputStream.write(originalBytes)                fileOutputStream.flush()                fileOutputStream.close()            }        }        // 提取出解密后的dex文件        val dexFiles = unzipApk.findDex()        // 使用类加载及动态加载机制完成原dex内容加载        DispatchByVersion.install(classLoader,dexFiles)
    }  }

enum OPCODES{MOV = 0xa0, // mov指令对应 0xa0XOR = 0xa1,CMP = 0xa2,RET = 0xa3,....};

typedef struct processor_t{int r0; // 虚拟寄存器r0~r15int r1;....int FP;int IP;char* SP;int LR;unsigned char* PC; // 虚拟机寄存器PC,指向正在解释的字节码地址int cpsr; // 虚拟标志寄存器flag,作用类似于eflagsvm_opcode op_table[OPCODE_NUM]; // 字节码列表,存放了所有字节码与对应的处理函数} vm_processor;

   void vm_CPU(vm_processor *proc, unsigned char* Vcode){      // PC指向被保护代码的第一个字节      proc -> PC = Vcode;      // 循环判断PC指向字节码是否为返回指令,如果不是就解释执行      while(*proc ->PC != RET){        int flag = 0;        int i = 0;        // 查找PC指向的正在解释的字节码对应的处理函数        while(!flag && i <OPCODE_NUM){          if(*proc->PC == proc->op_table[i].opcode){            flag = 1;            //查找到之后,调用本条指令的处理函数            proc->op_table[i].func((void*)proc);          }        }      }   } 

     public void onCreate(Bundle bundle) {          super.onCreate(bundle);          setContentView(R.layout.activity);          this.mPager = (ViewPager) findViewById(R.id.pager);          this.mTitles = (PagerTitleStrip) findViewById(R.id.titles);          this.mPager.setAdapter(this.mTermAdapter);      }
      /* access modifiers changed from: protected */      public void onStart() {          super.onStart();          bindService(new Intent(this, TerminalService.class), this.mServiceConn, 1);      }
      /* access modifiers changed from: protected */      public void onStop() {          super.onStop();          unbindService(this.mServiceConn);      }
      public boolean onCreateOptionsMenu(Menu menu) {          getMenuInflater().inflate(R.menu.activity, menu);          return true;      }
      public boolean onPrepareOptionsMenu(Menu menu) {          super.onPrepareOptionsMenu(menu);          menu.findItem(R.id.menu_close_tab).setEnabled(this.mTermAdapter.getCount() > 0);          return true;      }
      public boolean onOptionsItemSelected(MenuItem menuItem) {          switch (menuItem.getItemId()) {              case R.id.menu_close_tab /*{ENCODED_INT: 2131165281}*/:                  this.mService.destroyTerminal(this.mService.getTerminals().keyAt(this.mPager.getCurrentItem()));                  this.mTermAdapter.notifyDataSetChanged();                  invalidateOptionsMenu();                  return true;              case R.id.menu_new_tab /*{ENCODED_INT: 2131165282}*/:                  this.mService.createTerminal();                  this.mTermAdapter.notifyDataSetChanged();                  invalidateOptionsMenu();                  this.mPager.setCurrentItem(this.mService.getTerminals().size() - 1, true);                  return true;              default:                  return false;          }      }  ```

private final PagerAdapter mTermAdapter = new PagerAdapter() {        /* class com.android.terminal.TerminalActivity.AnonymousClass2 */        private SparseArray<SparseArray<Parcelable>> mSavedState = new SparseArray<>();
        static {            NativeUtil.classesInit0(629);        }
        @Override // androidx.viewpager.widget.PagerAdapter        public native void destroyItem(ViewGroup viewGroup, int i, Object obj);
        @Override // androidx.viewpager.widget.PagerAdapter        public native int getCount();
        @Override // androidx.viewpager.widget.PagerAdapter        public native int getItemPosition(Object obj);
        @Override // androidx.viewpager.widget.PagerAdapter        public native CharSequence getPageTitle(int i);
        @Override // androidx.viewpager.widget.PagerAdapter        public native Object instantiateItem(ViewGroup viewGroup, int i);
        @Override // androidx.viewpager.widget.PagerAdapter        public native boolean isViewFromObject(View view, Object obj);    };    private PagerTitleStrip mTitles;
    static {        NativeUtil.classesInit0(425);    }
    /* access modifiers changed from: protected */    public native void onCreate(Bundle bundle);
    public native boolean onCreateOptionsMenu(Menu menu);
    public native boolean onOptionsItemSelected(MenuItem menuItem);
    public native boolean onPrepareOptionsMenu(Menu menu);
    /* access modifiers changed from: protected */    public native void onStart();
    /* access modifiers changed from: protected */    public native void onStop();