android 反编译心得
kerrysimon 2014-06-11
工程文件反编译后,首先查看资源文件与配置文件格式是否对的,将src下的R文件放入gen下,修正src下源文件的编码错误.
R.styleable:R下文件的编码错误通常是由资源文件引起的,修改资源文件
<declare-styleable name="TileView">
<attr name="tileSize" format="integer" />
</declare-styleable>
通常反编译后类型为Object的,修改其编译类型,如int的则修改为int类型.
null值错误,可以看其类型改为0或""
去掉:import dalvik.annotation.Signature;
去掉: @Signature({"Ljava/util/ArrayList", "<", "Lcom/example/android/snake/SnakeView$Coordinate;", ">;"})
这是反编译时dalvik虚拟机自动生成的.
java class 利用jad 反编译之后，偶尔回碰到一些不正常的代码，例如：label0 :_L1 MISSING_BLOCK_LABEL_30、JVM INSTR ret 7、JVM INSTR tableswitch 1 3: default 269、 JVM INSTR monitorexit、JVM INSTR monitorenter，这些一般是由特殊的for循环、try catch finally语句块、synchronized语句反编译后产生的。下面，就简单介绍一下，一些反编译后的特殊代码的还原规则。
异常
下面的代码前提是类中有如下属性，
显示代码打印1 Calendar cal = Calendar.getInstance();
1、Exceptioin的还原
反编译后的代码如下：
显示代码打印1 public boolean f1() { return cal.getTime().after(new Date());
2 Exception e;
3 e;
4 e.printStackTrace();
5 return false;
6 }
还原后的Java代码
显示代码打印1 public boolean f1() { try { return cal.getTime().after(new Date());
2 } catch (Exception e) { e.printStackTrace();
3 return false;
4 } }
2、finally代码的还原 反编译后的Java代码如下：
显示代码打印01 public boolean f2() { boolean flag = cal.getTime().after(new Date());
02 System.out.println("finally");
03 return flag;
04 Exception e;
05 e;
06 e.printStackTrace();
07 System.out.println("finally");
08 return false;
09 Exception exception;
10 exception;
11 System.out.println("finally");
12 throw exception;
13 }
还原后的代码如下：
显示代码打印1 public boolean f2() { try { return cal.getTime().after(new Date());
2 } catch (Exception e) { e.printStackTrace();
3 return false;
4 } finally { System.out.println("finally");
5 } }
3、MISSING_BLOCK_LABEL_的还原反编译后的代码
显示代码打印01 public Object f22() { Date date = cal.getTime();
02 System.out.println("finally");
03 return date;
04 Exception e;
05 e;
06 e.printStackTrace();
07 System.out.println("finally");
08 break MISSING_BLOCK_LABEL_45;
09 Exception exception;
10 exception;
11 System.out.println("finally");
12 throw exception;
13 return null;
14 }
还原后的Java代码
显示代码打印1 public Object f22() { try { return cal.getTime();
2 } catch (Exception e) { e.printStackTrace();
3 } finally { System.out.println("finally");
4 } return null;
5 }
4、异常中:label的还原反编译后的代码
显示代码打印01 public String f4() throws Exception { label0: { try { Integer i = new Integer(1);
02 if(i.intValue() >
03 0) { System.out.println(i);
04 break label0;
05 } System.err.println(i);
06 } catch(Exception dae) { System.err.println(dae);
07 throw new RuntimeException(dae);
08 } return null;
09 } return "Hello";
10 }
注意，这个代码有点诡异，实际代码如下：
显示代码打印1 public String f4() throws Exception { try { Integer i = new Integer(1);
2 if (i.intValue() >
3 0) { System.out.println(i);
4 } else { System.err.println(i);
5 return null;
6 } return "Hello";
7 } catch (Exception dae) { System.err.println(dae);
8 throw new RuntimeException(dae);
9 } }
5、典型数据库操作代码还原反编译后代码
显示代码打印01 public HashMap f5() { Connection conn = null;
02 HashMap hashmap;
03 HashMap map = new HashMap();
04 Class.forName("");
05 conn = DriverManager.getConnection("jdbc:odbc:");
06 PreparedStatement pstmt = conn.prepareStatement("select * from table");
07 pstmt.setString(1, "param");
08 String columnVallue;
09 for(ResultSet rs = pstmt.executeQuery();
10 rs.next();
11 map.put(columnVallue, "")) columnVallue = rs.getString("column");
12 hashmap = map;
13 if(conn != null) try { conn.close();
14 } catch(SQLException sqlce) { sqlce.printStackTrace();
15 } return hashmap;
16 ClassNotFoundException cnfe;
17 cnfe;
18 cnfe.printStackTrace();
19 if(conn != null) try { conn.close();
20 } catch(SQLException sqlce) { sqlce.printStackTrace();
21 } break MISSING_BLOCK_LABEL_188;
22 SQLException sqle;
23 sqle;
24 sqle.printStackTrace();
25 if(conn != null) try { conn.close();
26 } catch(SQLException sqlce) { sqlce.printStackTrace();
27 } break MISSING_BLOCK_LABEL_188;
28 Exception exception;
29 exception;
30 if(conn != null) try { conn.close();
31 } catch(SQLException sqlce) { sqlce.printStackTrace();
32 } throw exception;
33 return null;
34 }
实际代码如下：
显示代码打印01 public HashMap f5() { Connection conn = null;
02 try { HashMap map = new HashMap();
03 Class.forName("");
04 conn = DriverManager.getConnection("jdbc:odbc:");
05 PreparedStatement pstmt = conn.prepareStatement("select * from table");
06 pstmt.setString(1, "param");
07 ResultSet rs = pstmt.executeQuery();
08 while (rs.next()) { String columnVallue = rs.getString("column");
09 map.put(columnVallue, "");
10 } return map;
11 } catch (ClassNotFoundException cnfe) { cnfe.printStackTrace();
12 } catch (SQLException sqle) { sqle.printStackTrace();
13 } finally { if (conn != null) { try { conn.close();
14 } catch (SQLException sqlce) { sqlce.printStackTrace();
15 } } } return null;
16 }
6、两层异常嵌套代码还原反编译后的代码
显示代码打印01 public int f6() { int i = cal.getTime().compareTo(new Date());
02 System.out.println("finally");
03 return i;
04 Exception e1;
05 e1;
06 e1.printStackTrace();
07 System.out.println("finally");
08 return -1;
09 Exception e2;
10 e2;
11 e2.printStackTrace();
12 System.out.println("finally");
13 return -2;
14 Exception exception;
15 exception;
16 System.out.println("finally");
17 throw exception;
18 }
实际代码
显示代码打印1 public int f6() { try { try { return cal.getTime().compareTo(new Date());
2 } catch (Exception e1) { e1.printStackTrace();
3 return -1;
4 } } catch (Exception e2) { e2.printStackTrace();
5 return -2;
6 } finally { System.out.println("finally");
7 } }
7、非常诡异的代码反编译后的代码
显示代码打印01 public int f7() { int i = cal.getTime().compareTo(new Date());
02 System.out.println("finally");
03 return i;
04 Exception e1;
05 e1;
06 e1.printStackTrace();
07 _L2: System.out.println("finally");
08 return -1;
09 Exception e2;
10 e2;
11 e2.printStackTrace();
12 if(true) goto _L2;
13 else goto _L1 _L1: Exception exception;
14 exception;
15 System.out.println("finally");
16 throw exception;
17 }
原始代码
显示代码打印1 public int f7() { try { try { return cal.getTime().compareTo(new Date());
2 } catch (Exception e1) { e1.printStackTrace();
3 return -1;
4 } } catch (Exception e2) { e2.printStackTrace();
5 return -1;
6 } finally { System.out.println("finally");
7 } }
