Android 逆向之旅(上)

Download as pptx, pdf

0 likes297 views

Pu Lee

该文档介绍了安卓逆向工程的基本知识和动机，包括恶意应用分析、广告屏蔽及系统漏洞分析。文中提到了础笔碍格式、顿贰虫格式、修改和重新封包应用程序的工具和步骤。还包含了伪演示，展示了如何拆包应用和分析其代码结构。

Technology

Android 逆向之旅(上)
資工三A 李樸
2015/10/13電算中心網路系統工讀小組工读分享

Agenda
? 逆向動機
? 基礎知識
? Demo
2015/10/13電算中心網路系統工讀小組工读分享

逆向動機
? 分析惡意APP
? 屏蔽廣告
? 分析有興趣功能
? 分析系統漏洞
? 破解
2015/10/13電算中心網路系統工讀小組工读分享

Dalvik VM
2015/10/13電算中心網路系統工讀小組工读分享
Register-based
architecture

APK
? 取得途徑：網路，自己寫，手機內……
? 已安裝APP: /data/app
2015/10/13電算中心網路系統工讀小組工读分享

APK Format
? ZIP File
? Content:
o META-INF
o lib
o res
o assets
o classes.dex
o resources.arsc
o AndroidManifest.xml
2015/10/13電算中心網路系統工讀小組工读分享

Dex Format
? Dalvik Executable format
? 工具：
o Dex2Jar
o JD-GUI
? 可以快速分析 App 於 Java 層行為
? 代碼混淆：ProGuard，APKProtect
2015/10/13電算中心網路系統工讀小組工读分享

修改 – 拆包
? ApkTool.jar
? java -jar apktool.jar d target.apk target
? smali: Opcode(ByteCode) of Dalvik VM
? 從 JAR 分析後找對應 smali 修改
2015/10/13電算中心網路系統工讀小組工读分享

修改 --回封
? ApkTool.jar
? java -jar apktool.jar b target
? 簽名後才能於裝置安裝
? signapk
2015/10/13電算中心網路系統工讀小組工读分享

Pseudo Demo
? Origin App:
2015/10/13電算中心網路系統工讀小組工读分享

Pseudo Demo – 拆包
2015/10/13電算中心網路系統工讀小組工读分享

Pseudo Demo
? Smali:
o file HelloAndroid$1
? .class Lcom/example/helloandroid/HelloAndroid$1;
? .super Ljava/lang/Object;
? .source "HelloAndroid.java“
? # interfaces
? .implements Landroid/view/View$OnClickListener;
o Onclick: startActivity
o ==> Abount Button Listener
2015/10/13電算中心網路系統工讀小組工读分享

Pseudo Demo
? Smali:
o File HelloAndroid$2
? .class Lcom/example/helloandroid/HelloAndroid$2;
? .super Ljava/lang/Object;
? .source "HelloAndroid.java"
? # interfaces
? .implements Landroid/view/View$OnClickListener;
o Onclick Listener of Check Button
2015/10/13電算中心網路系統工讀小組工读分享

Pseudo Demo
? 關鍵
2015/10/13電算中心網路系統工讀小組工读分享

Pseudo Demo – 封包 & 簽名
2015/10/13電算中心網路系統工讀小組工读分享

Pseudo Demo
? Result:
2015/10/13電算中心網路系統工讀小組工读分享

覺得複雜?
? Native Library Disassembly
? ELF 結構
? ELF 加密節
? Init_array 自解密
? 模擬器檢測，root 檢測，文件 checksum 檢測……
? …… 待續
2015/10/13電算中心網路系統工讀小組工读分享

Thank you for your attention!
2015/10/13電算中心網路系統工讀小組工读分享

笔齿贰（预启动执行环境）是一种基于罢颁笔/滨笔的网络开机技术，方便管理多台电脑，实现系统的远程安装和恢复。本文介绍了笔齿贰的工作原理及其应用，如通过顿贬颁笔获取滨笔并请求启动程序，还提到了贵辞驳项目，旨在快速构建笔齿贰服务器并提供管理界面。文档还包含了一些示例和参考资料。

2024 Trend Updates: What Really Works In SEO & Content MarketingSearch Engine Journal

The document outlines key SEO and content marketing trends for 2024, emphasizing the impact of AI, the importance of E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness), and a shift towards user-centric content strategies. It advises against focusing on outdated trends like voice search and stresses the need for creating value-driven, authoritative content. Additionally, it highlights the need to leverage AI as a supportive tool rather than relying solely on it for content creation.

Storytelling For The Web: Integrate Storytelling in your Design ProcessChiara Aliotta

The document outlines a livestream presentation by Chiara Aliotta on integrating storytelling into web design to enhance user experiences. It covers the storytelling process for designers, emphasizing aspects such as understanding the audience, structuring narratives, and creating emotional connections. The presentation also includes case studies and practical examples to demonstrate effective storytelling in UX/UI design.

Artificial Intelligence, Data and Competition – SCHREPEL – June 2024 OECD dis...OECD Directorate for Financial and Enterprise Affairs

This presentation by Thibault Schrepel, Associate Professor of Law at Vrije Universiteit Amsterdam University, was made during the discussion “Artificial Intelligence, Data and Competition” held at the 143rd meeting of the OECD Competition Committee on 12 June 2024. More papers and presentations on the topic can be found at oe.cd/aicomp. This presentation was uploaded with the author’s consent.

How to Leverage AI to Boost Employee Wellness - Lydia Di Francesco - SocialHR...SocialHRCamp

The document discusses leveraging AI to enhance employee wellness through data analytics, automating tasks, and personalized wellness apps, emphasizing the shared responsibility of employee well-being between leaders and organizations. It outlines best practices for using AI in wellness strategies, including ensuring data privacy and security, understanding employee needs, and promoting inclusivity. Lydia Di Francesco, a wellness specialist, shares insights to optimize workplace wellness strategy using AI-driven data analytics and encourages collaboration and transparency.

2024 State of Marketing Report – by HubspotMarius Sescu

The State of Marketing 2024 report highlights the transformative impact of AI and automation, emphasizing the importance of personalization and engagement to drive growth in a competitive landscape. Marketers are focusing on optimizing budgets, leveraging social media for brand awareness, and utilizing AI tools to enhance efficiency across tasks. Key trends for 2024 include the rise of experiential marketing, content creation that meets user needs, and strengthened connections through personalized customer experiences.

Everything You Need To Know About ChatGPTExpeed Software

ChatGPT is an AI chatbot developed by OpenAI, built on advanced language models to facilitate human-like conversational interactions. Launched in November 2022, it utilizes a transformer architecture to understand and generate text, with applications ranging from content creation to customer service. Despite its capabilities, there are concerns about potential misuse and biases in its responses, which OpenAI aims to mitigate through moderation and user feedback.

Product Design Trends in 2024 | Teenage EngineeringsPixeldarts

How Race, Age and Gender Shape Attitudes Towards Mental HealthThinkNow

The November 2023 mental health report indicates that 70% of respondents rate their mental health as 'good' or 'excellent,' with higher diagnoses reported among African Americans and non-Hispanic whites compared to Hispanics and Asians. Younger generations, particularly Gen Z and millennials, are more likely to experience mental health challenges, seek information online, and report that their mental health impacts their work and relationships. Half of the respondents feel comfortable discussing their mental health with professionals, although Gen Z shows the least comfort in this area.

AI Trends in Creative Operations 2024 by Artwork Flow.pdfmarketingartwork

Creative operations teams expect increased AI use in 2024. Currently, over half of tasks are not AI-enabled, but this is expected to decrease in the coming year. ChatGPT is the most popular AI tool currently. Business leaders are more actively exploring AI benefits than individual contributors. Most respondents do not believe AI will impact workforce size in 2024. However, some inhibitions still exist around AI accuracy and lack of understanding. Creatives primarily want to use AI to save time on mundane tasks and boost productivity.

Skeleton Culture CodeSkeleton Technologies

Organizational culture includes values, norms, systems, symbols, language, assumptions, beliefs, and habits that influence employee behaviors and how people interpret those behaviors. It is important because culture can help or hinder a company's success. Some key aspects of Netflix's culture that help it achieve results include hiring smartly so every position has stars, focusing on attitude over just aptitude, and having a strict policy against peacocks, whiners, and jerks.

PEPSICO Presentation to CAGNY Conference Feb 2024Neil Kimberley

PepsiCo provided a safe harbor statement noting that any forward-looking statements are based on currently available information and are subject to risks and uncertainties. It also provided information on non-GAAP measures and directing readers to its website for disclosure and reconciliation. The document then discussed PepsiCo's business overview, including that it is a global beverage and convenient food company with iconic brands, $91 billion in net revenue in 2023, and nearly $14 billion in core operating profit. It operates through a divisional structure with a focus on local consumers.

Content Methodology: A Best Practices Report (Webinar)contently

This document provides an overview of content methodology best practices. It defines content methodology as establishing objectives, KPIs, and a culture of continuous learning and iteration. An effective methodology focuses on connecting with audiences, creating optimal content, and optimizing processes. It also discusses why a methodology is needed due to the competitive landscape, proliferation of channels, and opportunities for improvement. Components of an effective methodology include defining objectives and KPIs, audience analysis, identifying opportunities, and evaluating resources. The document concludes with recommendations around creating a content plan, testing and optimizing content over 90 days.

How to Prepare For a Successful Job Search for 2024Albert Qian

The document provides guidance on preparing a job search for 2024. It discusses the state of the job market, focusing on growth in AI and healthcare but also continued layoffs. It recommends figuring out what you want to do by researching interests and skills, then conducting informational interviews. The job search should involve building a personal brand on LinkedIn, actively applying to jobs, tailoring resumes and interviews, maintaining job hunting as a habit, and continuing self-improvement. Once hired, the document advises setting new goals and keeping skills and networking active in case of future opportunities.

Social Media Marketing Trends 2024 // The Global Indie InsightsKurio // The Social Media Age(ncy)

The 2024 social media marketing trends report highlights significant shifts influenced by generative AI, including the emergence of personalized content, the rise of virtual influencers, and a stronger focus on user-generated content. Insights were gathered from 33 experts across 23 leading independent agencies, providing a perspective that emphasizes creativity and authenticity in marketing strategies. Key trends also include the blending of B2B and B2C approaches, reflecting changes in consumer behavior and the evolving landscape of social media engagement.

Trends In Paid Search: Navigating The Digital Landscape In 2024Search Engine Journal

The document discusses trends in paid search for 2024, highlighting changes in user behavior, the implications for financial services, and privacy challenges. It emphasizes the importance of adapting search strategies, utilizing AI-driven tools like performance max and smart bidding, and leveraging first-party data for better marketing efficacy. Key takeaways include holistic SEO and SEM approaches, monitoring shifting user intents, and the need for continuous performance evaluation.

5 Public speaking tips from TED - Visualized summarySpeakerHub

The document outlines five public speaking tips from Chris Anderson, TED Talks curator, emphasizing the importance of eye contact, vulnerability, humor, humility, and storytelling. These skills are presented as essential for engaging audiences effectively and are increasingly valuable in today's economy. The article posits that mastering these techniques can enhance speakers' ability to communicate ideas powerfully.

ChatGPT and the Future of Work - Clark Boyd Clark Boyd

The document provides an overview of generative AI, particularly focusing on ChatGPT and its implications for business and the job market. It discusses the rapid growth of generative AI, its applications in marketing, and the skills needed for the AI era while addressing potential job displacement and the need for adaptation. The agenda includes a Q&A session and emphasizes rethinking work in collaboration with AI technology.

Getting into the tech field. what next Tessa Mero

The document provides career advice for getting into the tech field, including: - Doing projects and internships in college to build a portfolio. - Learning about different roles and technologies through industry research. - Contributing to open source projects to build experience and network. - Developing a personal brand through a website and social media presence. - Networking through events, communities, and finding a mentor. - Practicing interviews through mock interviews and whiteboarding coding questions.

Google's Just Not That Into You: Understanding Core Updates & Search IntentLily Ray

1. Core updates from Google periodically change how its algorithms assess and rank websites and pages. This can impact rankings through shifts in user intent, site quality issues being caught up to, world events influencing queries, and overhauls to search like the E-A-T framework. 2. There are many possible user intents beyond just transactional, navigational and informational. Identifying intent shifts is important during core updates. Sites may need to optimize for new intents through different content types and sections. 3. Responding effectively to core updates requires analyzing "before and after" data to understand changes, identifying new intents or page types, and ensuring content matches appropriate intents across video, images, knowledge graphs and more.

How to have difficult conversations Rajiv Jayarajah, MAppComm, ACC

Introduction to Data ScienceChristy Abraham Joy

The document discusses the rise and importance of data science and machine learning, highlighting the growing demand for data scientists and the challenges they face. It explains machine learning concepts such as supervised and unsupervised learning, along with various real-world applications and the necessary steps involved in a machine learning workflow. Additionally, the document emphasizes the iterative process of model improvement and feature engineering used to enhance machine learning outcomes.

Time Management & Productivity - Best PracticesVit Horky

The document outlines best practices for time management and productivity, focusing on effective meeting habits, structured work blocks, and the importance of reflection and goal setting. It emphasizes the need for proper planning, the use of appropriate tools, and prioritizing tasks to enhance both personal and team efficiency. Additionally, personal anecdotes and strategies are shared to encourage a positive mindset and enjoyment in achieving work-related goals.

Android 逆向之旅(上)

1. Android 逆向之旅(上) 資工三A 李樸 2015/10/13電算中心網路系統工讀小組工读分享

2. Agenda ? 逆向動機 ? 基礎知識 ? Demo 2015/10/13電算中心網路系統工讀小組工读分享

3. 逆向動機 ? 分析惡意APP ? 屏蔽廣告 ? 分析有興趣功能 ? 分析系統漏洞 ? 破解 2015/10/13電算中心網路系統工讀小組工读分享

4. Agenda ? 逆向動機 ? 基礎知識 ? Demo 2015/10/13電算中心網路系統工讀小組工读分享

5. Android 架構 2015/10/13電算中心網路系統工讀小組工读分享

6. Dalvik VM 2015/10/13電算中心網路系統工讀小組工读分享 Register-based architecture

7. APK ? 取得途徑：網路，自己寫，手機內…… ? 已安裝APP: /data/app 2015/10/13電算中心網路系統工讀小組工读分享

8. APK Format ? ZIP File ? Content: o META-INF o lib o res o assets o classes.dex o resources.arsc o AndroidManifest.xml 2015/10/13電算中心網路系統工讀小組工读分享

9. Dex Format ? Dalvik Executable format ? 工具： o Dex2Jar o JD-GUI ? 可以快速分析 App 於 Java 層行為 ? 代碼混淆：ProGuard，APKProtect 2015/10/13電算中心網路系統工讀小組工读分享

10. 修改 – 拆包 ? ApkTool.jar ? java -jar apktool.jar d target.apk target ? smali: Opcode(ByteCode) of Dalvik VM ? 從 JAR 分析後找對應 smali 修改 2015/10/13電算中心網路系統工讀小組工读分享

11. 修改 --回封 ? ApkTool.jar ? java -jar apktool.jar b target ? 簽名後才能於裝置安裝 ? signapk 2015/10/13電算中心網路系統工讀小組工读分享

12. Agenda ? 逆向動機 ? 基礎知識 ? Demo 2015/10/13電算中心網路系統工讀小組工读分享

13. Demo……? 2015/10/13電算中心網路系統工讀小組工读分享

14. Pseudo Demo ? Origin App: 2015/10/13電算中心網路系統工讀小組工读分享

15. Pseudo Demo – 拆包 2015/10/13電算中心網路系統工讀小組工读分享

16. Pseudo Demo ? Smali: o file HelloAndroid$1 ? .class Lcom/example/helloandroid/HelloAndroid$1; ? .super Ljava/lang/Object; ? .source "HelloAndroid.java“ ? # interfaces ? .implements Landroid/view/View$OnClickListener; o Onclick: startActivity o ==> Abount Button Listener 2015/10/13電算中心網路系統工讀小組工读分享

17. Pseudo Demo ? Smali: o File HelloAndroid$2 ? .class Lcom/example/helloandroid/HelloAndroid$2; ? .super Ljava/lang/Object; ? .source "HelloAndroid.java" ? # interfaces ? .implements Landroid/view/View$OnClickListener; o Onclick Listener of Check Button 2015/10/13電算中心網路系統工讀小組工读分享

18. Pseudo Demo ? 關鍵 2015/10/13電算中心網路系統工讀小組工读分享

19. Pseudo Demo – 封包 & 簽名 2015/10/13電算中心網路系統工讀小組工读分享

20. Pseudo Demo ? Result: 2015/10/13電算中心網路系統工讀小組工读分享

21. 覺得複雜? ? Native Library Disassembly ? ELF 結構 ? ELF 加密節 ? Init_array 自解密 ? 模擬器檢測，root 檢測，文件 checksum 檢測…… ? …… 待續 2015/10/13電算中心網路系統工讀小組工读分享

22. Thank you for your attention! 2015/10/13電算中心網路系統工讀小組工读分享

狠狠撸

Android 逆向之旅(上)

Recommended

More Related Content

Featured (20)

Android 逆向之旅(上)

狠狠撸

Android 逆向之旅(上)

Recommended

More Related Content

Featured (20)

Android 逆向之旅(上)

Android 逆向之旅(上)

Android 逆向之旅(上)