fix: 修复 Megaphone 图标导入拼写错误
This commit is contained in:
@@ -0,0 +1,356 @@
|
||||
package com.example.shell;
|
||||
|
||||
import android.app.Activity;
|
||||
import android.app.AlertDialog;
|
||||
import android.app.Application;
|
||||
import android.app.Dialog;
|
||||
import android.graphics.Color;
|
||||
import android.os.Handler;
|
||||
import android.os.Looper;
|
||||
import android.view.Gravity;
|
||||
import android.view.View;
|
||||
import android.view.ViewGroup;
|
||||
import android.widget.Button;
|
||||
import android.widget.FrameLayout;
|
||||
import android.widget.LinearLayout;
|
||||
import android.widget.TextView;
|
||||
import android.widget.Toast;
|
||||
|
||||
import java.lang.ref.WeakReference;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.Map;
|
||||
|
||||
public class HookApplication extends Application {
|
||||
|
||||
public static boolean showDialog = true;
|
||||
public static boolean showFullscreen = true; // ✅ 全屏弹窗开关
|
||||
|
||||
private AlertDialog dialog = null;
|
||||
private Dialog fullscreenDialog = null; // ✅ 全屏弹窗引用
|
||||
|
||||
public static boolean showImageFullscreen = true; // ✅ 控制图片弹窗
|
||||
private Dialog imageDialog = null;
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
private WeakReference<Activity> currentActivityRef = null;
|
||||
@Override
|
||||
public void onCreate() {
|
||||
super.onCreate();
|
||||
|
||||
Toast.makeText(getApplicationContext(), "HookApplication 已启动", Toast.LENGTH_SHORT).show();
|
||||
|
||||
//Hook弹窗
|
||||
new Handler(Looper.getMainLooper()).postDelayed(() -> {
|
||||
showPopupLoop();
|
||||
}, 3000);
|
||||
|
||||
//全屏欢迎弹窗
|
||||
new Handler(Looper.getMainLooper()).postDelayed(() -> { // ✅ 全屏弹窗监听
|
||||
showFullscreenLoop();
|
||||
}, 3000);
|
||||
|
||||
//全屏广告弹窗
|
||||
new Handler(Looper.getMainLooper()).postDelayed(() -> {
|
||||
showImageFullscreenLoop(
|
||||
"https://i11.hoopchina.com.cn/editor/3037dc8d3081ab92b16a80b36ef1b332_w_1242_h_1242_.png",
|
||||
() -> Toast.makeText(getApplicationContext(), "你点击了图片", Toast.LENGTH_SHORT).show(),
|
||||
5
|
||||
);
|
||||
}, 3000);
|
||||
}
|
||||
|
||||
private void showPopupLoop() {
|
||||
Handler handler = new Handler(Looper.getMainLooper());
|
||||
|
||||
Runnable popupTask = new Runnable() {
|
||||
@Override
|
||||
public void run() {
|
||||
if (!showDialog) {
|
||||
if (dialog != null && dialog.isShowing()) {
|
||||
dialog.dismiss();
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
Activity activity = getCurrentActivity();
|
||||
|
||||
if (activity == null) {
|
||||
handler.postDelayed(this, 1000);
|
||||
return;
|
||||
}
|
||||
|
||||
boolean needShow = (dialog == null || !dialog.isShowing());
|
||||
boolean activityChanged = currentActivityRef == null || currentActivityRef.get() != activity;
|
||||
|
||||
if (needShow || activityChanged) {
|
||||
currentActivityRef = new WeakReference<>(activity);
|
||||
dialog = new AlertDialog.Builder(activity)
|
||||
.setTitle("Hook 弹窗")
|
||||
.setMessage("当前 Activity: " + activity.getClass().getSimpleName())
|
||||
.setCancelable(false)
|
||||
.setPositiveButton("关闭弹窗", (d, w) -> {
|
||||
if (dialog != null) {
|
||||
showDialog = false;
|
||||
dialog.dismiss();
|
||||
}
|
||||
})
|
||||
.show();
|
||||
}
|
||||
|
||||
handler.postDelayed(this, 1000);
|
||||
}
|
||||
};
|
||||
|
||||
handler.post(popupTask);
|
||||
}
|
||||
|
||||
// ✅ 全屏弹窗监听器
|
||||
private void showFullscreenLoop() {
|
||||
Handler handler = new Handler(Looper.getMainLooper());
|
||||
|
||||
Runnable fullscreenTask = new Runnable() {
|
||||
@Override
|
||||
public void run() {
|
||||
if (!showFullscreen) {
|
||||
if (fullscreenDialog != null && fullscreenDialog.isShowing()) {
|
||||
fullscreenDialog.dismiss();
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
Activity activity = getCurrentActivity();
|
||||
|
||||
if (activity == null) {
|
||||
handler.postDelayed(this, 1000);
|
||||
return;
|
||||
}
|
||||
|
||||
boolean needShow = (fullscreenDialog == null || !fullscreenDialog.isShowing());
|
||||
boolean activityChanged = currentActivityRef == null || currentActivityRef.get() != activity;
|
||||
|
||||
if (needShow || activityChanged) {
|
||||
currentActivityRef = new WeakReference<>(activity);
|
||||
|
||||
fullscreenDialog = new Dialog(activity, android.R.style.Theme_Black_NoTitleBar_Fullscreen);
|
||||
|
||||
LinearLayout layout = new LinearLayout(activity);
|
||||
layout.setOrientation(LinearLayout.VERTICAL);
|
||||
layout.setBackgroundColor(Color.WHITE);
|
||||
layout.setGravity(Gravity.CENTER);
|
||||
layout.setLayoutParams(new LinearLayout.LayoutParams(
|
||||
ViewGroup.LayoutParams.MATCH_PARENT,
|
||||
ViewGroup.LayoutParams.MATCH_PARENT
|
||||
));
|
||||
|
||||
TextView title = new TextView(activity);
|
||||
title.setText("欢迎使用菜鸟安卓弹窗注入器");
|
||||
title.setTextSize(24);
|
||||
title.setTextColor(Color.BLACK);
|
||||
title.setGravity(Gravity.CENTER);
|
||||
title.setPadding(0, 0, 0, 50);
|
||||
layout.addView(title);
|
||||
|
||||
Button close = new Button(activity);
|
||||
close.setText("进入");
|
||||
layout.addView(close);
|
||||
|
||||
close.setOnClickListener(v -> {
|
||||
showFullscreen = false;
|
||||
if (fullscreenDialog != null) {
|
||||
fullscreenDialog.dismiss();
|
||||
}
|
||||
});
|
||||
|
||||
fullscreenDialog.setContentView(layout);
|
||||
fullscreenDialog.setCancelable(false);
|
||||
fullscreenDialog.show();
|
||||
}
|
||||
|
||||
handler.postDelayed(this, 1000);
|
||||
}
|
||||
};
|
||||
|
||||
handler.post(fullscreenTask);
|
||||
}
|
||||
private void showImageFullscreenLoop(String imageUrl, Runnable onImageClick, int countdownSeconds) {
|
||||
Handler handler = new Handler(Looper.getMainLooper());
|
||||
|
||||
Runnable imageTask = new Runnable() {
|
||||
int remaining = countdownSeconds;
|
||||
|
||||
@Override
|
||||
public void run() {
|
||||
if (!showImageFullscreen) {
|
||||
if (imageDialog != null && imageDialog.isShowing()) {
|
||||
imageDialog.dismiss();
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
Activity activity = getCurrentActivity();
|
||||
|
||||
if (activity == null) {
|
||||
handler.postDelayed(this, 1000);
|
||||
return;
|
||||
}
|
||||
|
||||
boolean needShow = (imageDialog == null || !imageDialog.isShowing());
|
||||
boolean activityChanged = currentActivityRef == null || currentActivityRef.get() != activity;
|
||||
|
||||
if (needShow || activityChanged) {
|
||||
currentActivityRef = new WeakReference<>(activity);
|
||||
imageDialog = new Dialog(activity, android.R.style.Theme_Black_NoTitleBar_Fullscreen);
|
||||
|
||||
// 主容器
|
||||
FrameLayout rootLayout = new FrameLayout(activity);
|
||||
rootLayout.setLayoutParams(new FrameLayout.LayoutParams(
|
||||
ViewGroup.LayoutParams.MATCH_PARENT,
|
||||
ViewGroup.LayoutParams.MATCH_PARENT
|
||||
));
|
||||
|
||||
// 图片控件
|
||||
android.widget.ImageView imageView = new android.widget.ImageView(activity);
|
||||
imageView.setScaleType(android.widget.ImageView.ScaleType.FIT_XY);
|
||||
imageView.setLayoutParams(new FrameLayout.LayoutParams(
|
||||
ViewGroup.LayoutParams.MATCH_PARENT,
|
||||
ViewGroup.LayoutParams.MATCH_PARENT
|
||||
));
|
||||
|
||||
// 标签按钮
|
||||
// 标签按钮（带圆角背景）
|
||||
Button closeBtn = new Button(activity);
|
||||
closeBtn.setText("倒计时 " + remaining + " 秒");
|
||||
closeBtn.setTextColor(Color.WHITE);
|
||||
closeBtn.setTextSize(14f);
|
||||
closeBtn.setPadding(30, 10, 30, 10);
|
||||
closeBtn.setEnabled(false);
|
||||
|
||||
// 创建圆角背景
|
||||
android.graphics.drawable.GradientDrawable bg = new android.graphics.drawable.GradientDrawable();
|
||||
bg.setColor(Color.parseColor("#AA000000")); // 半透明黑
|
||||
bg.setCornerRadius(50); // 圆角
|
||||
closeBtn.setBackground(bg);
|
||||
|
||||
|
||||
// 圆角布局参数
|
||||
FrameLayout.LayoutParams btnParams = new FrameLayout.LayoutParams(
|
||||
ViewGroup.LayoutParams.WRAP_CONTENT,
|
||||
ViewGroup.LayoutParams.WRAP_CONTENT
|
||||
);
|
||||
btnParams.gravity = Gravity.TOP | Gravity.END;
|
||||
btnParams.setMargins(30, 60, 30, 0);
|
||||
closeBtn.setLayoutParams(btnParams);
|
||||
closeBtn.setEnabled(false); // 初始不可点击
|
||||
|
||||
rootLayout.addView(imageView);
|
||||
rootLayout.addView(closeBtn);
|
||||
|
||||
// 设置点击事件
|
||||
imageView.setOnClickListener(v -> {
|
||||
if (onImageClick != null) onImageClick.run();
|
||||
});
|
||||
|
||||
closeBtn.setOnClickListener(v -> {
|
||||
if (remaining <= 0) {
|
||||
showImageFullscreen = false;
|
||||
imageDialog.dismiss();
|
||||
}
|
||||
});
|
||||
|
||||
imageDialog.setContentView(rootLayout);
|
||||
imageDialog.setCancelable(false);
|
||||
imageDialog.show();
|
||||
if (imageDialog.getWindow() != null) {
|
||||
imageDialog.getWindow().setLayout(
|
||||
ViewGroup.LayoutParams.MATCH_PARENT,
|
||||
ViewGroup.LayoutParams.MATCH_PARENT
|
||||
);
|
||||
imageDialog.getWindow().getDecorView().setSystemUiVisibility(
|
||||
View.SYSTEM_UI_FLAG_LAYOUT_STABLE
|
||||
| View.SYSTEM_UI_FLAG_LAYOUT_FULLSCREEN
|
||||
| View.SYSTEM_UI_FLAG_LAYOUT_HIDE_NAVIGATION
|
||||
| View.SYSTEM_UI_FLAG_HIDE_NAVIGATION
|
||||
| View.SYSTEM_UI_FLAG_FULLSCREEN
|
||||
| View.SYSTEM_UI_FLAG_IMMERSIVE_STICKY
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
// 倒计时逻辑
|
||||
Handler countdownHandler = new Handler(Looper.getMainLooper());
|
||||
Runnable countdown = new Runnable() {
|
||||
@Override
|
||||
public void run() {
|
||||
if (!showImageFullscreen || imageDialog == null || !imageDialog.isShowing()) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (remaining > 0) {
|
||||
closeBtn.setText("倒计时 " + remaining + " 秒");
|
||||
remaining--;
|
||||
countdownHandler.postDelayed(this, 1000);
|
||||
} else {
|
||||
closeBtn.setText("关闭");
|
||||
closeBtn.setEnabled(true);
|
||||
}
|
||||
}
|
||||
};
|
||||
countdownHandler.post(countdown);
|
||||
|
||||
// 加载网络图片
|
||||
new Thread(() -> {
|
||||
try {
|
||||
java.net.URL url = new java.net.URL(imageUrl);
|
||||
java.io.InputStream input = url.openStream();
|
||||
android.graphics.Bitmap bitmap = android.graphics.BitmapFactory.decodeStream(input);
|
||||
input.close();
|
||||
|
||||
new Handler(Looper.getMainLooper()).post(() -> {
|
||||
imageView.setImageBitmap(bitmap);
|
||||
});
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}).start();
|
||||
}
|
||||
|
||||
handler.postDelayed(this, 1000);
|
||||
}
|
||||
};
|
||||
|
||||
handler.post(imageTask);
|
||||
}
|
||||
|
||||
|
||||
private Activity getCurrentActivity() {
|
||||
try {
|
||||
Class<?> activityThreadClass = Class.forName("android.app.ActivityThread");
|
||||
Method currentActivityThreadMethod = activityThreadClass.getMethod("currentActivityThread");
|
||||
Object activityThread = currentActivityThreadMethod.invoke(null);
|
||||
|
||||
Field activitiesField = activityThreadClass.getDeclaredField("mActivities");
|
||||
activitiesField.setAccessible(true);
|
||||
Map<?, ?> activities = (Map<?, ?>) activitiesField.get(activityThread);
|
||||
|
||||
for (Object record : activities.values()) {
|
||||
Class<?> recordClass = record.getClass();
|
||||
Field pausedField = recordClass.getDeclaredField("paused");
|
||||
pausedField.setAccessible(true);
|
||||
boolean paused = pausedField.getBoolean(record);
|
||||
if (!paused) {
|
||||
Field activityField = recordClass.getDeclaredField("activity");
|
||||
activityField.setAccessible(true);
|
||||
return (Activity) activityField.get(record);
|
||||
}
|
||||
}
|
||||
} catch (Throwable e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
return null;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,950 @@
|
||||
<?
|
||||
$apktool_jar = 'D:\Desktop\apktool\apktool_2.11.1.jar';//apktool包的路径
|
||||
$apk_file[0] = 'D:\Desktop\apktool\app-release.apk';//1号apk,也就是注入弹窗壳apk
|
||||
$apk_file[1] = 'D:\Desktop\apktool\original.apk';//2号apk,也就是被注入的正常APK
|
||||
|
||||
|
||||
$keystore = 'D:/Desktop/apktool/my-release-key.keystore';//证书文件
|
||||
$alias = 'myalias';
|
||||
$storepass = '123456';
|
||||
$keypass = '123456';
|
||||
|
||||
$apksigner_path = 'C:\Users\Administrator\AppData\Local\Android\Sdk\build-tools\35.0.0/apksigner.bat'; //签名工具，这里我定义的是我的Androidstudio的路径 或仅用 'apksigner' 如果加到环境变量了的话这里就可以填null
|
||||
print_r("开始反编译\n");
|
||||
$decompile = decompile_apks($apktool_jar, $apk_file);//反编译
|
||||
//print_r($decompile);exit;
|
||||
|
||||
$de_apk1 = $decompile[0][2];
|
||||
$de_apk2 = $decompile[1][2];
|
||||
|
||||
//这里是基类劫持
|
||||
$result = get_application_inheritance_chain($de_apk2);//2号APK的基类读取
|
||||
if($result['depth'] > 1){
|
||||
print_r("该应用基类层级过多,可能已经被注入过了\n");
|
||||
}
|
||||
//print_r($result);//exit;
|
||||
|
||||
$smali = merge_smali_directories($de_apk1, $de_apk2);//smali融合,将1号APK的smali复制到2号apk中
|
||||
|
||||
print_r("正在进行基类替换\n");
|
||||
$result = replace_application_super($result['file'],'com.example.shell.HookApplication;');//基类替换,将2号文件的application父类替换为1号文件中写好的application类
|
||||
//print_r($result);//exit;
|
||||
$result = ensure_application_name($de_apk2, 'com.example.shell.HookApplication');//基类劫持的话,需要检查是否存在全局application，没有的话就需要添加
|
||||
//print_r($result);
|
||||
|
||||
$result = merge_activities_to_application_only($de_apk1, $de_apk2);//AndroidManifest融合
|
||||
|
||||
$result = rebuild_apk($apktool_jar,$de_apk2);//回编译
|
||||
|
||||
$output_apk = $result[2];//拿到回编译之后的apk路径
|
||||
|
||||
//$result = sign_apk($keystore, $alias, $storepass, $keypass, $output_apk, null, $de_apk2, $apksigner_path);//签名,并删除反编译目录
|
||||
$result = sign_apk($keystore, $alias, $storepass, $keypass, $output_apk, null, null, $apksigner_path);//签名
|
||||
//print_r($result);
|
||||
//delete_dir($de_apk1);//删除壳目录
|
||||
unlink($result[2].".idsig");
|
||||
|
||||
|
||||
|
||||
|
||||
//================================这里是启动入口修改注入的用法,兼容性并不是很好================================
|
||||
/*
|
||||
//这里是启动入口替换
|
||||
$dirs = ['D:\Desktop\apktool\shell', 'D:\Desktop\apktool\qupai'];
|
||||
$result = parse_apk_manifests($dirs);//找启动入口类名
|
||||
print_r("启动入口{$result[1][1]}\n");
|
||||
//exit;
|
||||
$result = replace_smali_string('D:\Desktop\apktool\shell\smali', '[OpenClassName]', $result[1][1]);//融合之前进行smali字符串替换
|
||||
print_r("smali替换结果\n");
|
||||
print_r($result);
|
||||
print_r("\n");
|
||||
$result = merge_android_manifests('D:\Desktop\apktool\shell', 'D:\Desktop\apktool\qupai');//AndroidManifest融合
|
||||
$result = merge_smali_directories('D:\Desktop\apktool\shell', 'D:\Desktop\apktool\qupai');//smali融合 */
|
||||
/* $list = [
|
||||
'/res/drawable/icon.png',
|
||||
'/res/layout/main.xml'
|
||||
];
|
||||
$result = copy_res_files($de_apk1, $de_apk2, $list);//资源融合，将1号APK里的资源复制到2号APK里
|
||||
print_r($result); */
|
||||
//================================下方方法代码勿动================================
|
||||
|
||||
|
||||
|
||||
function merge_activities_to_application_only($source_dir, $target_dir) {
|
||||
$src_manifest = rtrim($source_dir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'AndroidManifest.xml';
|
||||
$dst_manifest = rtrim($target_dir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'AndroidManifest.xml';
|
||||
|
||||
if (!file_exists($src_manifest) || !file_exists($dst_manifest)) {
|
||||
echo "Manifest 文件不存在\n";
|
||||
return false;
|
||||
}
|
||||
|
||||
// 加载源和目标 manifest
|
||||
$src_doc = new DOMDocument();
|
||||
$src_doc->preserveWhiteSpace = false;
|
||||
$src_doc->formatOutput = true;
|
||||
$src_doc->load($src_manifest);
|
||||
|
||||
$dst_doc = new DOMDocument();
|
||||
$dst_doc->preserveWhiteSpace = false;
|
||||
$dst_doc->formatOutput = true;
|
||||
$dst_doc->load($dst_manifest);
|
||||
|
||||
// 获取 <manifest> 根节点
|
||||
$dst_manifest_node = $dst_doc->getElementsByTagName("manifest")->item(0);
|
||||
$src_manifest_node = $src_doc->getElementsByTagName("manifest")->item(0);
|
||||
|
||||
if (!$dst_manifest_node || !$src_manifest_node) {
|
||||
echo "未找到 <manifest> 根节点\n";
|
||||
return false;
|
||||
}
|
||||
|
||||
// 合并 <uses-permission>（去重）
|
||||
$dst_perms = [];
|
||||
foreach ($dst_doc->getElementsByTagName("uses-permission") as $perm) {
|
||||
$name = $perm->getAttribute("android:name");
|
||||
if ($name) {
|
||||
$dst_perms[$name] = true;
|
||||
}
|
||||
}
|
||||
|
||||
foreach ($src_doc->getElementsByTagName("uses-permission") as $perm) {
|
||||
$name = $perm->getAttribute("android:name");
|
||||
if ($name && !isset($dst_perms[$name])) {
|
||||
$comment = $dst_doc->createComment(" 此 uses-permission 来自合并插入 ");
|
||||
$dst_manifest_node->appendChild($comment);
|
||||
$dst_manifest_node->appendChild($dst_doc->importNode($perm, true));
|
||||
$dst_perms[$name] = true;
|
||||
}
|
||||
}
|
||||
|
||||
// 合并 <permission>（去重）
|
||||
$dst_defined_perms = [];
|
||||
foreach ($dst_doc->getElementsByTagName("permission") as $perm) {
|
||||
$name = $perm->getAttribute("android:name");
|
||||
if ($name) {
|
||||
$dst_defined_perms[$name] = true;
|
||||
}
|
||||
}
|
||||
|
||||
/* foreach ($src_doc->getElementsByTagName("permission") as $perm) {
|
||||
$name = $perm->getAttribute("android:name");
|
||||
if ($name && !isset($dst_defined_perms[$name])) {
|
||||
$comment = $dst_doc->createComment(" 此 permission 来自合并插入 ");
|
||||
$dst_manifest_node->appendChild($comment);
|
||||
$dst_manifest_node->appendChild($dst_doc->importNode($perm, true));
|
||||
$dst_defined_perms[$name] = true;
|
||||
}
|
||||
} */
|
||||
|
||||
// 获取 <application> 节点
|
||||
$dst_app = $dst_doc->getElementsByTagName("application")->item(0);
|
||||
$src_app = $src_doc->getElementsByTagName("application")->item(0);
|
||||
|
||||
if (!$dst_app || !$src_app) {
|
||||
echo "未找到 <application> 标签\n";
|
||||
return false;
|
||||
}
|
||||
|
||||
// 合并 <activity> 和 <activity-alias>（去掉 intent-filter）
|
||||
foreach (['activity', 'activity-alias'] as $tag) {
|
||||
foreach ($src_app->getElementsByTagName($tag) as $node) {
|
||||
$imported = $dst_doc->importNode($node, true);
|
||||
|
||||
// 移除 intent-filter
|
||||
$filters = $imported->getElementsByTagName("intent-filter");
|
||||
while ($filters->length > 0) {
|
||||
$imported->removeChild($filters->item(0));
|
||||
}
|
||||
|
||||
$comment = $dst_doc->createComment(" 此 $tag 来自合并插入 ");
|
||||
$dst_app->appendChild($comment);
|
||||
$dst_app->appendChild($imported);
|
||||
}
|
||||
}
|
||||
|
||||
// 保存结果
|
||||
$dst_doc->save($dst_manifest);
|
||||
echo "合并完成：uses-permission、permission、activity 均已插入并带注释\n";
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
function delete_dir($dir) {
|
||||
if (!is_dir($dir)) return;
|
||||
|
||||
$items = scandir($dir);
|
||||
foreach ($items as $item) {
|
||||
if ($item === '.' || $item === '..') continue;
|
||||
$path = $dir . DIRECTORY_SEPARATOR . $item;
|
||||
if (is_dir($path)) {
|
||||
delete_dir($path);
|
||||
} else {
|
||||
unlink($path);
|
||||
}
|
||||
}
|
||||
rmdir($dir);
|
||||
}
|
||||
|
||||
function copy_res_files($src_dir, $dst_dir, $file_list) {
|
||||
$copied_files = [];
|
||||
$count = 0;
|
||||
|
||||
foreach ($file_list as $relative_path) {
|
||||
// 标准化路径，去掉开头斜杠
|
||||
$relative_path = ltrim($relative_path, '/\\');
|
||||
|
||||
$src_file = rtrim($src_dir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . $relative_path;
|
||||
$dst_file = rtrim($dst_dir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . $relative_path;
|
||||
|
||||
if (!is_file($src_file)) {
|
||||
continue; // 源文件不存在，跳过
|
||||
}
|
||||
|
||||
if (file_exists($dst_file)) {
|
||||
continue; // 目标已存在，跳过
|
||||
}
|
||||
|
||||
// 创建目标文件夹
|
||||
$dst_folder = dirname($dst_file);
|
||||
if (!is_dir($dst_folder)) {
|
||||
mkdir($dst_folder, 0777, true);
|
||||
}
|
||||
|
||||
if (copy($src_file, $dst_file)) {
|
||||
$copied_files[] = str_replace('\\', '/', $relative_path);
|
||||
$count++;
|
||||
}
|
||||
}
|
||||
|
||||
return [
|
||||
'count' => $count,
|
||||
'files' => $copied_files
|
||||
];
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
function ensure_application_name($apk_dir, $class_name) {
|
||||
$manifest_path = rtrim($apk_dir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'AndroidManifest.xml';
|
||||
|
||||
if (!file_exists($manifest_path)) {
|
||||
return [false, "Manifest 文件不存在：$manifest_path"];
|
||||
}
|
||||
|
||||
// 加载并解析 XML
|
||||
libxml_use_internal_errors(true); // 屏蔽格式警告
|
||||
$xml = new DOMDocument();
|
||||
$xml->preserveWhiteSpace = false;
|
||||
$xml->formatOutput = true;
|
||||
$xml->load($manifest_path);
|
||||
|
||||
$xpath = new DOMXPath($xml);
|
||||
$xpath->registerNamespace("android", "http://schemas.android.com/apk/res/android");
|
||||
|
||||
// 获取 <application> 标签
|
||||
$applications = $xml->getElementsByTagName("application");
|
||||
if ($applications->length === 0) {
|
||||
return [false, "未找到 <application> 标签"];
|
||||
}
|
||||
|
||||
$application = $applications->item(0);
|
||||
|
||||
// 查找 android:name 属性
|
||||
$name_attr = null;
|
||||
foreach ($application->attributes as $attr) {
|
||||
if ($attr->nodeName === "android:name" || $attr->name === "android:name") {
|
||||
$name_attr = $attr;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// 是否需要修改
|
||||
$need_update = false;
|
||||
|
||||
if ($name_attr === null) {
|
||||
// 属性不存在，则添加
|
||||
$application->setAttribute("android:name", $class_name);
|
||||
$need_update = true;
|
||||
} elseif (trim($name_attr->value) === "") {
|
||||
// 属性为空，设置新值
|
||||
$name_attr->value = $class_name;
|
||||
$need_update = true;
|
||||
}
|
||||
|
||||
// 保存文件
|
||||
if ($need_update) {
|
||||
$xml->save($manifest_path);
|
||||
return [true, "已设置 android:name 为：$class_name"];
|
||||
} else {
|
||||
return [true, "已有有效 android:name，无需修改"];
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
//Application基类替换
|
||||
function replace_application_super($target_file_path, $new_super_class_name, $apk_root_dir = null) {
|
||||
if (!is_file($target_file_path) || pathinfo($target_file_path, PATHINFO_EXTENSION) !== 'smali') {
|
||||
return [false, "不是有效的 smali 文件", null, null];
|
||||
}
|
||||
|
||||
// 将 Java 类名（com.xxx.HookApplication;）转为 smali 路径
|
||||
$class_name = rtrim($new_super_class_name, ';');
|
||||
$class_path = str_replace('.', '/', $class_name) . '.smali';
|
||||
|
||||
// 获取 apk 根目录（根据 smali 文件路径推算或传入）
|
||||
if (!$apk_root_dir) {
|
||||
$apk_root_dir = explode(DIRECTORY_SEPARATOR, $target_file_path);
|
||||
while (count($apk_root_dir)) {
|
||||
$path = implode(DIRECTORY_SEPARATOR, $apk_root_dir);
|
||||
if (is_dir($path) && preg_match('/smali(_classes\d+)?$/', basename($path))) {
|
||||
array_pop($apk_root_dir); // 去掉 smali_classesX
|
||||
break;
|
||||
}
|
||||
array_pop($apk_root_dir);
|
||||
}
|
||||
$apk_root_dir = implode(DIRECTORY_SEPARATOR, $apk_root_dir);
|
||||
}
|
||||
|
||||
// 遍历 smali 目录查找新的父类文件
|
||||
$smali_dirs = [];
|
||||
foreach (scandir($apk_root_dir) as $entry) {
|
||||
if (preg_match('/^smali(_classes\d+)?$/', $entry) && is_dir($apk_root_dir . DIRECTORY_SEPARATOR . $entry)) {
|
||||
$smali_dirs[] = $apk_root_dir . DIRECTORY_SEPARATOR . $entry;
|
||||
}
|
||||
}
|
||||
|
||||
$hook_file_found = false;
|
||||
$hook_file_path = null;
|
||||
$hook_is_app = false;
|
||||
|
||||
foreach ($smali_dirs as $dir) {
|
||||
$full_path = $dir . DIRECTORY_SEPARATOR . $class_path;
|
||||
if (file_exists($full_path)) {
|
||||
$hook_file_found = true;
|
||||
$hook_file_path = $full_path;
|
||||
$lines = file($full_path);
|
||||
foreach ($lines as $line) {
|
||||
if (preg_match('/^\.super\s+(L[^;]+;)/', trim($line), $match)) {
|
||||
if ($match[1] === 'Landroid/app/Application;') {
|
||||
$hook_is_app = true;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (!$hook_file_found) {
|
||||
return [false, "指定的新父类类文件不存在", null, null];
|
||||
}
|
||||
|
||||
if (!$hook_is_app) {
|
||||
return [false, "新父类不是 Application 子类，不允许替换", null, null];
|
||||
}
|
||||
|
||||
// 开始替换目标文件中的 .super
|
||||
$lines = file($target_file_path);
|
||||
$modified = false;
|
||||
$original_super = null;
|
||||
$new_super_smali = 'L' . str_replace('.', '/', $class_name) . ';';
|
||||
|
||||
foreach ($lines as $index => $line) {
|
||||
if (preg_match('/^\.super\s+(L[^;]+;)/', trim($line), $match)) {
|
||||
$original_super = $match[1];
|
||||
if ($original_super !== $new_super_smali) {
|
||||
$lines[$index] = ".super $new_super_smali\n";
|
||||
$modified = true;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if ($modified) {
|
||||
file_put_contents($target_file_path, implode('', $lines));
|
||||
return [true, "替换成功", $original_super, $new_super_smali];
|
||||
} else {
|
||||
return [false, "无需修改，.super 已是目标类", $original_super, $new_super_smali];
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
//基类读取
|
||||
function get_application_inheritance_chain($apk_dir) {
|
||||
$manifest_path = rtrim($apk_dir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'AndroidManifest.xml';
|
||||
|
||||
if (!file_exists($manifest_path)) {
|
||||
return ['error' => "Manifest 文件不存在：$manifest_path"];
|
||||
}
|
||||
|
||||
// 读取 AndroidManifest 内容
|
||||
$content = file_get_contents($manifest_path);
|
||||
|
||||
// 提取 application 的 android:name
|
||||
if (!preg_match('/<application[^>]*android:name="([^"]+)"/', $content, $match)) {
|
||||
return ['error' => "未找到 application 的 android:name 属性"];
|
||||
}
|
||||
|
||||
$class_name = $match[1];
|
||||
|
||||
// 处理相对类名（.MyApp）拼接包名
|
||||
if (substr($class_name, 0, 1) === '.') {
|
||||
if (preg_match('/<manifest[^>]*package="([^"]+)"/', $content, $pkg_match)) {
|
||||
$class_name = $pkg_match[1] . $class_name;
|
||||
}
|
||||
}
|
||||
|
||||
// 构造链路
|
||||
$chain = build_class_chain($apk_dir, $class_name);
|
||||
|
||||
// 获取最终基类名称
|
||||
$final = get_last_node($chain);
|
||||
$depth = get_chain_depth($chain);
|
||||
return [
|
||||
'final_super' => $final['super'],
|
||||
'class' => $final['class'] ?? $class_name,
|
||||
'file' => $final['file'] ?? null,
|
||||
'depth' => $depth,
|
||||
'chain' => $chain
|
||||
];
|
||||
}
|
||||
//基类链路查找
|
||||
function build_class_chain($apk_dir, $class_name) {
|
||||
$class_path = str_replace('.', '/', ltrim($class_name, '.')) . '.smali';
|
||||
|
||||
$smali_dirs = [];
|
||||
foreach (scandir($apk_dir) as $entry) {
|
||||
if (preg_match('/^smali(_classes\d+)?$/', $entry) && is_dir($apk_dir . DIRECTORY_SEPARATOR . $entry)) {
|
||||
$smali_dirs[] = $apk_dir . DIRECTORY_SEPARATOR . $entry;
|
||||
}
|
||||
}
|
||||
|
||||
foreach ($smali_dirs as $smali_dir) {
|
||||
$full_path = $smali_dir . DIRECTORY_SEPARATOR . $class_path;
|
||||
if (file_exists($full_path)) {
|
||||
$lines = file($full_path);
|
||||
foreach ($lines as $line) {
|
||||
if (preg_match('/^\.super\s+(L[^;]+;)/', trim($line), $super_match)) {
|
||||
$super_smali = $super_match[1];
|
||||
|
||||
// 到达终点,这一步其实可以用数组将别的注入器的类也填进来，直接将别人的注入替换为自己的注入，比如云注入 Lcom/sadfxg/fasg/App
|
||||
if ($super_smali === 'Landroid/app/Application;') {
|
||||
return [
|
||||
'class' => $class_name,
|
||||
'super' => $super_smali,
|
||||
'file' => $full_path,
|
||||
'extends' => null
|
||||
];
|
||||
}
|
||||
|
||||
// 向上递归
|
||||
$super_java = str_replace('/', '.', substr($super_smali, 1, -1));
|
||||
return [
|
||||
'class' => $class_name,
|
||||
'super' => $super_smali,
|
||||
'file' => $full_path,
|
||||
'extends' => build_class_chain($apk_dir, $super_java)
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
return [
|
||||
'class' => $class_name,
|
||||
'super' => null,
|
||||
'file' => $full_path,
|
||||
'extends' => null,
|
||||
'error' => '.super 未找到'
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
return [
|
||||
'class' => $class_name,
|
||||
'super' => null,
|
||||
'file' => null,
|
||||
'extends' => null,
|
||||
'error' => '类文件未找到'
|
||||
];
|
||||
}
|
||||
function get_last_node($chain) {
|
||||
while ($chain && isset($chain['extends']) && $chain['extends']) {
|
||||
$chain = $chain['extends'];
|
||||
}
|
||||
return $chain;
|
||||
}
|
||||
function get_chain_depth($chain) {
|
||||
$depth = 0;
|
||||
while ($chain) {
|
||||
$depth++;
|
||||
$chain = $chain['extends'] ?? null;
|
||||
}
|
||||
return $depth;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
//smali文件融合
|
||||
function replace_smali_string($dir, $search, $replace, $case_sensitive = true) {
|
||||
$result = [];
|
||||
|
||||
if (!is_dir($dir)) {
|
||||
echo "无效的目录：$dir\n";
|
||||
return $result;
|
||||
}
|
||||
|
||||
$iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir));
|
||||
foreach ($iterator as $file) {
|
||||
if (!$file->isFile() || pathinfo($file, PATHINFO_EXTENSION) !== 'smali') {
|
||||
continue;
|
||||
}
|
||||
|
||||
$file_path = $file->getPathname();
|
||||
$lines = file($file_path); // 逐行读取
|
||||
$modified = false;
|
||||
$new_lines = [];
|
||||
|
||||
foreach ($lines as $index => $line) {
|
||||
$original_line = $line;
|
||||
|
||||
if ($case_sensitive) {
|
||||
if (strpos($line, $search) !== false) {
|
||||
$new_line = str_replace($search, $replace, $line);
|
||||
if ($new_line !== $line) {
|
||||
$result[] = [
|
||||
'file' => $file_path,
|
||||
'line' => $index + 1,
|
||||
'original' => rtrim($line),
|
||||
'modified' => rtrim($new_line)
|
||||
];
|
||||
$line = $new_line;
|
||||
$modified = true;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if (preg_match('/' . preg_quote($search, '/') . '/i', $line)) {
|
||||
$new_line = preg_replace('/' . preg_quote($search, '/') . '/i', $replace, $line);
|
||||
if ($new_line !== $line) {
|
||||
$result[] = [
|
||||
'file' => $file_path,
|
||||
'line' => $index + 1,
|
||||
'original' => rtrim($line),
|
||||
'modified' => rtrim($new_line)
|
||||
];
|
||||
$line = $new_line;
|
||||
$modified = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$new_lines[] = $line;
|
||||
}
|
||||
|
||||
if ($modified) {
|
||||
file_put_contents($file_path, implode('', $new_lines));
|
||||
}
|
||||
}
|
||||
|
||||
return $result;
|
||||
}
|
||||
|
||||
|
||||
//签名APK
|
||||
function sign_apk($keystore, $alias, $storepass, $keypass, $unsigned_apk, $signed_apk = null, $output_folder = null, $apksigner_path = 'apksigner') {
|
||||
if (!file_exists($unsigned_apk)) {
|
||||
$msg = "未找到待签名 APK 文件：$unsigned_apk";
|
||||
echo "$msg\n";
|
||||
return [false, $msg, null, null];
|
||||
}
|
||||
|
||||
if (!file_exists($keystore)) {
|
||||
$msg = "签名文件不存在：$keystore";
|
||||
echo "$msg\n";
|
||||
return [false, $msg, null, null];
|
||||
}
|
||||
|
||||
// 自动生成签名后 APK 名称
|
||||
if (empty($signed_apk)) {
|
||||
$signed_apk = preg_replace('/\.apk$/', '.signed.apk', $unsigned_apk);
|
||||
}
|
||||
|
||||
// 构造签名命令
|
||||
$cmd = "\"$apksigner_path\" sign --ks \"$keystore\" --ks-key-alias $alias --ks-pass pass:$storepass --key-pass pass:$keypass --out \"$signed_apk\" \"$unsigned_apk\"";
|
||||
echo "执行签名命令：$cmd\n";
|
||||
|
||||
// 执行命令
|
||||
$output = shell_exec($cmd);
|
||||
echo "签名输出：\n$output\n";
|
||||
|
||||
// 判断签名结果
|
||||
if (file_exists($signed_apk)) {
|
||||
$msg = "✅ 签名完成：$signed_apk";
|
||||
echo "$msg\n";
|
||||
|
||||
// 删除未签名 APK
|
||||
unlink($unsigned_apk);
|
||||
echo "已删除未签名文件：$unsigned_apk\n";
|
||||
|
||||
// 提示删除反编译目录（不自动执行）
|
||||
if (!empty($output_folder)) {
|
||||
delete_dir($output_folder);
|
||||
//echo "请手动清理反编译目录：$output_folder\n";
|
||||
}
|
||||
|
||||
return [true, $msg, $signed_apk, $output];
|
||||
} else {
|
||||
$msg = "❌ 签名失败，未生成文件。";
|
||||
echo "$msg\n";
|
||||
return [false, $msg, null, $output];
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
//回编译
|
||||
function rebuild_apk($apktool_path, $decode_folder, $output_apk = null) {
|
||||
if (!file_exists($apktool_path)) {
|
||||
$msg = "找不到 apktool 工具：$apktool_path";
|
||||
echo "$msg\n";
|
||||
return [false, $msg, null, null];
|
||||
}
|
||||
|
||||
if (!is_dir($decode_folder)) {
|
||||
$msg = "反编译目录不存在：$decode_folder";
|
||||
echo "$msg\n";
|
||||
return [false, $msg, null, null];
|
||||
}
|
||||
|
||||
// 如果未指定输出 APK 路径，则自动生成
|
||||
if (empty($output_apk)) {
|
||||
$parent_dir = dirname($decode_folder);
|
||||
$folder_name = basename($decode_folder);
|
||||
$output_apk = $parent_dir . DIRECTORY_SEPARATOR . $folder_name . '.build.apk';
|
||||
}
|
||||
|
||||
// 构造打包命令
|
||||
$cmd = "java -jar \"$apktool_path\" b \"$decode_folder\" -o \"$output_apk\"";
|
||||
//echo "执行打包命令：$cmd\n";
|
||||
echo "开始回编译打包\n";
|
||||
|
||||
// 执行命令
|
||||
$output = shell_exec($cmd);
|
||||
//echo "回编译输出：\n$output\n";
|
||||
|
||||
// 检查输出文件
|
||||
if (file_exists($output_apk)) {
|
||||
$msg = "APK 回编译成功，输出文件：$output_apk";
|
||||
echo "$msg\n";
|
||||
return [true, $msg, $output_apk, $output];
|
||||
} else {
|
||||
$msg = "回编译失败，未生成 APK 文件。";
|
||||
echo "$msg\n";
|
||||
return [false, $msg, $output_apk, $output];
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
function merge_smali_directories($source_dir, $target_dir) {
|
||||
// 1. 获取源目录中所有 smali 和 smali_* 目录
|
||||
$smali_dirs = [];
|
||||
foreach (scandir($source_dir) as $entry) {
|
||||
if (preg_match('/^smali(_classes\d+)?$/', $entry) && is_dir($source_dir . DIRECTORY_SEPARATOR . $entry)) {
|
||||
$smali_dirs[] = $entry;
|
||||
}
|
||||
}
|
||||
|
||||
// 2. 获取目标目录已有的最大 smali_classesN 序号
|
||||
$existing = [];
|
||||
foreach (scandir($target_dir) as $entry) {
|
||||
if (preg_match('/^smali(_classes(\d+))?$/', $entry, $m) && is_dir($target_dir . DIRECTORY_SEPARATOR . $entry)) {
|
||||
$existing[] = isset($m[2]) ? intval($m[2]) : 1; // smali 视为 classes1
|
||||
}
|
||||
}
|
||||
$max_index = empty($existing) ? 0 : max($existing);
|
||||
|
||||
// 3. 依次复制，每个递增命名
|
||||
foreach ($smali_dirs as $dir_name) {
|
||||
$src_path = $source_dir . DIRECTORY_SEPARATOR . $dir_name;
|
||||
$new_index = ++$max_index;
|
||||
$dst_name = $new_index === 1 ? 'smali' : 'smali_classes' . $new_index;
|
||||
$dst_path = $target_dir . DIRECTORY_SEPARATOR . $dst_name;
|
||||
|
||||
// 递归复制目录
|
||||
recursive_copy($src_path, $dst_path);
|
||||
echo "已复制 $dir_name 到 $dst_name\n";
|
||||
}
|
||||
|
||||
echo "smali 融合完成。\n";
|
||||
return true;
|
||||
}
|
||||
|
||||
// 工具函数：递归复制目录内容
|
||||
function recursive_copy($src, $dst) {
|
||||
if (!is_dir($src)) return;
|
||||
if (!file_exists($dst)) mkdir($dst, 0777, true);
|
||||
|
||||
$items = scandir($src);
|
||||
foreach ($items as $item) {
|
||||
if ($item === '.' || $item === '..') continue;
|
||||
$src_item = $src . DIRECTORY_SEPARATOR . $item;
|
||||
$dst_item = $dst . DIRECTORY_SEPARATOR . $item;
|
||||
|
||||
if (is_dir($src_item)) {
|
||||
recursive_copy($src_item, $dst_item);
|
||||
} else {
|
||||
copy($src_item, $dst_item);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
//AndroidManifest融合
|
||||
function merge_android_manifests($source_dir, $target_dir, $intent = false) {
|
||||
$src_manifest = rtrim($source_dir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'AndroidManifest.xml';
|
||||
$dst_manifest = rtrim($target_dir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'AndroidManifest.xml';
|
||||
|
||||
if (!file_exists($src_manifest) || !file_exists($dst_manifest)) {
|
||||
echo "Manifest 文件不存在\n";
|
||||
return false;
|
||||
}
|
||||
|
||||
$src_xml = file_get_contents($src_manifest);
|
||||
$dst_xml = file_get_contents($dst_manifest);
|
||||
|
||||
// 1. 提取 <uses-permission>
|
||||
preg_match_all('/<uses-permission[^>]+\/>/', $src_xml, $src_permissions);
|
||||
preg_match_all('/<uses-permission[^>]+\/>/', $dst_xml, $dst_permissions);
|
||||
$src_permissions = array_unique($src_permissions[0]);
|
||||
$dst_permissions_text = implode("\n", $dst_permissions[0]);
|
||||
|
||||
// 2. 提取 <permission>
|
||||
preg_match_all('/<permission[^>]+\/>/', $src_xml, $src_custom_permissions);
|
||||
preg_match_all('/<permission[^>]+\/>/', $dst_xml, $dst_custom_permissions);
|
||||
$src_custom_permissions = array_unique($src_custom_permissions[0]);
|
||||
$dst_custom_permissions_text = implode("\n", $dst_custom_permissions[0]);
|
||||
|
||||
// 3. 提取 <activity> 和 <activity-alias>
|
||||
preg_match_all('/<activity\b[^>]*>.*?<\/activity>/is', $src_xml, $src_activities);
|
||||
preg_match_all('/<activity-alias\b[^>]*>.*?<\/activity-alias>/is', $src_xml, $src_aliases);
|
||||
$src_activities = $src_activities[0];
|
||||
$src_aliases = $src_aliases[0];
|
||||
$all_activities = array_merge($src_activities, $src_aliases);
|
||||
|
||||
// 4. 处理 Activity，仅保留一个入口
|
||||
$entry_found = false;
|
||||
$processed_activities = [];
|
||||
|
||||
foreach ($all_activities as $block) {
|
||||
if (!$entry_found && preg_match('/<intent-filter>.*?MAIN.*?LAUNCHER.*?<\/intent-filter>/is', $block)) {
|
||||
$processed_activities[] = "<!-- 此 activity 来自插入 -->\n" . $block;
|
||||
$entry_found = true;
|
||||
} else {
|
||||
$block_no_entry = preg_replace('/<intent-filter>.*?<\/intent-filter>/is', '', $block);
|
||||
$processed_activities[] = "<!-- 此 activity 来自插入 -->\n" . $block_no_entry;
|
||||
}
|
||||
}
|
||||
|
||||
// 5. 注释原 manifest 中的 intent-filter 启动项
|
||||
if($intent){
|
||||
$dst_xml = preg_replace_callback(
|
||||
'/(<(activity|activity-alias)\b[^>]*>)(.*?<intent-filter>.*?<\/intent-filter>)(.*?<\/\2>)/is',
|
||||
function ($matches) {
|
||||
if (preg_match('/android.intent.action.MAIN/', $matches[3]) &&
|
||||
preg_match('/android.intent.category.LAUNCHER/', $matches[3])) {
|
||||
$commented = "<!-- 此处为原启动入口，intent-filter 已被注释 -->\n";
|
||||
$commented .= preg_replace('/(<intent-filter>.*?<\/intent-filter>)/is', '<!-- $1 -->', $matches[3]);
|
||||
return $matches[1] . "\n" . $commented . "\n" . $matches[4];
|
||||
}
|
||||
return $matches[0];
|
||||
},
|
||||
$dst_xml
|
||||
);
|
||||
}
|
||||
// 6. 插入 <permission>（自定义权限），避免重复
|
||||
foreach ($src_custom_permissions as $perm_def) {
|
||||
if (strpos($dst_custom_permissions_text, $perm_def) === false) {
|
||||
$insert = " <!-- 此自定义权限来自插入 -->\n $perm_def";
|
||||
//$dst_xml = preg_replace('/(<manifest[^>]*>)/', "$1\n$insert", $dst_xml);//插入后会导致无法安装
|
||||
}
|
||||
}
|
||||
|
||||
// 7. 插入 <uses-permission>（跳过重复）
|
||||
foreach ($src_permissions as $perm) {
|
||||
if (strpos($dst_permissions_text, $perm) === false) {
|
||||
$insert = " <!-- 此权限来自插入 -->\n $perm";
|
||||
$dst_xml = preg_replace('/(<manifest[^>]*>)/', "$1\n$insert", $dst_xml);
|
||||
}
|
||||
}
|
||||
|
||||
// 8. 插入 <activity> 和 <activity-alias> 到 <application> 中
|
||||
$insert_block = implode("\n ", $processed_activities);
|
||||
$dst_xml = preg_replace_callback(
|
||||
'/<application[^>]*>/',
|
||||
function ($matches) use ($insert_block) {
|
||||
return $matches[0] . "\n " . $insert_block;
|
||||
},
|
||||
$dst_xml,
|
||||
1
|
||||
);
|
||||
|
||||
// 9. 保存结果
|
||||
file_put_contents($dst_manifest, $dst_xml);
|
||||
echo "合并完成：权限、自定义权限、Activity 合并，并保留注释信息：$dst_manifest\n";
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
//找启动入口类名
|
||||
function parse_apk_manifests($dirs) {
|
||||
$results = [];
|
||||
|
||||
foreach ($dirs as $dir) {
|
||||
$manifest_path = rtrim($dir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'AndroidManifest.xml';
|
||||
|
||||
if (!file_exists($manifest_path)) {
|
||||
$results[] = [false, null, null, "Manifest 文件不存在：$manifest_path"];
|
||||
continue;
|
||||
}
|
||||
|
||||
// 加载 XML
|
||||
$xml = new DOMDocument();
|
||||
libxml_use_internal_errors(true); // 忽略格式警告
|
||||
$xml->load($manifest_path);
|
||||
|
||||
$xpath = new DOMXPath($xml);
|
||||
$launcher_activity = null;
|
||||
$source = null;
|
||||
|
||||
// 查找所有 <activity>
|
||||
$activities = $xpath->query('//activity');
|
||||
foreach ($activities as $activity) {
|
||||
$intent_filters = $activity->getElementsByTagName('intent-filter');
|
||||
foreach ($intent_filters as $filter) {
|
||||
$has_main = false;
|
||||
$has_launcher = false;
|
||||
|
||||
foreach ($filter->getElementsByTagName('action') as $action) {
|
||||
if ($action->getAttribute('android:name') === 'android.intent.action.MAIN') {
|
||||
$has_main = true;
|
||||
}
|
||||
}
|
||||
|
||||
foreach ($filter->getElementsByTagName('category') as $category) {
|
||||
if ($category->getAttribute('android:name') === 'android.intent.category.LAUNCHER') {
|
||||
$has_launcher = true;
|
||||
}
|
||||
}
|
||||
|
||||
if ($has_main && $has_launcher) {
|
||||
$launcher_activity = $activity->getAttribute('android:name');
|
||||
$source = 'activity';
|
||||
break 2;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// 如果未找到，再查找 <activity-alias>
|
||||
if (!$launcher_activity) {
|
||||
$aliases = $xpath->query('//activity-alias');
|
||||
foreach ($aliases as $alias) {
|
||||
$intent_filters = $alias->getElementsByTagName('intent-filter');
|
||||
foreach ($intent_filters as $filter) {
|
||||
$has_main = false;
|
||||
$has_launcher = false;
|
||||
|
||||
foreach ($filter->getElementsByTagName('action') as $action) {
|
||||
if ($action->getAttribute('android:name') === 'android.intent.action.MAIN') {
|
||||
$has_main = true;
|
||||
}
|
||||
}
|
||||
|
||||
foreach ($filter->getElementsByTagName('category') as $category) {
|
||||
if ($category->getAttribute('android:name') === 'android.intent.category.LAUNCHER') {
|
||||
$has_launcher = true;
|
||||
}
|
||||
}
|
||||
|
||||
if ($has_main && $has_launcher) {
|
||||
$launcher_activity = $alias->getAttribute('android:targetActivity');
|
||||
$source = 'activity-alias';
|
||||
break 2;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if ($launcher_activity !== null) {
|
||||
$results[] = [true, $launcher_activity, $source, null];
|
||||
} else {
|
||||
$results[] = [false, null, null, "未找到启动 Activity：$manifest_path"];
|
||||
}
|
||||
}
|
||||
|
||||
return $results;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
// 方法：反编译 APK
|
||||
function decompile_apks($apktool_jar, $apk_files, $output_base_dir = null) {
|
||||
$results = [];
|
||||
|
||||
// 检查所有 APK 文件是否存在
|
||||
foreach ($apk_files as $apk_file) {
|
||||
if (!file_exists($apk_file)) {
|
||||
return [[false, "APK 文件不存在：$apk_file", null, null]];
|
||||
}
|
||||
}
|
||||
|
||||
// 遍历每个 APK 执行反编译
|
||||
foreach ($apk_files as $apk_file) {
|
||||
// 生成默认输出目录
|
||||
$apk_dir = dirname($apk_file);
|
||||
$apk_name = pathinfo($apk_file, PATHINFO_FILENAME);
|
||||
$output_dir = ($output_base_dir ?? $apk_dir) . DIRECTORY_SEPARATOR . $apk_name;
|
||||
|
||||
// 构造反编译命令
|
||||
$cmd = "java -jar \"$apktool_jar\" d \"$apk_file\" -o \"$output_dir\" -f";
|
||||
|
||||
// 执行命令
|
||||
$output = shell_exec($cmd);
|
||||
|
||||
// 判断是否成功（通过输出目录是否存在判断）
|
||||
if (is_dir($output_dir)) {
|
||||
$results[] = [true, "反编译成功", $output_dir, $output];
|
||||
} else {
|
||||
$results[] = [false, "反编译失败", $output_dir, $output];
|
||||
}
|
||||
}
|
||||
|
||||
return $results;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user