{"id":726,"date":"2026-07-07T22:40:47","date_gmt":"2026-07-07T14:40:47","guid":{"rendered":"https:\/\/dreamc.top\/?p=726"},"modified":"2026-07-07T22:40:47","modified_gmt":"2026-07-07T14:40:47","slug":"apk_reverse1","status":"publish","type":"post","link":"https:\/\/dreamc.top\/index.php\/2026\/07\/07\/apk_reverse1\/","title":{"rendered":"\u67d0\u516c\u4ea4 APK \u9006\u5411\u53bb\u5e7f\u544a\u5168\u6d41\u7a0b\u603b\u7ed3"},"content":{"rendered":"

<\/span>\u67d0\u516c\u4ea4 APK \u9006\u5411\u53bb\u5e7f\u544a\u5168\u6d41\u7a0b\u603b\u7ed3<\/span><\/h1>\n

<\/span>\u4e00\u3001\u9879\u76ee\u6982\u8ff0<\/span><\/h2>\n
    \n
  • \u76ee\u6807APP<\/strong>: \u67d0\u516c\u4ea4 (cn.xxx.pay) v3.1.4<\/li>\n
  • APK\u5927\u5c0f<\/strong>: 169MB<\/li>\n
  • APP\u7c7b\u578b<\/strong>: Flutter (Dart AOT\u7f16\u8bd1)<\/li>\n
  • \u4fdd\u62a4\u65b9\u6848<\/strong>: \u767e\u5ea6\u52a0\u56fa (BaiduProtect\/Sagittarius) v6.9.4<\/li>\n
  • \u7b7e\u540d\u65b9\u5f0f<\/strong>: APK Signature Scheme v2+v3<\/li>\n
  • \u76ee\u6807<\/strong>: \u79fb\u9664\u5e7f\u544a\u5f39\u7a97 + \u79fb\u9664\u6743\u9650\u5f39\u7a97 + \u53bb\u9664\u767e\u5ea6\u52a0\u56fa<\/li>\n<\/ul>\n
    \n

    <\/span>\u4e8c\u3001\u73af\u5883\u51c6\u5907<\/span><\/h2>\n

    <\/span>2.1 \u5de5\u5177\u5b89\u88c5<\/span><\/h3>\n\n\n\n\n\n\n\n\n\n\n\n\n
    \u5de5\u5177<\/th>\n\u7248\u672c<\/th>\n\u7528\u9014<\/th>\n<\/tr>\n<\/thead>\n
    apktool<\/td>\n2.10.0<\/td>\nAPK\u53cd\u7f16\u8bd1\/\u91cd\u6253\u5305<\/td>\n<\/tr>\n
    jadx<\/td>\n1.5.0<\/td>\nJava\u6e90\u7801\u53cd\u7f16\u8bd1(\u67e5\u770b)<\/td>\n<\/tr>\n
    aapt\/aapt2<\/td>\n\u7cfb\u7edf\u81ea\u5e26<\/td>\nAndroid\u8d44\u6e90\u5904\u7406<\/td>\n<\/tr>\n
    zipalign<\/td>\n\u7cfb\u7edf\u81ea\u5e26<\/td>\nAPK\u5bf9\u9f50<\/td>\n<\/tr>\n
    apksigner<\/td>\n\u7cfb\u7edf\u81ea\u5e26<\/td>\nAPK\u7b7e\u540d<\/td>\n<\/tr>\n
    openjdk-17<\/td>\nJRE+JDK<\/td>\nJava\u8fd0\u884c\u73af\u5883<\/td>\n<\/tr>\n
    gcc-aarch64-linux-gnu<\/td>\n9.4.0<\/td>\nARM64\u4ea4\u53c9\u7f16\u8bd1<\/td>\n<\/tr>\n
    adb<\/td>\nAndroid SDK<\/td>\n\u771f\u673a\u8c03\u8bd5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    sudo apt install -y openjdk-17-jdk-headless\nsudo apt install -y gcc-aarch64-linux-gnu\nsudo apt install -y adb\n\n# apktool\nsudo wget https:\/\/github.com\/iBotPeaches\/Apktool\/releases\/download\/v2.10.0\/apktool_2.10.0.jar -O \/usr\/local\/bin\/apktool.jar\nsudo wget https:\/\/raw.githubusercontent.com\/iBotPeaches\/Apktool\/master\/scripts\/linux\/apktool -O \/usr\/local\/bin\/apktool\nsudo chmod +x \/usr\/local\/bin\/apktool \/usr\/local\/bin\/apktool.jar\n\n# jadx\nwget https:\/\/github.com\/skylot\/jadx\/releases\/download\/v1.5.0\/jadx-1.5.0.zip\nunzip jadx-1.5.0.zip -d \/tmp\/jadx\nsudo cp \/tmp\/jadx\/bin\/jadx \/usr\/local\/bin\/\nsudo cp -r \/tmp\/jadx\/lib \/usr\/local\/share\/jadx\/\n<\/code><\/pre>\n
    <\/span>2.2 \u6d4b\u8bd5\u8bbe\u5907<\/span><\/h3>\n
      \n
    • \u5c0f\u7c73\u624b\u673a (MIUI, arm64-v8a)<\/li>\n
    • \u5df2Root (su\u53ef\u7528)<\/li>\n
    • USB\u8c03\u8bd5\u5df2\u5f00\u542f<\/li>\n
    • adb\u8fde\u63a5\u6b63\u5e38<\/li>\n<\/ul>\n
      \n
      <\/span>\u4e09\u3001APK\u7ed3\u6784\u5206\u6790<\/span><\/h2>\n
      <\/span>3.1 \u53cd\u7f16\u8bd1<\/span><\/h3>\n
      apktool d -f mzt.apk -o mzt_decoded\n<\/code><\/pre>\n
      <\/span>3.2 DEX\u6587\u4ef6\u7ed3\u6784<\/span><\/h3>\n\n\n\n\n\n\n\n\n\n
      DEX\u6587\u4ef6<\/th>\n\u5185\u5bb9<\/th>\n\u5927\u5c0f<\/th>\n<\/tr>\n<\/thead>\n
      classes.dex<\/td>\n\u767e\u5ea6\u52a0\u56fa\u58f3\u4ee3\u7801(sagittarius) + \u7b2c\u4e09\u65b9\u5e93(alibaba\/alipay\/bumptech)<\/td>\n7.8MB<\/td>\n<\/tr>\n
      classes2.dex<\/td>\nbumptech + bytedance(\u7a7f\u5c71\u7532) + google<\/td>\n6.0MB<\/td>\n<\/tr>\n
      classes3.dex<\/td>\ngoogle + huawei + kwad(\u5feb\u624b) + kwai + qq(\u817e\u8baf\u5e7f\u544a)<\/td>\n5.3MB<\/td>\n<\/tr>\n
      classes4.dex<\/td>\nss(\u4e0b\u8f7d) + ta + tencent + unionpay<\/td>\n2.4MB<\/td>\n<\/tr>\n
      classes5.dex<\/td>\nFlutter\u5f15\u64ce + kotlin + okhttp + Flutter\u63d2\u4ef6\u6ce8\u518c<\/td>\n6.6MB<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
      <\/span>3.3 \u767e\u5ea6\u52a0\u56fa\u7ed3\u6784<\/span><\/h3>\n
      assets\/\n\u251c\u2500\u2500 baiduprotect1~6.jar        # \u52a0\u5bc6\u7684\u4e1a\u52a1dex (\u51714.6MB)\n\u251c\u2500\u2500 baiduprotect1~6.i.dex      # dex\u7d22\u5f15 (ZIP\u5305\u542b\u7a7a\u58f3dex)\n\u251c\u2500\u2500 baiduprotect-sec.dex        # \u5b89\u5168\u914d\u7f6e\n\u251c\u2500\u2500 baiduprotect.md             # \u52a0\u5bc6\u914d\u7f6e\n\u2514\u2500\u2500 libbaiduprotect_x86\/x86_64  # x86 so\u5e93\n\nlib\/\n\u251c\u2500\u2500 arm64-v8a\/libbaiduprotect.so    # \u6838\u5fc3native\u5e93 (OLLVM\u6df7\u6dc6)\n\u2514\u2500\u2500 armeabi-v7a\/libbaiduprotect.so\n\nsmali\/com\/sagittarius\/v6\/\n\u251c\u2500\u2500 StubApplication.smali    # \u58f3Application (\u66ff\u6362\u539f\u59cbApplication)\n\u251c\u2500\u2500 A.smali                  # native\u65b9\u6cd5\u58f0\u660e (n1\/n2\/n3)\n\u251c\u2500\u2500 AppInfo.smali            # APP\u4fe1\u606f (\u5305\u540d\/so\u540d\/\u8def\u5f84)\n\u2514\u2500\u2500 b\/                       # \u52a0\u56fa\u5de5\u5177\u7c7b\n    \u251c\u2500\u2500 f.smali              # \u521d\u59cb\u5316\u7ba1\u7406\u5668\n    \u251c\u2500\u2500 t.smali              # so\u52a0\u8f7d\n    \u251c\u2500\u2500 h.smali              # dex\u52a0\u8f7d\n    \u2514\u2500\u2500 g.smali              # Application\u5b9e\u4f8b\u5316\n<\/code><\/pre>\n
      <\/span>3.4 \u5e7f\u544aSDK\u8bc6\u522b<\/span><\/h3>\n
      \u901a\u8fc7AndroidManifest.xml\u548csmali\u4ee3\u7801\u5206\u6790\uff0c\u8bc6\u522b\u51fa9\u4e2a\u5e7f\u544aSDK\uff1a<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
      SDK<\/th>\n\u5305\u540d<\/th>\n\u7c7b\u578b<\/th>\n<\/tr>\n<\/thead>\n
      \u7a7f\u5c71\u7532\/Pangle<\/td>\ncom.bytedance.sdk.openadsdk<\/td>\n\u5f00\u5c4f\/\u63d2\u5c4f\/\u6fc0\u52b1\u89c6\u9891<\/td>\n<\/tr>\n
      Sigmob<\/td>\ncom.sigmob.sdk<\/td>\n\u5f00\u5c4f\/\u63d2\u5c4f<\/td>\n<\/tr>\n
      Windmill\u805a\u5408<\/td>\ncom.windmill.windmill_ad_plugin<\/td>\nFlutter\u5e7f\u544a\u6865\u63a5<\/td>\n<\/tr>\n
      \u5feb\u624bKwad<\/td>\ncom.kwad.sdk<\/td>\n\u5f00\u5c4f\/\u5168\u5c4f\/\u6fc0\u52b1\u89c6\u9891<\/td>\n<\/tr>\n
      \u817e\u8baf\u4f18\u91cf\u6c47GDT<\/td>\ncom.qq.e.ads<\/td>\n\u6a2a\u5e45\/\u63d2\u5c4f\/\u6fc0\u52b1\u89c6\u9891<\/td>\n<\/tr>\n
      \u767e\u5ea6Mobads<\/td>\ncom.baidu.mobads.sdk<\/td>\n\u6fc0\u52b1\u89c6\u9891<\/td>\n<\/tr>\n
      \u7f8e\u6570Meishu<\/td>\ncom.meishu.sdk<\/td>\n\u63d2\u5c4f\/\u6fc0\u52b1\u89c6\u9891<\/td>\n<\/tr>\n
      \u7ae0\u9c7cOctopus<\/td>\ncom.octopus.ad<\/a><\/td>\n\u63d2\u5c4f\/\u6d4f\u89c8\u5668\u5e7f\u544a<\/td>\n<\/tr>\n
      \u8da3\u76dfQumeng<\/td>\ncom.qumeng.advlib<\/td>\n\u63d2\u5c4f\u5e7f\u544a<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
      \n
      <\/span>\u56db\u3001\u767e\u5ea6\u52a0\u56fa\u7b7e\u540d\u6821\u9a8c\u5206\u6790\u4e0e\u7ed5\u8fc7<\/span><\/h2>\n
      <\/span>4.1 \u7b7e\u540d\u6821\u9a8c\u673a\u5236<\/span><\/h3>\n
      \u767e\u5ea6\u52a0\u56fa\u6709\u4e24\u5c42\u7b7e\u540d\u6821\u9a8c\uff1a<\/p>\n
        \n
      1. n1()\u521d\u59cb\u6821\u9a8c<\/strong>: \u5728StubApplication.attachBaseContext()<\/code>\u4e2d\u8c03\u7528native\u65b9\u6cd5A.n1()<\/code>\uff0c\u6821\u9a8cAPK\u7b7e\u540d+\u89e3\u5bc6dex<\/li>\n
      2. \u540e\u53f0\u68c0\u6d4b\u7ebf\u7a0b<\/strong>: APP\u542f\u52a8\u540e\u7ea61\u79d2\uff0cThread-9\u68c0\u6d4b\u7ebf\u7a0b\u89e6\u53d1XOX state=519<\/code>\uff0c\u53d1\u73b0\u7b7e\u540d\u4e0d\u5339\u914d\u540e\u53d1\u9001signal 64<\/code>\u6740\u6b7b\u8fdb\u7a0b<\/li>\n<\/ol>\n
        <\/span>4.2 StubApplication\u542f\u52a8\u6d41\u7a0b<\/span><\/h3>\n
        StubApplication.<clinit>()\n  \u2514\u2500 b\/f.init()                          # \u52a0\u8f7d\u52a0\u56fa\u6a21\u5757\n\nStubApplication.attachBaseContext(context)\n  \u251c\u2500 b\/t.a(app, context)                 # \u8bbe\u7f6e\u73af\u5883\u53d8\u91cf\n  \u251c\u2500 AppInfo.APKPATH = sourceDir         # \u83b7\u53d6APK\u8def\u5f84\n  \u251c\u2500 b\/t.b()                             # \u52a0\u8f7dlibbaiduprotect.so\n  \u251c\u2500 A.n1(context, pkg, apkpath, ...)    # \u2605\u7b7e\u540d\u6821\u9a8c+dex\u89e3\u5bc6\n  \u251c\u2500 \u52a0\u8f7d\u539f\u59cbApplication                  # \u5b9e\u4f8b\u5316FlutterApplication\n  \u251c\u2500 b\/g.a(context, application)          # \u8bbe\u7f6eApplication\n  \u2514\u2500 b\/f.attachBaseContext(...)           # \u6267\u884c\u52a0\u56fa\u6a21\u5757\u7684attachBaseContext\n<\/code><\/pre>\n
        <\/span>4.3 FakeAPK\u65b9\u6848<\/span><\/h3>\n
        \u6838\u5fc3\u601d\u8def<\/strong>: \u8ba9n1()\u8bfb\u53d6\u5230\u539f\u59cb\u7b7e\u540d\u7684APK\u6587\u4ef6<\/p>\n
          \n
        1. \u521b\u5efa\u4f2a\u9020APK (7.5MB)\uff0c\u5305\u542b\u539f\u59cbAPK\u7684\u7b7e\u540d\u5757 + baiduprotect*.jar + classes.dex<\/li>\n
        2. \u4fee\u6539StubApplication\uff0c\u5728n1()\u8c03\u7528\u524d\u5c06APKPATH\u6307\u5411\u4f2a\u9020APK<\/li>\n
        3. n1()\u4ece\u4f2a\u9020APK\u9a8c\u8bc1\u7b7e\u540d(\u901a\u8fc7) + \u89e3\u5bc6dex(\u6b63\u5e38)<\/li>\n
        4. APP\u6b63\u5e38\u8fd0\u884c<\/li>\n<\/ol>\n
          # \u521b\u5efa\u4f2a\u9020APK\n# \u5305\u542b: \u539f\u59cbclasses.dex + baiduprotect*.jar + \u539f\u59cb\u7b7e\u540d\u5757\n<\/code><\/pre>\n
          <\/span>4.4 \u5185\u5b58\u8131\u58f3<\/span><\/h3>\n
          \u76ee\u7684<\/strong>: \u63d0\u53d6\u767e\u5ea6\u52a0\u56fa\u89e3\u5bc6\u540e\u7684\u771f\u5b9e\u4e1a\u52a1dex<\/p>\n
          \u7f16\u5199C\u7a0b\u5e8f(dex_dumper)\uff0c\u7f16\u8bd1\u4e3aARM64\u9759\u6001\u4e8c\u8fdb\u5236\uff1a<\/p>\n
          \/\/ \u6838\u5fc3\u6d41\u7a0b:\n\/\/ 1. \u7b49\u5f85APP\u8fdb\u7a0b\u51fa\u73b0\n\/\/ 2. kill -STOP \u6682\u505c\u8fdb\u7a0b\n\/\/ 3. \u8bfb\u53d6 \/proc\/pid\/maps\n\/\/ 4. \u641c\u7d22 "dalvik-DEX data" \u5185\u5b58\u533a\u57df\n\/\/ 5. \u5728\u5185\u5b58\u4e2d\u641c\u7d22 "dex\\n" \u5934\n\/\/ 6. \u8bfb\u53d6dex header\u4e2d\u7684file_size\n\/\/ 7. dump\u5b8c\u6574dex\u5230\u6587\u4ef6\n\/\/ 8. kill -CONT \u6062\u590d\u8fdb\u7a0b\n<\/code><\/pre>\n
          aarch64-linux-gnu-gcc -O2 -static -o dex_dumper dex_dumper.c\nadb push dex_dumper \/data\/local\/tmp\/\n# \u542f\u52a8APP\u540e\u7acb\u5373\u6267\u884cdump\n<\/code><\/pre>\n
          \u8131\u58f3\u7ed3\u679c<\/strong>: \u6210\u529f\u63d0\u53d66\u4e2adex\u6587\u4ef6<\/p>\n\n\n\n\n\n\n\n\n\n\n
          \u6587\u4ef6<\/th>\n\u5927\u5c0f<\/th>\n\u5185\u5bb9<\/th>\n<\/tr>\n<\/thead>\n
          dex_0.dex<\/td>\n3.4MB<\/td>\nWindmillAdPlugin + JPushPlugin + \u7b2c\u4e09\u65b9\u5e93<\/td>\n<\/tr>\n
          dex_2.dex<\/td>\n3.9MB<\/td>\nTalkingDataSDK + \u5e7f\u544aSDK<\/td>\n<\/tr>\n
          dex_4.dex<\/td>\n545KB<\/td>\nTencentKitPlugin<\/td>\n<\/tr>\n
          dex_6.dex<\/td>\n2.4MB<\/td>\nFlutterBuglyPlugin + Sigmob<\/td>\n<\/tr>\n
          dex_8.dex<\/td>\n1.9MB<\/td>\nMainActivity + MztFlutterPlugins + AliyunFace<\/td>\n<\/tr>\n
          dex_10.dex<\/td>\n193KB<\/td>\n\u5176\u4ed6\u4e1a\u52a1\u4ee3\u7801<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          \n
          <\/span>\u4e94\u3001\u91cd\u6253\u5305(\u53bb\u58f3+\u53bb\u5e7f\u544a)<\/span><\/h2>\n
          <\/span>5.1 \u4fee\u6539\u65b9\u6848<\/span><\/h3>\n
            \n
          1. \u4ececlasses.dex\u79fb\u9664sagittarius\u76ee\u5f55(\u767e\u5ea6\u52a0\u56fa\u4ee3\u7801)<\/li>\n
          2. \u5c06\u8131\u58f3\u76846\u4e2adex\u53cd\u7f16\u8bd1\u4e3asmali\uff0c\u5408\u5e76\u4e3aclasses6~classes9<\/li>\n
          3. AndroidManifest\u4fee\u6539:\n