├── Demo.apk
├── README
├── config.py
├── extendStringChunk.py
├── handleAXML.py
├── options.py
├── utf_16.py
└── zipApk.sh


/Demo.apk:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/wanchouchou/playWithAXML/10a7c12afef819b2f08f3005ab93a7b79b0fb083/Demo.apk


--------------------------------------------------------------------------------
/README:
--------------------------------------------------------------------------------
 1 | 本程序用于修改AXML二进制文件。目前完成的功能有：
 2 |    1、混淆、替换AndroidManifes.xml中的属性名
 3 |    2、向AXML中加入一个无效属性以实现AXML Ambiguity方案
 4 |    
 5 | 使用平台：
 6 |    由于加入了options相关代码，所以只能在LINUX环境下运行。
 7 | 限制：
 8 |    目前只对utf-16编码的AXML文件进行处理，暂不支持UTF-8。不过后者简单很多，大家可以自己实现~
 9 | 使用方法：
10 |    1、下载https://github.com/wanchouchou/ManifestAmbiguity中的所有文件，并make，得到manifestAmbiguit可执行文件
11 |    2、chmod a+x manifestAmbiguity   #添加可执行权限
12 |    ps:之所以要这样做，是因为我太懒，不重写AXML Ambiguity方案的代码，为了复用它，就在后续的代码中直接调用这个可执行文件了...
13 |    3、下载此分支下所有文件。
14 |    4、由于需要重签名apk，所以需要将自己的签名文件keystore放在此目录下，并重命名为clientkeystore。
15 |    5、useage:
16 |        ./handleAXML.py -s/--source=[Source.apk] -o/--out=new.apk -c/--confuse  -a/--ambiguity  
17 |        注意，由于某些原因，这里的-o 后的参必须为new.apk~~  -s 后跟源apk名 -c 表示混淆 -a 表示加入一个无效属性以实现AXML Ambiguity方案
18 |    这两个参是可选的，大家可根据自己的需要选择。
19 |    6、程序执行过程中，会停留在签名阶段，输入自己clientkeystore对应的密码即可。
20 |    7、config.py为配置文件，具体作用里面有说明~
21 |    
22 | 


--------------------------------------------------------------------------------
/config.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python2.7
 2 | # FileName: config.py
 3 | # Author: wanchouchou
 4 | # mail: 200802376@qq.com
 5 | # Created Time: 2014-12-27
 6 | 
 7 | 
 8 | # the size (in byte) of each string of the AXML, used in extendStringChunk.py
 9 | NEW_EACH_STRING_SIZE = 200  
10 | 
11 | #Use NEW_STRING to replace all item in OLD_STRING_LIST in AXML
12 | NEW_STRING = '\n\n----######----\n------#-------\n-----#####----\n----#----#----\n---#-----#----\n--#-----##----\n\n'
13 | OLD_STRING_LIST = ['label', 'theme', 'icon', 'minSdkVersion', 'versionCode', \
14 |         'versionCode', 'targetSdkVersion', 'protectionLevel', 'permissionGroup', 'required', 'allowBackup', \
15 |         'permission', 'priority', 'launchMode',]
16 | 
17 | 


--------------------------------------------------------------------------------
/extendStringChunk.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python2.7
 2 | # FileName: extendStringChunk.py
 3 | # Author: wanchouchou
 4 | # mail: 200802376@qq.com
 5 | # Created Time: 2014-12-14
 6 | 
 7 | import struct
 8 | import config
 9 | 
10 | NEW_EACH_STRING_SIZE = config.NEW_EACH_STRING_SIZE
11 | 
12 | def getUint32(bytearray_data, pos):
13 |     return struct.unpack_from('<I', bytearray_data[pos : pos + 4])[0]
14 | 
15 | def getUshort16(bytearray_data, pos):
16 |     return struct.unpack_from('<H', bytearray_data[pos : pos + 2])[0]
17 | 
18 | def setUint32(bytearray_data, pos, uint):
19 |     #first change the uint to streams
20 |     tmp = struct.pack('<I', uint)
21 |     bytearray_data[pos : pos + 4] = struct.unpack('BBBB', tmp[ : 4])
22 | 
23 | def cp_bytes(dest_data, source_data, len, pos_of_dest, pos_of_source):
24 |     dest_data[pos_of_dest : pos_of_dest + len] = source_data[pos_of_source : pos_of_source + len]
25 | 
26 | def extend_and_copy_eachString(dest_data, source_data, \
27 |         string_count, string_start_offset):
28 |     global NEW_EACH_STRING_SIZE
29 |     EXTEND_SIZE = 0  #record how many bytes the stringchunk added after we extended the stingchunk.
30 |     #judge if the xml had been extended, throught calculating the distance between first and second string offset 
31 |     first_string_offset = getUint32(source_data, 0x24)
32 |     second_string_offset = getUint32(source_data, 0x24 + 4)
33 |     need_extend = 0   
34 |     if (second_string_offset - first_string_offset) < NEW_EACH_STRING_SIZE:
35 |         need_extend = 1
36 |         #debug 
37 |         print 'need extend'
38 |     else:
39 |         print 'Do not need extend'
40 | 
41 |     for i in range(string_count):
42 |         #firstly we need to extend each string to NEW_EACH_STRING_SIZE bytes
43 |         old_value = getUint32(source_data, 0x24 + 4*i) #old_string_offset
44 |         setUint32(dest_data, 0x24 + 4*i, NEW_EACH_STRING_SIZE * i)
45 |         #and then copy all old_data to suitable location of dest_data
46 |         cur_String_offset = string_start_offset + 0x8 + old_value
47 |         cur_string_len = getUshort16(source_data, cur_String_offset)
48 |         cur_string_bytes = 2 * (cur_string_len + 2)
49 |         if need_extend == 1:
50 |             EXTEND_SIZE += (NEW_EACH_STRING_SIZE - cur_string_bytes)
51 |         pos_of_dest = string_start_offset + 0x8 + i * NEW_EACH_STRING_SIZE
52 |         cp_bytes(dest_data, source_data, cur_string_bytes, pos_of_dest, cur_String_offset)
53 |      
54 | 
55 |     return EXTEND_SIZE / 4 * 4  #NOTE!The last string in source_data maybe 4 aligned, so we mush offset it.
56 | 
57 | def extend_AXML_stringChunk(source_filename, target_filename):
58 |         '''
59 |         Open the AXML of source.apk defined by source_filename), and extend its stringchunk.
60 |         At last, write the extended AXML to the file defined by target_filename.
61 |         '''
62 |         source_file = open(source_filename, 'rb')
63 |         source_data = bytearray(source_file.read())
64 |         source_file.close()
65 |         dest_filename = target_filename
66 |         dest_file = open(dest_filename, 'wb')
67 |         #get filesize
68 |         filesize = getUint32(source_data, 4)
69 |         #get stringChunkSize
70 |         string_chunk_size = getUint32(source_data, 0xc)
71 |         #get count of strings
72 |         string_count = getUint32(source_data, 0x10)
73 |         #get string_start_offset
74 |         string_start_offset = getUint32(source_data, 0x1c)
75 |         print string_start_offset
76 | 
77 | 
78 |         dest_data = bytearray(filesize * 20)
79 |         dest_data[ : 0x24] = source_data[ : 0x24]
80 |         EXTEND_SIZE = extend_and_copy_eachString(dest_data, source_data, string_count, string_start_offset)
81 | 
82 |         print filesize, EXTEND_SIZE
83 | 
84 |         source_resourceID_offset = 0x8 + string_chunk_size
85 |         dest_resourceID_offset = source_resourceID_offset + EXTEND_SIZE
86 |         #the last data should not be changed, so we copy them directly
87 |         dest_data[dest_resourceID_offset : dest_resourceID_offset + filesize - source_resourceID_offset] = \
88 |                 source_data[source_resourceID_offset : filesize]
89 | 
90 |         #at last we should repair the filesize and stringChunkSize
91 |         setUint32(dest_data, 4, filesize + EXTEND_SIZE)
92 |         setUint32(dest_data, 0xc, string_chunk_size + EXTEND_SIZE)
93 | 
94 |         #write to the output file
95 |         dest_file.write(dest_data[: filesize + EXTEND_SIZE])
96 |         dest_file.close()
97 | 
98 | 


--------------------------------------------------------------------------------
/handleAXML.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python2.7
 2 | # FileName: handleAXML.py
 3 | # Author: wanchouchou
 4 | # mail: 200802376@qq.com
 5 | # Created Time: 2014-12-15
 6 | 
 7 | import os
 8 | import sys
 9 | 
10 | import extendStringChunk
11 | import utf_16
12 | import options
13 | 
14 | def confuseAXML(AXML_inpath, AXML_outpath):
15 |     #firstly, extend the string chunk for our DIY replace_attrName
16 |     extendStringChunk.extend_AXML_stringChunk(AXML_inpath, AXML_outpath)
17 |     #and then begin the operator of replacing. NOTE: currently, I just support the UTF-16.
18 |     utf_16.replace_attrName(AXML_inpath, AXML_outpath)
19 | 
20 | def ambiguityAXML(AXML_inpath, AXML_outpath):
21 |     CMD_MODIFY = './manifestAmbiguity -m ' + AXML_inpath + '  -o ' + AXML_outpath
22 |     os.system(CMD_MODIFY)
23 |     print 'Ambiguity Modify OK!'
24 | 
25 | def handle_AXML(argv):
26 |     options_ret = options.handle_options(argv)
27 |     if options_ret == 0 :
28 |         sys.exit(1)
29 |     
30 |     CMD_RMDIR = 'rm -rf out *new.apk'
31 |     CMD_MAKEDIR = 'mkdir -p out'
32 |     CMD_UNZIP = 'unzip ' + options.opts_struct.source_filepath + ' -d out' 
33 |     os.system(CMD_RMDIR)
34 |     os.system(CMD_MAKEDIR)
35 |     os.system(CMD_UNZIP)
36 |     
37 |     AXML_PATH = 'out' + os.sep + 'AndroidManifest.xml'
38 |     if options.opts_struct.needConfuse == 1:
39 |         confuseAXML(AXML_PATH, AXML_PATH)
40 |     if options.opts_struct.needAmbiguity == 1:
41 |         ambiguityAXML(AXML_PATH, AXML_PATH)
42 |     
43 |     os.system('./zipApk.sh')
44 | 
45 | 
46 |     
47 | 
48 | handle_AXML(sys.argv[1 : ])
49 | 
50 | 


--------------------------------------------------------------------------------
/options.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python2.7
 2 | # FileName: options.py
 3 | # Author: wanchouchou
 4 | # mail: 200802376@qq.com
 5 | # Created Time: 2014-12-15
 6 | 
 7 | import sys
 8 | import getopt
 9 | 
10 | class opts_struct:
11 |     needAmbiguity = 0
12 |     needConfuse = 0
13 |     source_filepath = ''
14 |     out_filepath = 'new.apk'
15 | 
16 | short_opts = 'haco:s:'
17 | long_opts = ['help','ambiguity', 'confuse', 'out=','source=']
18 | 
19 | 
20 | def useage():
21 |     print '#############################################################'
22 |     print 'Useage: '
23 |     print '\t./handleAXML.py -s/--source=[Source.apk] -o/--out=[out.apk] '
24 |     print '\t-c/--confuse  -m/--modify'
25 |     print '##############################################################'
26 | 
27 | def handle_options(argv):
28 |     global short_opts
29 |     global long_opts
30 |     
31 |     try:
32 |         opts, args = getopt.getopt(argv, short_opts, long_opts)
33 |     except:
34 |         print 'cmd formate error!'
35 |         sys.exit(2)
36 | 
37 |     for opt, arg in opts:
38 |         if opt in ('-h', '--help'):
39 |             useage()
40 |             return 0
41 |         if opt in ('-a', '--ambiguity'):
42 |             opts_struct.needAmbiguity = 1
43 |         if opt in ('-c', '--confuse'):
44 |             opts_struct.needConfuse = 1
45 |         if opt in ('-s', '--source'):
46 |             opts_struct.source_filepath = arg
47 |         if opt in ('-o', '--out'):
48 |             opts_struct.out_filepath = arg 
49 | 
50 |     return 1
51 | 
52 | 
53 | 
54 | 
55 | 


--------------------------------------------------------------------------------
/utf_16.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python2.7
 2 | # FileName: utf-16.py
 3 | # Author: wanchouchou
 4 | # mail: 200802376@qq.com
 5 | # Created Time: 2014-12-12
 6 | import struct
 7 | import config 
 8 | 
 9 | def axmlUtf16Encode(string):
10 |     bytes_str = bytearray(string.encode('utf-16'))
11 |     len_str = len(string)
12 |     pack_len_str = struct.pack('<I', len_str) 
13 |     bytes_str[ : 2] = struct.unpack('BB', pack_len_str[ : 2])
14 |     return bytes_str
15 | 
16 | def findUtf16InAXML(file_data, key_encoded, start_pos):
17 |     pos = file_data.find(key_encoded, start_pos, -1)
18 |     return pos
19 | 
20 | def replace_utf16(file_data, old_string, new_string):
21 |     '''
22 |     replace all old_string in the file_data with new_string
23 |     '''
24 |     new_string_encoded = axmlUtf16Encode(new_string)
25 |     old_string_encoded = axmlUtf16Encode(old_string)
26 |     n_s_e_len = len(new_string_encoded)
27 |     o_s_e_len = len(old_string_encoded)
28 |     
29 |     pos = 0
30 |     while True:
31 |         pos = findUtf16InAXML(file_data, old_string_encoded, pos)
32 |         if pos == -1:
33 |             print 'In func(replace_utf16) replace old string \"%s\" over!' %old_string
34 |             break
35 |         #Start replace 
36 |         file_data[pos : pos + n_s_e_len] = new_string_encoded[ : n_s_e_len]
37 |     
38 | 
39 | 
40 | def replace_attrName(source_AXML_name, dest_AXML_name):
41 |         source_file = open(source_AXML_name, 'rb')
42 |         file_data = bytearray(source_file.read())
43 |         source_file.close()
44 |         #new_string = '\n\n----######----\n------#-------\n-----#####----\n----#----#----\n---#-----#----\n--#-----##----\n\n'
45 |         #old_string_list = ['label', 'theme', 'icon', 'minSdkVersion', 'versionCode', \
46 |         #        'versionName', 'targetSdkVersion']
47 |         new_string = config.NEW_STRING
48 | 	old_string_list = config.OLD_STRING_LIST
49 | 	for item in old_string_list:
50 |             replace_utf16(file_data, item, new_string)
51 | 
52 |         f = open(dest_AXML_name, 'wb')
53 |         f.write(file_data)
54 |         f.close()
55 | 


--------------------------------------------------------------------------------
/zipApk.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | #APK=$1
 4 | #TEMP_DIR="${APK}_temp"
 5 | #rm -rf $TEMP_DIR *new
 6 | #mkdir -p $TEMP_DIR
 7 | #unzip $APK -d $TEMP_DIR
 8 | 
 9 | echo "zip apk"
10 | cd out/
11 | #do your job
12 | rm -r META-INF/
13 | zip -9 -r ../new.apk ./*
14 | cd ..
15 | echo "sig apk"
16 | jarsigner -keystore "./clientkeystore" -sigalg SHA1withRSA -digestalg SHA1 new.apk  CLIENT
17 | 


--------------------------------------------------------------------------------