AndResGuard资源混淆原理浅析

  /**
   * use by gradle
   *
   * @param param {@link InputParam} parameter
   * @throws IOException io exception
   */
  public Configuration(InputParam param) throws IOException {
    mWhiteList = new HashMap<>();
    ...
    // 进行白名单的转换
    for (String item : param.whiteList) {
      mUseWhiteList = true;
      addWhiteList(item);
    }
    ...
    // 固定ResTable_entry的名称，有助于减少全局字符串池的大小，此处的值一般配置为arg
    mFixedResName = param.fixedResName;
    // 需要将存储类型设置为deflated类型的名单
    for (String item : param.compressFilePattern) {
      mUseCompress = true;
      addToCompressPatterns(item);
    }
    ...
  }

  public final HashMap<String, HashMap<String, HashSet<Pattern>>> mWhiteList;

  private void addWhiteList(String item) throws IOException {
    if (item.length() == 0) {
      throw new IOException("Invalid config file: Missing required attribute " + ATTR_VALUE);
    }

    int packagePos = item.indexOf(".R.");
    if (packagePos == -1) {

      throw new IOException(String.format("please write the full package name,eg com.tencent.mm.R.drawable.dfdf, but yours %s\n",
          item
      ));
    }
    //先去掉空格
    item = item.trim();
    // 解析出包名
    String packageName = item.substring(0, packagePos);
    //不能通过lastDot
    int nextDot = item.indexOf(".", packagePos + 3);
    // 解析出类型名
    String typeName = item.substring(packagePos + 3, nextDot);
    // 资源名
    String name = item.substring(nextDot + 1);
    HashMap<String, HashSet<Pattern>> typeMap;

    if (mWhiteList.containsKey(packageName)) {
      typeMap = mWhiteList.get(packageName);
    } else {
      typeMap = new HashMap<>();
    }

    HashSet<Pattern> patterns;
    if (typeMap.containsKey(typeName)) {
      patterns = typeMap.get(typeName);
    } else {
      patterns = new HashSet<>();
    }

    // 资源名需要转换成Pattern，方便进行字符串匹配
    name = Utils.convertToPatternString(name);
    Pattern pattern = Pattern.compile(name);
    patterns.add(pattern);
    typeMap.put(typeName, patterns);
    System.out.println(String.format("convertToPatternString typeName %s format %s", typeName, name));
    mWhiteList.put(packageName, typeMap);
  }

  protected void resourceProguard(
      File outputDir, File outputFile, String apkFilePath, InputParam.SignatureType signatureType, int minSDKVersoin) {
    File apkFile = new File(apkFilePath);
    if (!apkFile.exists()) {
      System.err.printf("The input apk %s does not exist", apkFile.getAbsolutePath());
      goToError();
    }
    mRawApkSize = FileOperation.getFileSizes(apkFile);
    try {
      ApkDecoder decoder = new ApkDecoder(config, apkFile);
      /* 默认使用V1签名 */
      decodeResource(outputDir, decoder, apkFile);
      buildApk(decoder, apkFile, outputFile, signatureType, minSDKVersoin);
    } catch (Exception e) {
      e.printStackTrace();
      goToError();
    }
  }

  protected void resourceProguard(
      File outputDir, File outputFile, String apkFilePath, InputParam.SignatureType signatureType, int minSDKVersoin) {
      ...
      ApkDecoder decoder = new ApkDecoder(config, apkFile);
      /* 默认使用V1签名 */
      decodeResource(outputDir, decoder, apkFile);
      ...
  }

  private void decodeResource(File outputFile, ApkDecoder decoder, File apkFile)
      throws AndrolibException, IOException, DirectoryException {
    if (outputFile == null) {
      mOutDir = new File(mRunningLocation, apkFile.getName().substring(0, apkFile.getName().indexOf(".apk")));
    } else {
      mOutDir = outputFile;
    }
    decoder.setOutDir(mOutDir.getAbsoluteFile());
    decoder.decode();
  }

  public boolean hasResources() throws AndrolibException {
    try {
      return apkFile.getDirectory().containsFile("resources.arsc");
    } catch (DirectoryException ex) {
      throw new AndrolibException(ex);
    }
  }

  private void ensureFilePath() throws IOException {
    Utils.cleanDir(mOutDir);

    // TypedValue.UNZIP_FILE_PATH = temp
    String unZipDest = new File(mOutDir, TypedValue.UNZIP_FILE_PATH).getAbsolutePath();
    System.out.printf("unziping apk to %s\n", unZipDest);
    // 解压apk里面的所有文件到unZipDest，并记录每一项的压缩方式
    mCompressData = FileOperation.unZipAPk(apkFile.getAbsoluteFile().getAbsolutePath(), unZipDest);
    // 遍历apk里面每一项的名称，若匹配上了compressFilePattern配置的值，则将其压缩方式变为deflated
    dealWithCompressConfig();
    // 确定资源输出目录是res目录还是r目录，也就是说是否将res目录混淆成r目录
    if (!config.mKeepRoot) {
      mOutResFile = new File(mOutDir.getAbsolutePath() + File.separator + TypedValue.RES_FILE_PATH);
    } else {
      mOutResFile = new File(mOutDir.getAbsolutePath() + File.separator + "res");
    }

    //这个需要混淆各个文件夹
    mRawResFile = new File(mOutDir.getAbsoluteFile().getAbsolutePath()
                           + File.separator
                           + TypedValue.UNZIP_FILE_PATH
                           + File.separator
                           + "res");
    mOutTempDir = new File(mOutDir.getAbsoluteFile().getAbsolutePath() + File.separator + TypedValue.UNZIP_FILE_PATH);

    //这里纪录原始res目录的文件
    // 将原始res目录里面的文件记录到mRawResourceFiles中
    Files.walkFileTree(mRawResFile.toPath(), new ResourceFilesVisitor());

    if (!mRawResFile.exists() || !mRawResFile.isDirectory()) {
      throw new IOException("can not found res dir in the apk or it is not a dir");
    }

    mOutTempARSCFile = new File(mOutDir.getAbsoluteFile().getAbsolutePath() + File.separator + "resources_temp.arsc");
    mOutARSCFile = new File(mOutDir.getAbsoluteFile().getAbsolutePath() + File.separator + "resources.arsc");

    String basename = apkFile.getName().substring(0, apkFile.getName().indexOf(".apk"));
    // resources_mapping日志文件的地址
    mResMappingFile = new File(mOutDir.getAbsoluteFile().getAbsolutePath()
                               + File.separator
                               + TypedValue.RES_MAPPING_FILE
                               + basename
                               + TypedValue.TXT_FILE);
    // 被合并的冗余项的日志文件的地址
    mMergeDuplicatedResMappingFile = new File(mOutDir.getAbsoluteFile().getAbsolutePath()
                             + File.separator
                             + TypedValue.MERGE_DUPLICATED_RES_MAPPING_FILE
                             + basename
                             + TypedValue.TXT_FILE);
  }

  private void proguardFileName() throws IOException, AndrolibException {
    mMappingWriter = new BufferedWriter(new FileWriter(mApkDecoder.getResMappingFile(), false));
    mMergeDuplicatedResMappingWriter = new BufferedWriter(new FileWriter(mApkDecoder.getMergeDuplicatedResMappingFile(), false));
    mMergeDuplicatedResMappingWriter.write("res filter path mapping:\n");
    mMergeDuplicatedResMappingWriter.flush();

    // 短名字符串生成器
    mResguardBuilder = new ResguardStringBuilder();
    // 不过滤任何东西
    mResguardBuilder.reset(null);

    final Configuration config = mApkDecoder.getConfig();

    File rawResFile = mApkDecoder.getRawResFile();

    File[] resFiles = rawResFile.listFiles();

    // 需要看看哪些 类型 是要混淆文件路径的
    for (File resFile : resFiles) {
      String raw = resFile.getName();
      if (raw.contains("-")) {
        raw = raw.substring(0, raw.indexOf("-"));
      }
      mShouldResguardTypeSet.add(raw);
    }

    if (!config.mKeepRoot) {
      // 需要保持之前的命名方式
      if (config.mUseKeepMapping) {
        HashMap<String, String> fileMapping = config.mOldFileMapping;
        List<String> keepFileNames = new ArrayList<>();
        // 这里面为了兼容以前，也需要用以前的文件名前缀，即res混淆成什么
        String resRoot = TypedValue.RES_FILE_PATH;
        for (String name : fileMapping.values()) {
          int dot = name.indexOf("/");
          if (dot == -1) {
            throw new IOException(String.format("the old mapping res file path should be like r/a, yours %s\n", name));
          }
          resRoot = name.substring(0, dot);
          keepFileNames.add(name.substring(dot + 1));
        }
        // 去掉所有之前保留的命名，为了简单操作，mapping里面有的都去掉
        mResguardBuilder.removeStrings(keepFileNames);

        for (File resFile : resFiles) {
          String raw = "res" + "/" + resFile.getName();
          if (fileMapping.containsKey(raw)) {
            mOldFileName.put(raw, fileMapping.get(raw));
          } else {
            mOldFileName.put(raw, resRoot + "/" + mResguardBuilder.getReplaceString());
          }
        }
      } else {
        for (int i = 0; i < resFiles.length; i++) {
          // res/anim -> r/a
          mOldFileName.put("res" + "/" + resFiles[i].getName(),
             TypedValue.RES_FILE_PATH + "/" + mResguardBuilder.getReplaceString()
          );
        }
      }
      generalFileResMapping();
    }

    Utils.cleanDir(mApkDecoder.getOutResFile());
  }

  private void generalFileResMapping() throws IOException {
    mMappingWriter.write("res path mapping:\n");
    for (String raw : mOldFileName.keySet()) {
      mMappingWriter.write("    " + raw + " -> " + mOldFileName.get(raw));
      mMappingWriter.write("\n");
    }
    mMappingWriter.write("\n\n");
    mMappingWriter.write("res id mapping:\n");
    mMappingWriter.flush();
  }

  public static ResPackage[] decode(InputStream arscStream, ApkDecoder apkDecoder) throws AndrolibException {
    try {
      ARSCDecoder decoder = new ARSCDecoder(arscStream, apkDecoder);
      ResPackage[] pkgs = decoder.readTable();
      return pkgs;
    } catch (IOException ex) {
      throw new AndrolibException("Could not decode arsc file", ex);
    }
  }

  private void nextChunkCheckType(int expectedType) throws IOException, AndrolibException {
    nextChunk();
    checkChunkType(expectedType);
  }

  private Header nextChunk() throws IOException {
    return mHeader = Header.read(mIn);
  }  

  private void checkChunkType(int expectedType) throws AndrolibException {
    if (mHeader.type != expectedType) {
      throw new AndrolibException(String.format("Invalid chunk type: expected=0x%08x, got=0x%08x",
         expectedType,
         mHeader.type
      ));
    }
  }

  public static Header read(ExtDataInput in) throws IOException {
      short type;
      try {
        type = in.readShort();
        short count = in.readShort();
        int size = in.readInt();
        return new Header(type, size);
      } catch (EOFException ex) {
        return new Header(TYPE_NONE, 0);
      }
    }

  private ResPackage[] readTable() throws IOException, AndrolibException {
    // ResTable_header
    nextChunkCheckType(Header.TYPE_TABLE); // ResChunk_header
    int packageCount = mIn.readInt();

    // 全局字符串池
    mTableStrings = StringBlock.read(mIn);

    // 若干个Package
    ResPackage[] packages = new ResPackage[packageCount];
    nextChunk();
    for (int i = 0; i < packageCount; i++) {
      packages[i] = readPackage();
    }

    // 其他的收尾工作
    mMappingWriter.close();
    System.out.printf("resources mapping file %s done\n", mApkDecoder.getResMappingFile().getAbsolutePath());
    generalFilterEnd(mMergeDuplicatedResCount, mMergeDuplicatedResTotalSize);
    mMergeDuplicatedResMappingWriter.close();
    System.out.printf("resources filter mapping file %s done\n", mApkDecoder.getMergeDuplicatedResMappingFile().getAbsolutePath());
    return packages;
  }

  public static StringBlock read(ExtDataInput reader) throws IOException {
    reader.skipCheckChunkTypeInt(CHUNK_STRINGPOOL_TYPE, CHUNK_NULL_TYPE);
    // 整个字符串池的大小数
    int chunkSize = reader.readInt();
    // 字符串资源的数量
    int stringCount = reader.readInt();
    // 样式资源的数量
    int styleCount = reader.readInt();
    // flags
    int flags = reader.readInt();
    // 相对于整个chunk，字符串资源的起始位置
    int stringsOffset = reader.readInt();
    // 相对于整个chunk，样式资源的起始位置
    int stylesOffset = reader.readInt();

    StringBlock block = new StringBlock();
    block.m_isUTF8 = (flags & UTF8_FLAG) != 0;
    // string offsets
    block.m_stringOffsets = reader.readIntArray(stringCount);
    block.m_stringOwns = new int[stringCount];
    Arrays.fill(block.m_stringOwns, -1);

    if (styleCount != 0) {
      // styles offsets
      block.m_styleOffsets = reader.readIntArray(styleCount);
    }
    {
      // chunkSize表示的是整个字符串池的大小
      // stylesOffset为0时，用整个字符串池大小 减去 stringsOffset，得到了strings值的byte数
      // stylesOffset不为0时，由于styles值排在strings值的后面，两者相减就得到了strings值的byte数
      int size = ((stylesOffset == 0) ? chunkSize : stylesOffset) - stringsOffset;

      if ((size % 4) != 0) {
        throw new IOException("String data size is not multiple of 4 (" + size + ").");
      }
      block.m_strings = new byte[size];

      // strings
      reader.readFully(block.m_strings);
    }
    if (stylesOffset != 0) {
      int size = (chunkSize - stylesOffset);
      if ((size % 4) != 0) {
        throw new IOException("Style data size is not multiple of 4 (" + size + ").");
      }
      // styles
      block.m_styles = reader.readIntArray(size / 4);
    }
    return block;
  }

  private ResPackage readPackage() throws IOException, AndrolibException {
    checkChunkType(Header.TYPE_PACKAGE);
    // package的id，常见的就是系统的0x01以及自己的0x7f
    int id = (byte) mIn.readInt();
    // 包名
    String name = mIn.readNullEndedString(128, true);
    System.out.printf("reading packagename %s\n", name);

    /* typeNameStrings */
    mIn.skipInt();
    /* typeNameCount */
    mIn.skipInt();
    /* specNameStrings */
    mIn.skipInt();
    /* specNameCount */
    mIn.skipInt();
    mCurrTypeID = -1;
    // 类型 字符串池
    mTypeNames = StringBlock.read(mIn);
    // 项名称 字符串池
    mSpecNames = StringBlock.read(mIn);
    // 拼接包的id，后面还会拼接type的id，资源的id，这样就构成了0x7f 01 0000
    mResId = id << 24;

    // 保存包id，包名
    mPkg = new ResPackage(id, name);
    // 系统包名不混淆
    if (mPkg.getName().equals("android")) {
      mPkg.setCanResguard(false);
    } else {
      mPkg.setCanResguard(true);
    }
    // 读取下一个chunk
    nextChunk();
    // 判断下一个chunk是不是library，循环读取这个类型
    while (mHeader.type == Header.TYPE_LIBRARY) {
      readLibraryType();
    }
    // 判断是不是ResTable_typeSpec类型，如果是则循环读取
    while (mHeader.type == Header.TYPE_SPEC_TYPE) {
      readTableTypeSpec();
    }
    return mPkg;
  }

  private void readTableTypeSpec() throws AndrolibException, IOException {
    checkChunkType(Header.TYPE_SPEC_TYPE);
    // 读取类型id
    byte id = mIn.readByte();
    // 略过 1byte + 2byte 的保留位
    mIn.skipBytes(3);
    // 读取configuration数量的个数
    int entryCount = mIn.readInt();
    // mTypeNames.getString(id - 1)意思就是将类型id这个byte值在资源类型字符串池中解析成string类型
    // 比如这个id是01，在字符串池中解析出来就是anim
    mType = new ResType(mTypeNames.getString(id - 1), mPkg);
    if (DEBUG) {
      System.out.printf("[ReadTableType] type (%s) id: (%d) curr (%d)\n", mType, id, mCurrTypeID);
    }
    // first meet a type of resource
    if (mCurrTypeID != id) {
      mCurrTypeID = id;
      // 初始化短路径名生成器，会根据包名、资源类型名取出所有匹配的白名单项，生成短路径时排除这些与白名单项匹配的项
      initResGuardBuild(mCurrTypeID);
    }
    // 是否混淆文件路径：string、id、array这类资源不混淆
    mShouldResguardForType = isToResguardFile(mTypeNames.getString(id - 1));

    // 对，这里是用来描述差异性的！！！
    // 略过configMask
    mIn.skipBytes(entryCount * 4);
    // 将type id拼接到mResId上，在遍历具体资源时使用
    mResId = (0xff000000 & mResId) | id << 16;

    // 开始读取ResTable_type数组
    while (nextChunk().type == Header.TYPE_TYPE) {
      readConfig();
    }
  }

  private void readConfig() throws IOException, AndrolibException {
    checkChunkType(Header.TYPE_TYPE);
    /* typeId */
    // 值同上面的ResTable_typeSpec，可以略过
    // 这里注意一下，id(1byte) + res0(1byte) + res1(2byte) = 4byte，此处直接略过了三个字段
    mIn.skipInt();
    // 资源的数量
    int entryCount = mIn.readInt();
    // 资源偏移量
    int entriesStart = mIn.readInt();
    // 读取ResTable_config，此处只读了，没有保存任何数据，所以不进行分析
    // ResTable_config保存的是这些entry的限定符集合，里面的实现还是可以帮我们加深对于这个结构的了解的
    readConfigFlags();
    // entryCount个entry的偏移量，此处如果资源限定符为default也就是没有的话，offsets每一项都很均匀，都差0x10h，也就是16位，因为entry与value各占8位
    // 如果有限定符的话，entryCount与没有限定符的大小一样，但是资源个数肯定相对于default是有少一些的
    // 因此offset数组对于没有的资源，会全部置为0xFFFFFFFF，对于有的资源，会从0x00开始排布
    int[] entryOffsets = mIn.readIntArray(entryCount);
    for (int i = 0; i < entryOffsets.length; i++) {
      mCurEntryID = i;
      // 如果资源确实存在，即不为0xFFFFFFFF，则进行读取entry与value的对
      if (entryOffsets[i] != -1) {
        mResId = (mResId & 0xffff0000) | i;
        readEntry();
      }
    }
  }

  private void readEntry() throws IOException, AndrolibException {
    // size
    mIn.skipBytes(2);
    // entry的flag，代表是不是complex类型的
    short flags = mIn.readShort();
    // entry name在资源项名称字符串池中的索引
    int specNamesId = mIn.readInt();

    if (mPkg.isCanResguard()) {
      // 混淆过或者已经添加到白名单的都不需要再处理了
      if (!mResguardBuilder.isReplaced(mCurEntryID) && !mResguardBuilder.isInWhiteList(mCurEntryID)) {
        Configuration config = mApkDecoder.getConfig();
        boolean isWhiteList = false;
        if (config.mUseWhiteList) {
          // 处理白名单
          isWhiteList = dealWithWhiteList(specNamesId, config);
        }

        if (!isWhiteList) {
          // 如果不在白名单里面，则进行保存混淆前后的一些变量，重写文件时真正写入混淆后的变量
          dealWithNonWhiteList(specNamesId, config);
        }
      }
    }

    // 是不是复杂类型
    if ((flags & ENTRY_FLAG_COMPLEX) == 0) {
      readValue(true, specNamesId);
    } else {
      // 复杂类型里面根据struct里面count字段，有多个Res_value struct
      readComplexEntry(false, specNamesId);
    }
  }

  /**
   * deal with whitelist
   *
   * @param specNamesId resource spec name id
   * @param config      {@Configuration} AndResGuard configuration
   * @return isWhiteList whether this resource is processed by whitelist
   */
  private boolean dealWithWhiteList(int specNamesId, Configuration config) throws AndrolibException {
    String packName = mPkg.getName();
    // 白名单在初始化时都会拼接上包名
    if (config.mWhiteList.containsKey(packName)) {
      HashMap<String, HashSet<Pattern>> typeMaps = config.mWhiteList.get(packName);
      String typeName = mType.getName();
      if (typeMaps.containsKey(typeName)) {
        String specName = mSpecNames.get(specNamesId).toString();
        // 根据资源类型取出该类型下的所有白名单
        HashSet<Pattern> patterns = typeMaps.get(typeName);
        for (Iterator<Pattern> it = patterns.iterator(); it.hasNext(); ) {
          Pattern p = it.next();
          // 逐个开始匹配资源项
          if (p.matcher(specName).matches()) {
            if (DEBUG) {
              System.out.printf("[match] matcher %s ,typeName %s, specName :%s\n", p.pattern(), typeName, specName);
            }
            // 0x7f010000 abc_fade_in
            mPkg.putSpecNamesReplace(mResId, specName);
            // abc_fade_in abc_fade_in
            mPkg.putSpecNamesblock(specName, specName);
            mResguardBuilder.setInWhiteList(mCurEntryID);

            // abc_fade_in
            mType.putSpecResguardName(specName);
            return true;
          }
        }
      }
    }
    return false;
  }

  private void dealWithNonWhiteList(int specNamesId, Configuration config) throws AndrolibException, IOException {
    String replaceString = null;
    boolean keepMapping = false;
    ...
    if (!keepMapping) {
      replaceString = mResguardBuilder.getReplaceString();
    }

    // 保存处理过的id
    mResguardBuilder.setInReplaceList(mCurEntryID);
    if (replaceString == null) {
      throw new AndrolibException("readEntry replaceString == null");
    }
    // 写入resource_mapping文件
    generalResIDMapping(mPkg.getName(), mType.getName(), mSpecNames.get(specNamesId).toString(), replaceString);
    // 保存资源id与混淆后的名称：0x7f010000 a
    mPkg.putSpecNamesReplace(mResId, replaceString);
    // 是否需要将name列混淆成固定名字, 这样可以减少string pool大小
    boolean useFixedName = config.mFixedResName != null && config.mFixedResName.length() > 0;
    String fixedName = useFixedName ? config.mFixedResName : replaceString;
    // fixedName a
    mPkg.putSpecNamesblock(fixedName, replaceString);
    // a
    mType.putSpecResguardName(replaceString);
  }

  private void generalResIDMapping(
     String packageName, String typename, String specName, String replace) throws IOException {
    mMappingWriter.write("    "
       + packageName
       + ".R."
       + typename
       + "."
       + specName
       + " -> "
       + packageName
       + ".R."
       + typename
       + "."
       + replace);
    mMappingWriter.write("\n");
    mMappingWriter.flush();
  }