Android apk反編譯及AS代碼混淆方法

Android apk反編譯及AS代碼混淆方法

反編譯工具下載下傳位址：http://download.csdn.net/download/shenyuanqing/9187933

一.反編譯

1.用壓縮包管理軟體（如WinRAR、WinZIP等）解壓apk得到classes.dex檔案，把該檔案放到dex2jar檔案夾裡。

2.用dex2jar工具軟體得到相應的jar檔案。

（1）打開指令行界面。

（2）定位到dex2jar.bat所在目錄。

（3）輸入指令dex2jar.bat classes.dex即可生成jar檔案（classes_dex2jar.jar）。

3.用jd-gui工具軟體打開jar檔案，就可檢視源碼。

(1)File/Open File

真是一覽無餘啊，安全工作刻不容緩。

二.混淆

1.app/build.gradle/buildTypes把minifyEnabled從false改成ture來啟動Proguard混淆功能（AS1.2）。

buildTypes {
        release {
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }
    }
           

2.在proguard-rules.pro檔案中配置混淆規則（根據自己項目情況）。

# Add project specific ProGuard rules here.
# By default, the flags in this file are appended to flags specified
# in /Users/zhouping/Documents/code/android-sdk-macosx/tools/proguard/proguard-android.txt
# You can edit the include path and order by changing the proguardFiles
# directive in build.gradle.
#
# For more details, see
#   http://developer.android.com/guide/developing/tools/proguard.html

# Add any project specific keep options here:

# If your project uses WebView with JS, uncomment the following
# and specify the fully qualified class name to the JavaScript interface
# class:
#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
#   public *;
#}
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.support.v4.app.FragmentActivity
-keep public class * extends android.support.v4.app.Fragment
-keep class * extends java.lang.annotation.Annotation { *; }
#-keep class com.lidroid.xutils.** {*;}
-keep class cn.lkhealth.epos.pub.common.SerialPort {*;}
##---------------Begin: proguard configuration for Gson  ----------
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature

# Gson specific classes
-keep class sun.misc.Unsafe { *; }
-keep class com.google.gson.stream.** { *; }
-keep class com.google.gson.examples.android.model.** { *; }
-keep class com.google.gson.** { *;}

# Application classes that will be serialized/deserialized over Gson
-keep class cn.lkhealth.epos.about.bean.**{ *; }
-keep class cn.lkhealth.epos.cashier.bean.**{ *; }
-keep class cn.lkhealth.epos.order.bean.**{ *; }
-keep class cn.lkhealth.epos.pub.bean.**{ *; }
##---------------End: proguard configuration for Gson  ----------
           

3.混淆後效果如下圖：

可以看到變量、方法名等都由字母來代替了，雖然代碼結構沒有變，但至少增加了破解的難度了。