dex解析

先学习dex文件格式，如图所示(图片来源于网络)：

思路：

1.apk文件应用名称写死，修改为dex.zip，保存在固定的目录下，download目录下，使用函数获取路径

2.使用java中的zip类来实现dex.zip文件的解压，得到dex文件数据，并保存在内存中，java解析zip方法参考源码注释。

3.通过点击floatbutton加载classes.dex文件即可

   4.进行解析

       4.1先设计每个结构体都封装一个java bean类，每个类中有响应的字段解析方法，

       4.2再在界面显示

--------------------------------

思路简化：

   1.直接将classes.dex文件复制到download目录下

   2.读取文件内容保存到byte数组中

   3.通过点击floatbutton加载classes.dex文件即可

   4.进行解析

     4.1先设计每个结构体都封装一个java bean类，每个类中有响应的字段解析方法，

     4.2再在界面显示

--------------------------------

目的在于熟悉dex文件格式，所以没有实现复杂文件操作，直接写死的路径，通过直接在程序初始化时初始化对象，所以需要将dex文件复制到downloa目录下，且命名为classes.dex，否则程序直接退出。其中使用了android文件相关操作，一些路径的标准写法

Environment.getDataDirectory()= /data

Environment.getDownloadCacheDirectory()= /cache

Environment.getExternalStorageDirectory()= /mnt/sdcard

Environment.getRootDirectory()= /system

context.getCacheDir()= /data/data/com.mt.mtpp/cache

context.getExternalCacheDir()= /mnt/sdcard/Android/data/com.mt.mtpp/cache

context.getFilesDir()= /data/data/com.mt.mtpp/files

实现功能如图所示(部分截图)：

1.解析dexHeader

////    public dexHeader()throws IOException{        //1.获取文件路径，        String dexPath = GetDexFilePath();        //2.获取zip文件中的classes.dex,并读取字节        //2.打开dex文件，并读取头部数据到byte中        List<Byte> byteList = new ArrayList<Byte>();        byteList = getDexHeard(dexPath);        //3.需要判断魔数是否为合法dex文件64 65 78        if (!(byteList.get(0) == 0x64                && byteList.get(1) == 0x65                && byteList.get(2) == 0x78)){            IOException e = null;            throw e;        }        //4.将缓冲区内容按格式分别存储到对应的结构（javabean）对象中        //解析dex_header并保存各节的数据到对应的javabean对象中        ParseDexHeader(byteList);    }

 public String GetDexFilePath() {        String path = null;        //获取安卓download文件下的dex.zip文件路径        File inRoot = Environment.getExternalStorageDirectory();        path = inRoot.getPath() + "/"                + Environment.DIRECTORY_DOWNLOADS + "/classes.dex";        return path;    }    private List<Byte> getDexHeard(String dexPath) throws IOException{        File dexfile = new File(dexPath);        InputStream in = null;        List<Byte> bytelist = new ArrayList<Byte>();        // 一次读一个字节        in = new FileInputStream(dexfile);        int tempbyte;        //dex头大小为0x70        int count = 0x70;        while (count != 0) {            tempbyte = in.read();            bytelist.add((byte) tempbyte);            count--;        }        in.close();        return bytelist;    }

2.解析dexString

public dexString(dexHeader dexheader){        //从头部获取偏移和大小        this.byteStrSize = dexheader.stringsize;        this.byteStrOff = dexheader.stringoff;        //转换成int型        byte[] tempSize = new byte[4];        byte[] tempOff = new byte[4];        tempSize = bytereverse(byteStrSize);        tempOff = bytereverse(byteStrOff);        int intStrSize = byte2int(tempSize);        //偏移        int intStrOff = byte2int(tempOff);        //保存偏移值到stringID中        for (int i = 0; i < intStrSize; i++){            stringOffList.add(intStrOff);            intStrOff += 4;        }        try {            StringID strid = new StringID();            strIntsize = strid.getStrDataList();            strStringValue = strid.getStrStringList();            setStrIntsize(strIntsize);            setStrStringValue(strStringValue);        } catch (IOException e) {            System.out.println("解析String出错!");            e.printStackTrace();        }    }

3.解析dexType

 public dexType(dexHeader dexheader, dexString dexstring) throws IOException {        //从头部对象中获取type的大小和偏移        this.typeSize = dexheader.typesize;        this.typeOff = dexheader.typeoff;        //将获取的大小和偏移转化成int型        byte[] tempSize = new byte[4];        byte[] tempOff = new byte[4];        tempSize = bytereverse(typeSize);        tempOff = bytereverse(typeOff);        int intTypeSize = byte2int(tempSize);        //偏移,        int intTypeOff = byte2int(tempOff);        //保存到typeOffList中        //这个偏移里面保存了字符串表中的索引        for (int i = 0; i < intTypeSize; i++){            typeOffList.add(intTypeOff);            intTypeOff += 4;        }        //读文件取出索引值        for (int i = 0; i < typeOffList.size(); i++){            byte[] tmp = new byte[4];            int off = typeOffList.get(i);            List<Byte> tByte = readDexString(GetDexFilePath(), off);            //将byte转成int            tmp[0] = tByte.get(0);            tmp[1] = tByte.get(1);            tmp[2] = tByte.get(2);            tmp[3] = tByte.get(3);            tmp = bytereverse(tmp);            int StrIndex = byte2int(tmp);            //保存index值用于显示            intindex.add(StrIndex);            //在通过索引值在字符串表中找到对应字符串            String strRes = dexstring.getStrStringValue().get(StrIndex);            typeStringList.add(strRes);        }        setIntindex(intindex);        setTypeStringList(typeStringList);    }

4.解析dexProto

//构造方法    public dexProto(dexHeader dexheader, dexString dexstring, dexType dextype) throws IOException {        //dexheader获得偏移        //4字节短类型保存在dexString表中        //4字节返回值类型保存在dexType表中        //4字节参数偏移，找到参数的数量和索引            //参数数量，该原型有几个参数            //参数类型索引，通过类型索引在type表中找到类型值        //从头部对象中获取type的大小和偏移        this.protoSize = dexheader.protosize;        this.protoOff = dexheader.protooff;        //将获取的大小和偏移转化成int型        byte[] tempSize = new byte[4];        byte[] tempOff = new byte[4];        tempSize = bytereverse(protoSize);        tempOff = bytereverse(protoOff);        int intProtoSize = byte2int(tempSize);        //偏移,        int intProtoOff = byte2int(tempOff);        //保存到typeOffList中        //这个偏移里面保存了字符串表中的索引        for (int i = 0; i < intProtoSize; i++){            protoOffList.add(intProtoOff);            intProtoOff += 12;        }        //分别计算不同字段的偏移        for (int i = 0; i < protoOffList.size(); i++){            int off = protoOffList.get(i);            List<Byte> tByte = readDexString(GetDexFilePath(), off);            //将byte转成int            byte[] protoShort = new byte[4];            protoShort[0] = tByte.get(0);            protoShort[1] = tByte.get(1);            protoShort[2] = tByte.get(2);            protoShort[3] = tByte.get(3);            protoShort = bytereverse(protoShort);            int shortidx = byte2int(protoShort);            protoShortList.add(shortidx);            byte[] protoReturn = new byte[4];            protoReturn[0] = tByte.get(4);            protoReturn[1] = tByte.get(5);            protoReturn[2] = tByte.get(6);            protoReturn[3] = tByte.get(7);            protoReturn = bytereverse(protoReturn);            int Returnidx = byte2int(protoReturn);            protoReturnList.add(Returnidx);            byte[] protoParam = new byte[4];            protoParam[0] = tByte.get(8);            protoParam[1] = tByte.get(9);            protoParam[2] = tByte.get(10);            protoParam[3] = tByte.get(11);            protoParam = bytereverse(protoParam);            int Paramoff = byte2int(protoParam);            protoParamList.add(Paramoff);        }        //读文件分别获取不同字段的值        //获取短类型在dexString中的索引        //读文件取出短类型索引值        for (int i = 0; i < protoShortList.size(); i++){            int value = protoShortList.get(i);            //在通过索引值在字符串表中找到对应字符串            String strRes = dexstring.getStrStringValue().get(value);            protoShortStringList.add(strRes);        }        //读文件取出返回值索引值        for (int i = 0; i < protoReturnList.size(); i++){            int value = protoReturnList.get(i);            //在通过索引值在type表中找到对应字符串            String strRes = dextype.getTypeStringList().get(value);            protoReturnStringList.add(strRes);        }        //读文件取出参数偏移        for (int i = 0; i < protoParamList.size(); i++){            byte[] tmp = new byte[4];            int off = protoParamList.get(i);            List<Byte> tByte = new ArrayList<Byte>();            if (off == 0){                ParamNumList.add(0);                parambyteList.add(tByte);                continue;            }            tByte = readDexString2(GetDexFilePath(), off);            //将byte转成int            tmp[0] = tByte.get(0);            tmp[1] = tByte.get(1);            tmp[2] = tByte.get(2);            tmp[3] = tByte.get(3);            tmp = bytereverse(tmp);            int paramnum = byte2int(tmp);            //在通过索引值读文件在文件偏移处找到对应参数个数,参数索引            //参数个数list            ParamNumList.add(paramnum);            //保存参数list            //保存参数的字节，然后再更具参数个数进行解析            //需要偏移4个字节后开始读，字节数 = 索引2字节 * 个数（paramnum的值）            tByte = readDexString3(GetDexFilePath(), off + 4, paramnum);            parambyteList.add(tByte);        }        //再根据参数个数的list来解析参数的值        for (int i = 0; i < ParamNumList.size(); i++){            if (ParamNumList.get(i) == 1){                //直接保存参数索引                byte[] tmp2 = new byte[2];                tmp2[0] = parambyteList.get(i).get(0);                tmp2[1] = parambyteList.get(i).get(1);                tmp2 = bytereverse2(tmp2);                int paramidx = byte2int_2(tmp2);                String paramString = dextype.getTypeStringList().get(paramidx);                paramStringList.add(paramString);            }            else if (ParamNumList.get(i) == 0)            {                paramStringList.add("void");            }            else            {                //参数总字节数/参数个数 = 需要分解的参数个数                int count = (parambyteList.get(i).size())/(ParamNumList.get(i));                String paramString2 = "";                while(count != 0){                    //一次读2个字节，保存参数索引                    byte[] tmp2 = new byte[2];                    tmp2[0] = parambyteList.get(i).get(0);                    tmp2[1] = parambyteList.get(i).get(1);                    tmp2 = bytereverse2(tmp2);                    int paramidx = byte2int_2(tmp2);                    paramString2 = paramString2 + dextype.getTypeStringList().get(paramidx);                    count--;                }                paramStringList.add(paramString2);            }        }    }

5.解析dexField

//构造函数中获取field的偏移和大小    public dexField(dexHeader dexheader, dexString dexstring, dexType dextype) throws IOException {        //从头部对象中获取type的大小和偏移        this.fieldSize = dexheader.fieldsize;        this.fieldOff = dexheader.fieldoff;        //将获取的大小和偏移转化成int型        byte[] tempSize = new byte[4];        byte[] tempOff = new byte[4];        tempSize = bytereverse(fieldSize);        tempOff = bytereverse(fieldOff);        int intFiledSize = byte2int(tempSize);        //偏移,        int intFieldOff = byte2int(tempOff);        //保存到typeOffList中        //这个偏移里面保存了字符串表中的索引        for (int i = 0; i < intFiledSize; i++){            FieldOffList.add(intFieldOff);            intFieldOff += 8;        }        //根据偏移读取对应字段的值        for (int i = 0; i < FieldOffList.size(); i++){            int off = FieldOffList.get(i);            List<Byte> tByte = readDexString(GetDexFilePath(), off);            //将byte转成int            //保存classid的索引            byte[] classid = new byte[2];            classid[0] = tByte.get(0);            classid[1] = tByte.get(1);            classid = bytereverse2(classid);            int classindex = byte2int_2(classid);            FieldclassidList.add(classindex);            //保存typeid的索引            byte[] typeid = new byte[2];            typeid[0] = tByte.get(2);            typeid[1] = tByte.get(3);            typeid = bytereverse2(typeid);            int typeidindex = byte2int_2(typeid);            FieldtypeidList.add(typeidindex);            //保存nameid的索引            byte[] nameid = new byte[4];            nameid[0] = tByte.get(4);            nameid[1] = tByte.get(5);            nameid[2] = tByte.get(6);            nameid[3] = tByte.get(7);            nameid = bytereverse(nameid);            int nameindex = byte2int(nameid);            FieldnameidList.add(nameindex);        }        //根据索引获取classid字符串        for (int i = 0; i < FieldclassidList.size(); i++){            String classStr = dextype.getTypeStringList().get(FieldclassidList.get(i));            FiledClassStrList.add(classStr);        }        //根据索引获取typeid字符串        for (int i = 0; i < FieldtypeidList.size(); i++){            String typeStr = dextype.getTypeStringList().get(FieldtypeidList.get(i));            FiledTypeStrList.add(typeStr);        }        //根据索引获取nameid字符串        for (int i = 0; i < FieldnameidList.size(); i++){            String nameStr = dexstring.getStrStringValue().get(FieldnameidList.get(i));            FiledNameStrList.add(nameStr);        }    }

6.解析dexMethod

 //构造函数中获取field的偏移和大小    public dexMethod(dexHeader dexheader, dexString dexstring,                     dexType dextype, dexProto dexproto) throws IOException {        //从头部对象中获取method的大小和偏移        this.methodSize = dexheader.methodsize;        this.methodOff = dexheader.methodoff;        //将获取的大小和偏移转化成int型        byte[] tempSize = new byte[4];        byte[] tempOff = new byte[4];        tempSize = bytereverse(methodSize);        tempOff = bytereverse(methodOff);        int intMethodSize = byte2int(tempSize);        //偏移,        int intMethodOff = byte2int(tempOff);        //保存到methodOffList中        //这个偏移里面保存了字符串表中的索引        for (int i = 0; i < intMethodSize; i++){            MethodOffList.add(intMethodOff);            intMethodOff += 8;        }        //根据偏移读取对应字段的值        for (int i = 0; i < MethodOffList.size(); i++){            int off = MethodOffList.get(i);            List<Byte> tByte = readDexString(GetDexFilePath(), off);            //将byte转成int            //保存classid的索引            byte[] classid = new byte[2];            classid[0] = tByte.get(0);            classid[1] = tByte.get(1);            classid = bytereverse2(classid);            int classindex = byte2int_2(classid);            MethodclassidList.add(classindex);            //保存typeid的索引            byte[] protoid = new byte[2];            protoid[0] = tByte.get(2);            protoid[1] = tByte.get(3);            protoid = bytereverse2(protoid);            int protoidindex = byte2int_2(protoid);            MethodprotoidList.add(protoidindex);            //保存nameid的索引            byte[] nameid = new byte[4];            nameid[0] = tByte.get(4);            nameid[1] = tByte.get(5);            nameid[2] = tByte.get(6);            nameid[3] = tByte.get(7);            nameid = bytereverse(nameid);            int nameindex = byte2int(nameid);            MethodnameidList.add(nameindex);        }        //根据索引获取classid字符串        for (int i = 0; i < MethodclassidList.size(); i++){            String classStr = dextype.getTypeStringList().get(MethodclassidList.get(i));            MethodClassStrList.add(classStr);        }        //根据索引获取protoid字符串        for (int i = 0; i < MethodprotoidList.size(); i++){            //保存参数            String protoStr = dexproto.getParamStringList().get(MethodprotoidList.get(i));            MethodprotoStrList.add(protoStr);            //保存返回值            String protoreturnStr = dexproto.getProtoReturnStringList().get(MethodprotoidList.get(i));            MethodprotoReturnStrList.add(protoreturnStr);        }        //根据索引获取nameid字符串        for (int i = 0; i < MethodnameidList.size(); i++){            String nameStr = dexstring.getStrStringValue().get(MethodnameidList.get(i));            MethodNameStrList.add(nameStr);        }    }

7.解析dexClass，未实现完整，给出类型转换函数的实现

//转换uleb128转uint    // 解码uleb    int byteindex = 0;    public int decodeUleb128(byte[] byteAry) {        int index = 0, cur;        int result = byteAry[index];        index++;        if (result > 0x7f) { // 判断第一个字节是否大于 0x7f            cur = byteAry[index]; // 读取第二个字节            result = (result & 0x7f) | ((cur & 0x7f) << 7); //前两个字节合并            index++;            if (cur > 0x7f) {//判断第二个字节是否大于0x7f                cur = byteAry[index];//读取第三个字节                result |= (cur & 0x7f)  << 14;                index++;                if (cur > 0x7f) {//判断第三个字节是否大于0x7f                    cur = byteAry[index];//读取第四个字节                    result |= (cur & 0x7f)  << 21;                    index++;                    if (cur > 0x7f) {//判断第四个字节是否大于0x7f                        cur = byteAry[index];//读取第五个字节                        result |= cur  << 28;                    }                }            }        }        this.byteindex = index;        return result;    }

有更好的实现方式可以交流学习。