Proguard 源码分析 （7） 混淆

Proguard 源码分析 （七） 混淆

本章我们讲Proguard非常重要的一个步骤:混淆Obfuscator

混淆的目的很明显,是为了混淆语义。

我们能轻车熟路的找到混淆的源头:

Obfuscator 的execute方法

我们来看一下就行混淆器给我们设置了怎样的访问者:

ClassVisitor memberInfoLinker =
??????????? configuration.useUniqueClassMemberNames ?
??????????????? (ClassVisitor)new AllMemberVisitor(new MethodLinker()) :
??????????????? (ClassVisitor)new BottomClassFilter(new MethodLinker());

我们直接跟到最终的访问者,也就是MethodLinker

?

public void visitAnyClass(Clazz clazz)
??? {
??????? // Collect all non-private members in this class hierarchy.
??????? clazz.hierarchyAccept(true, true, true, false,
??????????? new AllMethodVisitor(
??????????? new MemberAccessFilter(0, ClassConstants.INTERNAL_ACC_PRIVATE | ClassConstants.INTERNAL_ACC_STATIC,
??????????? this)));

??????? // Clean up for the next class hierarchy.
??????? memberMap.clear();
??? }

它的意思是说将自己作为AllMethodVisitor 所有方法中,MemberAccessFilter可接受的访问权限的访问者,

既然它的目的很明显是为了处理方法,我们直接跟到相关的调用:

public void visitAnyMember(Clazz clazz, Member member)
??? {
??????? String name?????? = member.getName(clazz);
??????? String descriptor = member.getDescriptor(clazz);
??????? if (name.equals(ClassConstants.INTERNAL_METHOD_NAME_CLINIT) ||
??????????? name.equals(ClassConstants.INTERNAL_METHOD_NAME_INIT))
??????? {
??????????? return;
??????? }
??????? String key = name + ' ' + descriptor;
??????? Member otherMember = (Member)memberMap.get(key);

??????? if (otherMember == null)
??????? {
??????????? Member thisLastMember = lastMember(member);
??????????? memberMap.put(key, thisLastMember);
??????? } else {
??????????? link(member, otherMember);
??????? }
??? }

我们看到刚开始它会先取得方法的名称和签名,对于cinit 和init不做处理，注释便是最好的源码解析:

// Special cases: <clinit> and <init> are always kept unchanged.
??????? // We can ignore them here.

之后将通过签名来找到享元池中的方法Member otherMember = (Member)memberMap.get(key);

if (otherMember == null)
??????? {
??????????? // Get the last method in the chain.
??????????? Member thisLastMember = lastMember(member);

??????????? // Store the new class method in the map.
??????????? memberMap.put(key, thisLastMember);
??????? }
??????? else
??????? {
??????????? // Link both members.
??????????? link(member, otherMember);
??????? }

如果没有这个方法,便加入到享元池中,但是之前调用了lastMember

我们来看一下lastMember 方法:

?public static Member lastMember(Member member)
??? {
??????? Member lastMember = member;
??????? while (lastMember.getVisitorInfo() != null &&
?????????????? lastMember.getVisitorInfo() instanceof Member)
??????? {
??????????? lastMember = (Member)lastMember.getVisitorInfo();
??????? }

??????? return lastMember;
??? }

也就是说如果它的visitor信息里面如果存在,则直接返回上一个的方法,这种写法很类似于职责链模式，但我只是猜测,只是有职责链的感觉,我们继续往下看,如果方法已经存在了呢？~

我们回到clazz.hierarchyAccept 的参数:

?public void hierarchyAccept(boolean????? visitThisClass, //true
??????????????????????????????? boolean????? visitSuperClass, //true
??????????????????????????????? boolean????? visitInterfaces, //true
??????????????????????????????? boolean????? visitSubclasses,//false
??????????????????????????????? ClassVisitor classVisitor);

这里面很可能存在一个方法visitThisClass,visitSuperClass,visitInterfaces都存在的情况

所以link(member, otherMember); 的目的就是为了合并到一个共同的职责链源头

?

好的我们继续混淆的过程:

NameMarker nameMarker = new NameMarker();
??????? ClassPoolVisitor classPoolvisitor =
??????????? ClassSpecificationVisitorFactory.createClassPoolVisitor(configuration.keep,
??????????????????????????????????????????????????????????????????? nameMarker,
??????????????????????????????????????????????????????????????????? nameMarker,
??????????????????????????????????????????????????????????????????? false,
??????????????????????????????????????????????????????????????????? false,
??????????????????????????????????????????????????????????????????? true);

前文好几次提到了ClassSpecificationVisitorFactory.createClassPoolVisitor 这个方法,我们不做深究我们直接看NameMarker

?

public void visitProgramClass(ProgramClass programClass)
??? {
??????? keepClassName(programClass);

??????? // Make sure any outer class names are kept as well.
??????? programClass.attributesAccept(this);
??? }

public void keepClassName(Clazz clazz)
??? {
??????? ClassObfuscator.setNewClassName(clazz,
??????????????????????????????????????? clazz.getName());
??? }

?static void setNewClassName(Clazz clazz, String name)
??? {
??????? clazz.setVisitorInfo(name);
??? }

可见:keepClassName 的目的就是为了往VisitorInfo 设置name 标签

public void visitAnyAttribute(Clazz clazz, Attribute attribute) {}

说明它对属性并没有任何的访问操作:

接着由于库文件没有必要混淆,所以要将库文件保持签名

?libraryClassPool.classesAccept(nameMarker);
??????? libraryClassPool.classesAccept(new AllMemberVisitor(nameMarker));

?

接着:

?// Mark attributes that have to be kept.
??????? AttributeVisitor attributeUsageMarker =
??????????? new NonEmptyAttributeFilter(
??????????? new AttributeUsageMarker());

??????? AttributeVisitor optionalAttributeUsageMarker =
??????????? configuration.keepAttributes == null ? null :
??????????????? new AttributeNameFilter(new ListParser(new NameParser()).parse(configuration.keepAttributes),
??????????????????????????????????????? attributeUsageMarker);

??????? programClassPool.classesAccept(
??????????? new AllAttributeVisitor(true,
??????????? new RequiredAttributeFilter(attributeUsageMarker,
??????????????????????????????????????? optionalAttributeUsageMarker)));

这是对class的属性做标记,接着我们省略掉无关紧要的代码我们直接看混淆的主要访问者

?programClassPool.classesAccept(
??????????? new ClassObfuscator(programClassPool,
??????????????????????????????? classNameFactory,
??????????????????????????????? packageNameFactory,
??????????????????????????????? configuration.useMixedCaseClassNames,
??????????????????????????????? configuration.keepPackageNames,
??????????????????????????????? configuration.flattenPackageHierarchy,
??????????????????????????????? configuration.repackageClasses,
??????????????????????????????? configuration.allowAccessModification));

我们可以跟到对于混淆的名是通过:

String name??? = programClass.getName();
??????? String newName = ClassObfuscator.newClassName(programClass);

来生成的而ClassObfuscator.newClassName

实际上是放回访问者的访问标志,而这个标记值是通过ClassObfuscator的

?public void visitProgramClass(ProgramClass programClass)
??? {
??????? // Does this class still need a new name?
??????? newClassName = newClassName(programClass);
??????? if (newClassName == null)
??????? {
??????????? // Make sure the outer class has a name, if it exists. The name will
??????????? // be stored as the new class name, as a side effect, so we'll be
??????????? // able to use it as a prefix.
??????????? programClass.attributesAccept(this);

??????????? // Figure out a package prefix. The package prefix may actually be
??????????? // the an outer class prefix, if any, or it may be the fixed base
??????????? // package, if classes are to be repackaged.
??????????? String newPackagePrefix = newClassName != null ?
??????????????? newClassName + ClassConstants.INTERNAL_INNER_CLASS_SEPARATOR :
??????????????? newPackagePrefix(ClassUtil.internalPackagePrefix(programClass.getName()));

??????????? // Come up with a new class name, numeric or ordinary.
??????????? newClassName = newClassName != null && numericClassName ?
??????????????? generateUniqueNumericClassName(newPackagePrefix) :
??????????????? generateUniqueClassName(newPackagePrefix);

??????????? setNewClassName(programClass, newClassName);
??????? }
??? }

来设置的。而对于采用keep标记的那些值,在调用 newClassName(programClass);会放回keep访问者标记的值就不走if中的语句块,这样就达到了只针对非keep中的参数混淆的效果。我们来看一下它是如何给定名字的吧:

private String generateUniqueClassName(String newPackagePrefix)

?

?private String generateUniqueClassName(String????? newPackagePrefix,
?????????????????????????????????????????? NameFactory classNameFactory)
??? {
??????? // Come up with class names until we get an original one.
??????? String newClassName;
??????? String newMixedCaseClassName;
??????? do
??????? {
??????????? // Let the factory produce a class name.
??????????? newClassName = newPackagePrefix +
?????????????????????????? classNameFactory.nextName();
???????????
??????????? newMixedCaseClassName = mixedCaseClassName(newClassName);
??????? }
??????? while (classNamesToAvoid.contains(newMixedCaseClassName));

??????? // Explicitly make sure the name isn't used again if we have a
??????? // user-specified dictionary and we're not allowed to have mixed case
??????? // class names -- just to protect against problematic dictionaries.
??????? if (this.classNameFactory != null &&
??????????? !useMixedCaseClassNames)
??????? {
??????????? classNamesToAvoid.add(newMixedCaseClassName);
??????? }

??????? return newClassName;
??? }
??? {
??????? // Find the right name factory for this package.
??????? NameFactory classNameFactory =
??????????? (NameFactory)packagePrefixClassNameFactoryMap.get(newPackagePrefix);
??????? if (classNameFactory == null)
??????? {
??????????? // We haven't seen classes in this package before.
??????????? // Create a new name factory for them.
??????????? classNameFactory = new SimpleNameFactory(useMixedCaseClassNames);
??????????? if (this.classNameFactory != null)
??????????? {
??????????????? classNameFactory =
??????????????????? new DictionaryNameFactory(this.classNameFactory,
????????????????????????????????????????????? classNameFactory);
??????????? }

??????????? packagePrefixClassNameFactoryMap.put(newPackagePrefix,
???????????????????????????????????????????????? classNameFactory);
??????? }

??????? return generateUniqueClassName(newPackagePrefix, classNameFactory);
??? }

?

?可见,是通过调用工厂来生成下一个匹配的名字,而且每一个包对应一个工厂,Proguard中有很多的命名工厂类的实现,我们直接用默认的命名工厂类:SimpleNameFactory

?private String name(int index)
??? {
??????? // Which cache do we need?
??????? List cachedNames = generateMixedCaseNames ?
??????????? cachedMixedCaseNames :
??????????? cachedLowerCaseNames;

??????? // Do we have the name in the cache?
??????? if (index < cachedNames.size())
??????? {
??????????? return (String)cachedNames.get(index);
??????? }

private String newName(int index)
??? {
??????? // If we're allowed to generate mixed-case names, we can use twice as
??????? // many characters.
??????? int totalCharacterCount = generateMixedCaseNames ?
??????????? 2 * CHARACTER_COUNT :
??????????? CHARACTER_COUNT;

int baseIndex = index / totalCharacterCount;
??????? int offset??? = index % totalCharacterCount;

??????? char newChar = charAt(offset);

??????? String newName = baseIndex == 0 ?
??????????? new String(new char[] { newChar }) :
??????????? (name(baseIndex-1) + newChar);

??????? return newName;
??? }

??????? // Create a new name and cache it.
??????? String name = newName(index);
??????? cachedNames.add(index, name);

??????? return name;
??? }
我们看到它的命名规则非常简单~~就是采用26个字母顺序使用,然后依次扩展.

接下来我们来看下如何将这些规则应用到字节码库中：??????

我们看到访问者:

public void visitProgramClass(ProgramClass programClass)
??? {
??????? // Rename this class.
??????? programClass.thisClassConstantAccept(this);

??????? // Rename the class members.
??????? programClass.fieldsAccept(this);
??????? programClass.methodsAccept(this);
??? }

?

ClassRenamer 它对常量的访问操作是:

public void visitClassConstant(Clazz clazz, ClassConstant classConstant)
??? {
??????? // Update the Class entry if required.
??????? String newName = ClassObfuscator.newClassName(clazz);
??????? if (newName != null)
??????? {
??????????? // Refer to a new Utf8 entry.
??????????? classConstant.u2nameIndex =
??????????????? new ConstantPoolEditor((ProgramClass)clazz).addUtf8Constant(newName);
??????? }
??? }

很容易看出,实际上它是将常量池对应的索引数据替换成它的新数据,

我们看下它对member的操作吧:

?public void visitProgramMember(ProgramClass? programClass,
???????????????????????????????????? ProgramMember programMember)
??? {
??????? // Has the class member name changed?
??????? String name??? = programMember.getName(programClass);
??????? String newName = MemberObfuscator.newMemberName(programMember);
??????? if (newName != null &&
??????????? !newName.equals(name))
??????? {
??????????? programMember.u2nameIndex =
??????????????? new ConstantPoolEditor(programClass).addUtf8Constant(newName);
??????? }
??? }

还是一样的道理,先对member定义个一个新的名字,然后替换掉常量中的数据。

?

?

?

?

?

?

?

?