android-decompile-mcp 0.0.0-stage → 1.0.0

package/dist/adb.js

@@ -0,0 +1,89 @@
+import { exec } from "./util.js";
+/** ADB 可执行文件路径，可通过环境变量 ADB_PATH 覆盖。 */
+const ADB = process.env.ADB_PATH || "adb";
+function adb(args, opts = {}) {
+    const full = opts.serial ? ["-s", opts.serial, ...args] : args;
+    return exec(ADB, full, { timeoutMs: opts.timeoutMs ?? 60000 });
+}
+/** 列出已连接设备。 */
+export async function listDevices() {
+    const r = await adb(["devices", "-l"]);
+    const lines = r.stdout.split(/\r?\n/).slice(1);
+    const devices = [];
+    for (const line of lines) {
+        const t = line.trim();
+        if (!t)
+            continue;
+        const parts = t.split(/\s+/);
+        const serial = parts[0];
+        const state = parts[1] || "unknown";
+        const modelPart = parts.find((p) => p.startsWith("model:"));
+        devices.push({ serial, state, model: modelPart?.slice("model:".length) });
+    }
+    return devices;
+}
+/** 选取一个默认设备 serial；若指定了 serial 则校验存在。 */
+export async function resolveSerial(serial) {
+    const devices = (await listDevices()).filter((d) => d.state === "device");
+    if (devices.length === 0) {
+        throw new Error("没有可用的 ADB 设备（确认设备已连接并开启 USB 调试）。");
+    }
+    if (serial) {
+        if (!devices.find((d) => d.serial === serial)) {
+            throw new Error(`指定的设备 ${serial} 不存在或不可用。`);
+        }
+        return serial;
+    }
+    if (devices.length > 1) {
+        throw new Error(`检测到多台设备，请通过 serial 参数指定：${devices.map((d) => d.serial).join(", ")}`);
+    }
+    return devices[0].serial;
+}
+/** 列出设备上已安装的包名，可带关键字过滤。 */
+export async function listPackages(serial, keyword) {
+    const r = await adb(["shell", "pm", "list", "packages"], { serial });
+    let pkgs = r.stdout
+        .split(/\r?\n/)
+        .map((l) => l.trim().replace(/^package:/, ""))
+        .filter(Boolean);
+    if (keyword)
+        pkgs = pkgs.filter((p) => p.includes(keyword));
+    return pkgs.sort();
+}
+/** 获取某个包在设备上的所有 APK 路径（含 split）。 */
+export async function getApkPaths(serial, pkg) {
+    const r = await adb(["shell", "pm", "path", pkg], { serial });
+    const paths = r.stdout
+        .split(/\r?\n/)
+        .map((l) => l.trim().replace(/^package:/, ""))
+        .filter(Boolean);
+    if (paths.length === 0)
+        throw new Error(`设备上未找到包 ${pkg} 的 APK 路径。`);
+    return paths;
+}
+/** 从设备拉取文件到本地。 */
+export async function pull(serial, remote, local) {
+    return adb(["pull", remote, local], { serial, timeoutMs: 300000 });
+}
+/** 推送文件到设备。 */
+export async function push(serial, local, remote) {
+    return adb(["push", local, remote], { serial, timeoutMs: 300000 });
+}
+/** 安装 APK。 */
+export async function install(serial, apkPath) {
+    return adb(["install", "-r", "-g", apkPath], { serial, timeoutMs: 300000 });
+}
+/** 执行任意 shell 命令。 */
+export async function shell(serial, command) {
+    return adb(["shell", command], { serial });
+}
+/** 判断包是否已安装。 */
+export async function isInstalled(serial, pkg) {
+    const pkgs = await listPackages(serial, pkg);
+    return pkgs.includes(pkg);
+}
+/** 启动一个 app（monkey 方式，无需指定 Activity）。 */
+export async function launchApp(serial, pkg) {
+    return adb(["shell", "monkey", "-p", pkg, "-c", "android.intent.category.LAUNCHER", "1"], { serial });
+}
+export { adb };

package/dist/detect.js

@@ -0,0 +1,42 @@
+import AdmZip from "adm-zip";
+/** 常见加固壳特征库（文件/so 名）。 */
+const SIGNATURES = [
+    { name: "360 加固（奇虎）", patterns: ["libjiagu.so", "libjiagu_art.so", "libjiagu_x86.so", "libprotectClass.so"] },
+    { name: "腾讯乐固 / 御安全", patterns: ["libshell.so", "libshella", "libshellx", "libtup.so", "libtosprotection", "libBugly"] },
+    { name: "梆梆加固", patterns: ["libsecexe.so", "libsecmain.so", "libDexHelper.so", "libSecShell.so", "libsecpreload.so"] },
+    { name: "爱加密", patterns: ["libexec.so", "libexecmain.so", "ijiami.dat", "ijiami.ajm", "libSecShell"] },
+    { name: "阿里聚安全 / 娜迦", patterns: ["libmobisec.so", "libpreverify1.so", "aliprotect.dat", "libsgmain.so", "libsgsecuritybody.so"] },
+    { name: "百度加固", patterns: ["libbaiduprotect.so", "baiduprotect1.jar", "libbaiduprotect_x86.so"] },
+    { name: "娜迦 NAGAIN", patterns: ["libddog.so", "libfdog.so", "libchaosvmp.so"] },
+    { name: "网秦 / 通付盾", patterns: ["libnqshield.so", "libtup.so", "libnesec.so"] },
+    { name: "几维安全 KiwiSecurity", patterns: ["libkwscmm.so", "libkwscr.so", "libkwslinker.so"] },
+    { name: "顶象 Dingxiang", patterns: ["libx3g.so"] },
+    { name: "珊瑚灵御 / 瑞星", patterns: ["librsprotect.so"] },
+    { name: "APKProtect", patterns: ["libAPKProtect.so"] },
+];
+/** 扫描本地 APK，识别其是否被加固以及加固厂商。 */
+export function detectPacker(apkPath) {
+    const zip = new AdmZip(apkPath);
+    const entries = zip.getEntries().map((e) => e.entryName);
+    const lower = entries.map((e) => e.toLowerCase());
+    const hits = [];
+    const packers = new Set();
+    for (const sig of SIGNATURES) {
+        for (const pat of sig.patterns) {
+            const p = pat.toLowerCase();
+            const idx = lower.findIndex((e) => e.includes(p));
+            if (idx !== -1) {
+                hits.push({ packer: sig.name, entry: entries[idx] });
+                packers.add(sig.name);
+            }
+        }
+    }
+    const dexCount = entries.filter((e) => /^classes\d*\.dex$/i.test(e)).length;
+    return {
+        packed: packers.size > 0,
+        packers: [...packers],
+        hits,
+        dexCount,
+        entryCount: entries.length,
+    };
+}

package/dist/entry.js

@@ -0,0 +1,219 @@
+import { join, resolve } from "node:path";
+import { readFile, readdir, stat } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { exec, hasCommand } from "./util.js";
+function toSmaliRel(className) {
+    return className.replace(/\./g, "/") + ".smali";
+}
+async function findSmaliFile(roots, className) {
+    const rel = toSmaliRel(className);
+    for (const root of roots) {
+        const candidates = [
+            join(root, rel),
+            join(root, "smali", rel),
+            join(root, "smali_classes2", rel),
+            join(root, "smali_classes3", rel),
+            join(root, "smali_classes4", rel),
+            join(root, "smali_classes5", rel),
+        ];
+        for (const p of candidates) {
+            if (existsSync(p))
+                return p;
+        }
+        // scan smali* dirs under project
+        try {
+            const names = await readdir(root);
+            for (const n of names) {
+                if (!n.startsWith("smali"))
+                    continue;
+                const p = join(root, n, rel);
+                if (existsSync(p))
+                    return p;
+            }
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    return undefined;
+}
+async function locateOnCreate(smaliPath) {
+    const text = await readFile(smaliPath, "utf8");
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const m = lines[i].match(/^\s*\.method\s+.*\bonCreate\s*\(\s*Landroid\/os\/Bundle;\s*\)\s*V/);
+        if (m) {
+            return { line: i + 1, method: lines[i].trim() };
+        }
+    }
+    // fallback: any onCreate
+    for (let i = 0; i < lines.length; i++) {
+        if (/^\s*\.method\s+.*\bonCreate\s*\(/.test(lines[i])) {
+            return { line: i + 1, method: lines[i].trim() };
+        }
+    }
+    return undefined;
+}
+/** 从 apktool 解码后的 AndroidManifest.xml 解析入口。 */
+export function parseDecodedManifest(xml) {
+    const pkg = xml.match(/<manifest\b[^>]*\bpackage\s*=\s*"([^"]+)"/i)?.[1];
+    const appName = xml.match(/<application\b[^>]*\bandroid:name\s*=\s*"([^"]+)"/i)?.[1];
+    const launchers = new Set();
+    // Activity / activity-alias blocks that contain MAIN + LAUNCHER
+    const activityRe = /<(activity|activity-alias)\b([^>]*)>([\s\S]*?)<\/\1>/gi;
+    let m;
+    while ((m = activityRe.exec(xml))) {
+        const attrs = m[2];
+        const body = m[3];
+        const hasMain = /android:name\s*=\s*"android\.intent\.action\.MAIN"/i.test(body);
+        const hasLauncher = /android:name\s*=\s*"android\.intent\.category\.LAUNCHER"/i.test(body);
+        if (!hasMain || !hasLauncher)
+            continue;
+        const name = attrs.match(/\bandroid:name\s*=\s*"([^"]+)"/i)?.[1];
+        if (!name)
+            continue;
+        const target = attrs.match(/\bandroid:targetActivity\s*=\s*"([^"]+)"/i)?.[1];
+        const raw = target || name;
+        launchers.add(resolveClassName(pkg, raw));
+    }
+    return {
+        packageName: pkg,
+        applicationName: appName ? resolveClassName(pkg, appName) : undefined,
+        launchers: [...launchers],
+    };
+}
+function resolveClassName(pkg, name) {
+    if (name.startsWith(".")) {
+        if (!pkg)
+            return name.slice(1);
+        return pkg + name;
+    }
+    if (!name.includes(".") && pkg)
+        return `${pkg}.${name}`;
+    return name;
+}
+async function collectSmaliRoots(projectDir, smaliDir) {
+    const roots = [];
+    if (smaliDir)
+        roots.push(resolve(smaliDir));
+    if (projectDir)
+        roots.push(resolve(projectDir));
+    return roots;
+}
+async function fromAapt(apkPath) {
+    const tools = ["aapt", "aapt2"];
+    for (const tool of tools) {
+        if (!(await hasCommand(tool)))
+            continue;
+        const r = await exec(tool, ["dump", "badging", apkPath], { timeoutMs: 60000 });
+        if (r.code !== 0)
+            continue;
+        const pkg = r.stdout.match(/package:\s*name='([^']+)'/)?.[1];
+        const launchers = [];
+        for (const line of r.stdout.split(/\r?\n/)) {
+            const m = line.match(/launchable-activity:\s*name='([^']+)'/);
+            if (m)
+                launchers.push(m[1]);
+        }
+        return { packageName: pkg, launchers, raw: r.stdout.slice(0, 2000) };
+    }
+    throw new Error("未找到 aapt/aapt2，且未提供已解码的 AndroidManifest.xml。请安装 Android build-tools，或先用 apk_decode。");
+}
+/**
+ * 定位应用入口：包名、Application、MAIN/LAUNCHER Activity，以及对应 smali 的 onCreate 行号。
+ * 只做分析定位，不修改任何文件。
+ */
+export async function findAppEntry(opts) {
+    const notes = [];
+    const sources = [];
+    let packageName;
+    let applicationName;
+    let launcherNames = [];
+    const manifestPath = opts.manifestPath ||
+        (opts.projectDir ? join(opts.projectDir, "AndroidManifest.xml") : undefined);
+    if (manifestPath && existsSync(manifestPath)) {
+        const xml = await readFile(manifestPath, "utf8");
+        if (xml.includes("android:name") || xml.includes("<manifest")) {
+            const parsed = parseDecodedManifest(xml);
+            packageName = parsed.packageName;
+            applicationName = parsed.applicationName;
+            launcherNames = parsed.launchers;
+            sources.push(manifestPath);
+        }
+        else {
+            notes.push(`Manifest 可能是二进制 AXML，无法直接解析：${manifestPath}`);
+        }
+    }
+    if (launcherNames.length === 0 && opts.apkPath) {
+        const st = await stat(opts.apkPath).catch(() => null);
+        if (!st?.isFile())
+            throw new Error(`APK 不存在：${opts.apkPath}`);
+        const aapt = await fromAapt(opts.apkPath);
+        packageName = packageName || aapt.packageName;
+        launcherNames = aapt.launchers;
+        sources.push(`aapt dump badging: ${opts.apkPath}`);
+        notes.push("入口来自 aapt badging；更完整信息请先 apk_decode 再传 projectDir。");
+    }
+    if (launcherNames.length === 0 && !applicationName) {
+        throw new Error("未能定位入口。请提供 apktool 解码目录 projectDir，或 apkPath（需本机 aapt/aapt2）。");
+    }
+    const roots = await collectSmaliRoots(opts.projectDir, opts.smaliDir);
+    const launchers = [];
+    for (const activity of launcherNames) {
+        const entry = { activity };
+        const smaliPath = await findSmaliFile(roots, activity);
+        if (smaliPath) {
+            entry.smaliPath = smaliPath;
+            const oc = await locateOnCreate(smaliPath);
+            if (oc) {
+                entry.onCreateLine = oc.line;
+                entry.onCreateMethod = oc.method;
+            }
+            else {
+                notes.push(`${activity}: 找到 smali 但未定位 onCreate`);
+            }
+        }
+        else if (roots.length) {
+            notes.push(`${activity}: 在 smali 目录中未找到对应文件`);
+        }
+        launchers.push(entry);
+    }
+    if (applicationName && roots.length) {
+        const appSmali = await findSmaliFile(roots, applicationName);
+        if (appSmali)
+            notes.push(`Application smali: ${appSmali}`);
+    }
+    return {
+        packageName,
+        applicationName,
+        launchers,
+        sources,
+        notes,
+    };
+}
+export function formatAppEntry(info) {
+    const lines = [];
+    lines.push(`package: ${info.packageName ?? "(unknown)"}`);
+    lines.push(`application: ${info.applicationName ?? "(default)"}`);
+    lines.push(`launcher 数量: ${info.launchers.length}`);
+    for (const [i, L] of info.launchers.entries()) {
+        lines.push(`--- launcher #${i + 1} ---`);
+        lines.push(`activity: ${L.activity}`);
+        if (L.smaliPath)
+            lines.push(`smali: ${L.smaliPath}`);
+        if (L.onCreateLine)
+            lines.push(`onCreate: 第 ${L.onCreateLine} 行`);
+        if (L.onCreateMethod)
+            lines.push(`method: ${L.onCreateMethod}`);
+    }
+    if (info.sources.length) {
+        lines.push("--- sources ---");
+        lines.push(...info.sources.map((s) => `  ${s}`));
+    }
+    if (info.notes.length) {
+        lines.push("--- notes ---");
+        lines.push(...info.notes.map((n) => `  ${n}`));
+    }
+    lines.push("说明: 本工具仅定位入口，不写入/注入代码。重新打包请用 apk_decode →（自行合法修改）→ apk_repack。");
+    return lines.join("\n");
+}