drozer浅析三：命令实现与交互

前面走马观花的看了几个模块的源码，看到是用python(会加载自定义的java类)写的。产生2个问题：在命令行中输入command，drozer是如何去执行的；python是如何与java交互的。

drozer console connect：

当我们在命令行输入以上字符串时，在drozer中是如此来执行的：

1 Console().run(sys.argv[2::])

——>2 def run(self, argv=None)

——>3 self.__invokeCommand(arguments)

——>4 getattr(self, "do_" + command)(arguments)

——>5 def do_connect(self, arguments)

——> 6.1 response = server.startSession(device, password)

——>6.1.1 self.sendAndReceive(SystemRequestFactory.startSession(device_id))

——>6.1.1.1 startSession(device_id)

6.1.1.2self.sendAndReceive(builder)

——>6.1.1.2.1 message_id = self.send(message)

6.1.1.2.2 elif response.id == message_id: return response

6.2 if response.type == Message.SYSTEM_RESPONSE and response.system_response.status==Message.SystemResponse.SUCCESS: session_id =response.system_response.session_id

——>6.2.1 session = Session(server, session_id, arguments)

6.2.2 session.cmdloop()

当输入drozer console connect时，首先会把提取argv[2::]即connect。在步骤2里的run函数里经过转换去执行do_connect方法即步骤5。上面这几步都是次要的，接下来才是主题。步骤6.1建立会话过程；若会话建立成功即步骤6.2，进入6.2.2等待命令的输入，至此drozer console connect 命令全部执行完毕。需要理解什么是会话？

看上面的执行步骤我们可以看到，会话是在步骤6.1.1过程中建立的。在步骤6.1.1.1中封装开始会话请求信息及加入设备ID，budiler。

<span style="white-space:pre">	</span>builder = SystemRequestFactory(Message.SystemRequest.START_SESSION)    #注意这里请求的参数是start_session

        builder.addDeviceId(device_id)

        return builder

至此，步骤6.1.1变成变成步骤6.1.1.2。sendAndReceive中的操作：发送msg和接收到对应的msg才返回。详细分析发送和接收过程：首先给msg自动分配唯一标识符message_id，并通过socket将msg发送给agent；接收msg，通过message_id来识别是否为之前发送出去msg的返回信息。ok，会话建立过程就是给agent发送Message.SystemRequest.START_SESSION。

继续步骤6.2.1，初始化session，在此期间会输出drozer的由字母组成的头像(在最后)。接着进入步骤6.2.2cmdloop()，在preloop()中输出drozer console的版本号,接着循环等待用户输入命令。

run app.service.send:

上面的cmdloop在等待用户的输入，输入以上的字符串。读取字符串到argv中argv[0] = run,argv[1] = app.service.send。根据list[0]会先进入Session类中的do_run方法(Session类中有很多do_xx方法)。然后判断argv[1]是不是模块命令(module.run(argv[1:]))进入drozer.module.base.py中Module类(每个命令都是继承自Module类：class Send(Module, common.ServiceBinding))中的run方法：

<span style="font-size:18px;"> parser = self.__prepare_parser()

        parser.description = self.usage.formatted_description()
        parser.usage = self.usage.formatted_usage(parser)

        if "-h" in args or "--help" in args:
            return parser.print_help()
        else:
            arguments = parser.parse_args(args)
            
            if hasattr(self, 'execute'):
                <span style="color:#ff0000;">result = self.execute</span></span>

至此，self.execute(arguments)就去执行类app.service.send下的execute方法了。之前分析过app.service.send的执行过程中会加载自定义的java类来发送和接收service的msg，注意send类的定义class Send(Module, common.ServiceBinding):

<span style="font-size:18px;"> def obtain_binder(self):
            if self.binder == None:
                ServiceBinder = self.context.loadClass("common/ServiceBinder.apk", "ServiceBinder")
                
                self.binder = self.context.new(ServiceBinder)
                
            return self.binder</span>

首先会调用loader.py文件中的ClassLoader里的loadclass方法(class ServiceBinding(loader.ClassLoader))。

def loadClass(self, source, klass, relative_to=None):
        """
        Load a Class from a local apk file (source) on the running Dalvik VM.
        """

        if relative_to == None:
            relative_to = os.path.join(os.path.dirname(__file__), "..")
        elif relative_to.find(".py") >= 0 or relative_to.find(".pyc") >= 0:
            relative_to = os.path.dirname(relative_to)
        
        if not Module.cached_klass(".".join([source, klass])):
            loader = utils.ClassLoader(source, self.__get_cache_path(), self.__get_constructor(), self.klass('java.lang.ClassLoader').getSystemClassLoader(), relative_to=relative_to)
            loader.android_path = lambda: Configuration.library("android.jar")
            loader.dx_path = lambda: Configuration.executable("dx.bat") if platform.system() == "Windows" else Configuration.executable("dx")
            loader.javac_path = lambda: Configuration.executable("javac")
            
            Module.cache_klass(".".join([source, klass]), loader.loadClass(klass))
            
        return Module.get_cached_klass(".".join([source, klass]))

loadClass()先利用反射得到ClassLoader来初始化loader，然后利用loader将klass(自定义的java类)装载进dvm。先看反射步骤：.klass('java.lang.ClassLoader')

Module类中的klass方法：

def klass(self, class_name):
        """
        Resolves a class name, and returns an object reference for the class.
        """

        if not Module.cached_klass(class_name):
            Module.cache_klass(class_name, self.reflector.resolve(class_name))
        
        return Module.get_cached_klass(class_name)

通过Module.cached_klass判断当前类名是否已在Module__klass中，若不存在则调用self.reflector.resolve来加载并在cache_klass中记录(一个cached，一个是cache)。reflector.resolve: <—— reflector.py

    def resolve(self, class_name):
        """
        Resolves a Java class, given its fully qualified name, and returns a
        ReflectedObject that can be used to instantiate it with #construct.
        """

        response = self.sendAndReceive(ReflectionRequestFactory.resolve(class_name))

        if response is None:
            raise ReflectionException("expected a response to RESOLVE")
        elif response.reflection_response.status == Message.ReflectionResponse.SUCCESS:
            return ReflectedType.fromArgument(response.reflection_response.result, reflector=self)
        else:
            raise ReflectionException(response.reflection_response.errormessage)

分两步：resolve(class_name)组合msg；sendAndReceive发送msg要求Reflection calss_name。到此为止得到java.lang.ClassLoader，然后再loader.loadClass(klass)

    def loadClass(self, klass):
        return self.getClassLoader().loadClass(klass);

    def getClassLoader(self):
        """
        Gets a DexClassLoader on the agent, given compiled source or an apk
        file from the local system.
        """
        
        self.source = self.__get_source(self.source_or_relative_path, relative_to=self.relative_to)

        if self.source != None:
            file_path = "/".join([self.cache_path, self.__get_cached_apk_name()])
    
            file_io = self.construct('java.io.File', file_path)
            
            if not self.__verify_file(file_io, self.source):  
                source_data = [ReflectedPrimitive("byte", (ord(i) if ord(i) < 128 else ord(i) - 0x100), reflector=None) for i in self.source]
    
                file_stream = self.construct("java.io.FileOutputStream", file_path)
                file_stream.write(source_data, 0, len(source_data))
                file_stream.close()
            return self.construct('dalvik.system.DexClassLoader', file_path, self.cache_path, None, self.system_class_loader)
        else:
            raise RuntimeError("drozer could not find or compile a required extension library.
")

ok，仔细分析发现上面对于涉及到java的操作都是利用sendAndReceive来实现的(关于message如何定义查看https://github.com/mwrlabs/mercury-common/blob/master/protobuf.proto)。

startSession：sendAndReceive()——>Message.SystemRequest.START_SESSION
reflector.resolve:sendAndReceive()——>Message.ReflectionRequest.RESOLVE

construct ： sendAndReceive()——> Message.REFLECTION_REQUEST

.....

sendAndReceive是通过socket把msg发送给agent的，实际还是由agent来执行。

参考资料：Android开源审计框架drozer--源码浅析