From 67ffcd7fa893bcfa6a3d531eb4375fde0db12dde Mon Sep 17 00:00:00 2001 From: p30496857 Date: Thu, 23 Nov 2023 13:52:15 +0800 Subject: [PATCH] ADD file via upload --- AudioOutput.java | 98 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 AudioOutput.java diff --git a/AudioOutput.java b/AudioOutput.java new file mode 100644 index 0000000..771bed4 --- /dev/null +++ b/AudioOutput.java @@ -0,0 +1,98 @@ +package AudioChecker; + +import soot.*; +import soot.jimple.*; +import soot.options.Options; + +import java.util.Collections; +import java.util.Iterator; +import java.util.List; + +public class AudioOutput { + private final static String androidJAR = "D:\\Android\\Android SDK\\platforms";; // Android 平台库路径 + private final static String appApk = "C:\\Users\\32082\\Desktop\\soot\\soot-android-static-analysis-master\\apk\\Audio\\飞书.apk"; // APK + // 文件路径 + + public static void main(String[] args) { + // Soot 配置 + Options.v().set_src_prec(Options.src_prec_apk); + Options.v().set_android_jars(androidJAR); // 确保指向正确的 Android 平台库 + Options.v().set_process_dir(Collections.singletonList(appApk)); + Options.v().set_allow_phantom_refs(true); // 允许幻影引用,对于找不到的类 + Options.v().set_output_format(Options.output_format_jimple); + Scene.v().loadNecessaryClasses(); + + // 遍历所有类 + for (SootClass sootClass : Scene.v().getApplicationClasses()) { + for (SootMethod method : sootClass.getMethods()) { + if (method.isConcrete()) { + Body body = method.retrieveActiveBody(); + analyzeMethod(body); + } + } + } + } + + private static void analyzeMethod(Body body) { + boolean audioFocusLossCaseFound = false; + for (Unit unit : body.getUnits()) { + // 查找 switch(focusChange) 语句 +// System.out.println("We got it!"); + if (unit instanceof TableSwitchStmt) { + TableSwitchStmt switchStmt = (TableSwitchStmt) unit; + Value switchKey = switchStmt.getKey(); + List useBoxes = switchKey.getUseBoxes(); + System.out.println("We got switch!"); + if (useBoxes.stream().anyMatch(box -> box.getValue().toString().equals("focusChange"))) { + System.out.println("We got focusChange!"); + + List targets = switchStmt.getTargets(); + // 检查是否有 case AudioManager.AUDIOFOCUS_LOSS + for (Unit target : targets) { + if (target.toString().contains("AudioManager.AUDIOFOCUS_LOSS")) { + System.out.println("We got AudioManager.AUDIOFOCUS_LOSS!"); + analyzeMediaPlayerCalls(target, body.getUnits()); + break; // 找到后退出循环 + } + } + } + } + } +} + + private static void analyzeMediaPlayerCalls(Unit caseStartPoint, PatchingChain units) { + boolean pauseOrStopCalled = false; + Unit currentUnit = caseStartPoint; + + // 遍历 case 代码块 + while (currentUnit != null) { + if (currentUnit instanceof InvokeStmt) { + InvokeStmt invokeStmt = (InvokeStmt) currentUnit; + InvokeExpr invokeExpr = invokeStmt.getInvokeExpr(); + + if (invokeExpr instanceof InstanceInvokeExpr) { + InstanceInvokeExpr instanceInvokeExpr = (InstanceInvokeExpr) invokeExpr; + SootMethod method = instanceInvokeExpr.getMethod(); + + if (isMediaPlayerPauseOrStopMethod(method)) { + System.out.println("Found MediaPlayer call to " + method.getName() + " in method: " + + ((Body) caseStartPoint).getMethod()); + pauseOrStopCalled = true; + break; // 找到之后跳出循环 + } + } + } + // 移动到下一个单元 + currentUnit = units.getSuccOf(currentUnit); + } + + if (!pauseOrStopCalled) { + System.out.println("No MediaPlayer pause or stop call found in AudioManager.AUDIOFOCUS_LOSS case"); + } + } + + private static boolean isMediaPlayerPauseOrStopMethod(SootMethod method) { + return method.getDeclaringClass().getName().equals("android.media.MediaPlayer") + && (method.getName().equals("pause") || method.getName().equals("stop")); + } +} \ No newline at end of file