diff --git a/AudioInput.java b/AudioInput.java new file mode 100644 index 0000000..8353b09 --- /dev/null +++ b/AudioInput.java @@ -0,0 +1,83 @@ +package AudioChecker; + +import soot.*; +import soot.jimple.*; +import soot.options.Options; +import java.util.*; + +public class AudioInput { + + public static void main(String[] args) { + // Soot 初始化和配置 + String pathToAndroidJars = "D:\\Android\\Android SDK\\platforms"; // Android JARs 路径 + String pathToApk = "C:\\Users\\32082\\Desktop\\soot\\soot-android-static-analysis-master\\apk\\Audio\\飞书.apk"; // APK + // 路径 + + Options.v().set_src_prec(Options.src_prec_apk); + Options.v().set_android_jars(pathToAndroidJars); // 确保指向正确的 Android 平台库 + Options.v().set_process_dir(Collections.singletonList(pathToApk)); + Options.v().set_allow_phantom_refs(true); // 允许幻影引用,对于找不到的类 + Options.v().set_output_format(Options.output_format_jimple); + + Scene.v().loadNecessaryClasses(); + + // 存储 AudioRecordingCallback 的方法 + Map audioRecordingCallbacks = new HashMap<>(); + + // 遍历所有类 + for (SootClass sootClass : Scene.v().getApplicationClasses()) { + for (SootMethod method : sootClass.getMethods()) { +// System.out.println(method.getName()); + if(method.getName()=="registerRecordingCallback")System.out.println("yes"); + if (isAudioRecordingCallback(method)) { + try { + Body body = method.retrieveActiveBody(); + audioRecordingCallbacks.put(method, body); + } catch (Exception e) { + System.out.println("Error retrieving body for method: " + method.getName()); + } + } + } + } + if (audioRecordingCallbacks.size() == 0) + System.out.println("Class AudioRecordingCallbacks doesn't exist."); + else { + // 分析方法体 + for (Map.Entry entry : audioRecordingCallbacks.entrySet()) { + Body body = entry.getValue(); + for (Unit unit : body.getUnits()) { + if (unit instanceof IfStmt) { + IfStmt ifStmt = (IfStmt) unit; + Value condition = ifStmt.getCondition(); + + // 检查条件是否是 isClientSilenced + if (condition.toString().equals("isClientSilenced")) { + +// System.out.println("Yeah,We got it!"); + Unit nextUnit = body.getUnits().getSuccOf(ifStmt); + // 检查 AudioRecord.startRecording 调用 + if (nextUnit instanceof InvokeStmt) { + InvokeExpr invokeExpr = ((InvokeStmt) nextUnit).getInvokeExpr(); + if (invokeExpr.getMethod().getName().equals("startRecording")) { + System.out.println("Found target pattern in method: " + entry.getKey().getName()); + } + } + } else { + System.out.println("Target pattern doesn't exist."); + } + } + } + } + } + } + + private static boolean isAudioRecordingCallback(SootMethod method) { + // 根据特定条件判断方法是否为 AudioRecordingCallback + + return method.getName().contains("onAudioFocusChange"); +// return method.getName().contains("AudioRecordingCallback"); +// return method.getSignature().contains("AudioRecordingCallback"); +// return method.getSignature().contains("registerRecordingCallback"); +// return method.getSignature().contains("startActivity"); + } +}