逆向分析的时候会碰到有些apk会动态加载子包，加载完之后就删掉，导致没办法找到子包进行分析。
于是写了一个frida 脚本，获取动态加载的子包重命名报错，这样就不会被删掉。
脚本如下：
这里是一个通用的模版，可以根据hook的apk 按需求修改，这个会hook非常多的class, 可以按需求判断loadClass 后再去保存dex。
Java.perform(function () {var DexClassLoader = Java.use('dalvik.system.DexClassLoader');var File = Java.use('java.io.File');var FileInputStream = Java.use('java.io.FileInputStream');var FileOutputStream = Java.use('java.io.FileOutputStream');var BufferedInputStream = Java.use('java.io.BufferedInputStream');var BufferedOutputStream = Java.use('java.io.BufferedOutputStream');// 全局变量保存 dexPathvar globalDexPath = null;// Hook DexClassLoader 的构造函数DexClassLoader.$init.overload('java.lang.String', 'java.lang.String', 'java.lang.String', 'java.lang.ClassLoader').implementation = function (dexPath, optimizedDirectory, librarySearchPath, parent) {console.log('DexClassLoader initialized with dexPath: ' + dexPath);// 保存 dexPath 到全局变量globalDexPath = dexPath;// 调用原始构造函数return this.$init(dexPath, optimizedDirectory, librarySearchPath, parent);};// Hook loadClass(String name) 方法DexClassLoader.loadClass.overload('java.lang.String').implementation = function (name) {console.log('Loading class: ' + name);// 获取 DEX 文件路径if (globalDexPath == null) {console.error('Failed to get DEX file: globalDexPath is null');return this.loadClass(name); // 直接调用原始方法}console.log('DEX file path: ' + globalDexPath);// 导出 DEX 文件try {var sourceFile = File.$new(globalDexPath);console.log('Global DEX path: ' + globalDexPath);if (!sourceFile.exists()) {throw new Error('Source file does not exist: ' + globalDexPath);}var originalFileName = sourceFile.getName();var originalDirectory = sourceFile.getParent();var i = 1;var destFileName = originalFileName + '_' + i;var destFile = File.$new(originalDirectory + '/' + destFileName);while (destFile.exists()) {i++;destFileName = originalFileName + '_' + i;destFile = File.$new(originalDirectory + '/' + destFileName);}var inputStream = FileInputStream.$new(sourceFile);var bufferedInputStream = BufferedInputStream.$new(inputStream);var outputStream = FileOutputStream.$new(destFile);var bufferedOutputStream = BufferedOutputStream.$new(outputStream);// 创建缓冲区var bufferSize = 1024; // 每次读取的字节数var buffer = Java.array('byte', new Array(bufferSize).fill(0)); // 创建一个字节数组var bytesRead;console.log('Buffer created with length: ' + buffer.length);// 使用 read(byte[] b, int off, int len) 方法while ((bytesRead = bufferedInputStream.read(buffer, 0, bufferSize)) !== -1) {bufferedOutputStream.write(buffer, 0, bytesRead);}bufferedOutputStream.flush();bufferedOutputStream.close();bufferedInputStream.close();console.log('DEX file exported to: ' + destFile.getAbsolutePath());} catch (e) {console.error('Error exporting DEX file: ' + e.message);}// 调用原始方法return this.loadClass(name);};
});
