android - JNI混淆器混淆

Question

我有混淆问题。为了更好的想象力:

Java代码

class JniTest...

public void test()
{
    //some code
}

public void runJniCode()
{
    //here I call native code
}

本地代码

JNIEXPORT void JNICALL
Java_path_to_class_test(JNIEnv* env, jobject  obj)
{
    //here I call test method from Java

}

一切正常，直到我想发布混淆版本。 Java 类的名称(例如 JniTest)和该类中的方法 test 被混淆器重命名为“a”和“a()”(这可能不是始终相同)，但在 native 代码中，方法和类的原始名称仍然存在，因为它被硬编码为字符串，例如:

jmethodID mid = env->GetMethodID(cls, "test", "someSignature");

...有什么方法可以动态设置方法名吗？

Answer 1

在研究这个完全相同的问题时，我遇到了一个我认为合理的解决方案。不幸的是，该解决方案不会按要求自动混淆 native Java 代码和 JNI 方法，但我仍然认为它值得分享。

引自来源:

I present here a simple trick which allows obfuscation of the JNI layer, renaming the method names to meaningless names on both the Java and native side, while keeping the source code relatively readable and maintainable and without affecting performance.

Let’s consider an example, initial situation:

class Native {
    native static int rotateRGBA(int rgb, int w, int h);
}

extern "C" int Java_pakage_Native_rotateRGBA(JNIEnv *env, jclass, int rgb, int w, int h);

In the example above Proguard can’t obfuscate the method name rotateRGBA, which remains visible on the Java side and on the native side.

The solution is to use directly a meaningless method name in the source, while taking care to minimally disrupt the readability and maintainability of the code.

class Native {
    private native static int a(int rgb, int w, int h); //rotateRGBA

    static int rotateRGBA(int rgb, int w, int h) {
        return a(rgb, w, h);
    }
}

// rotateRGBA
extern "C" int Java_pakage_Native_a(JNIEnv *env, jclass, int rgb, int w, int h);

The JNI method is renamed to a meaningless a. But the call on the Java side is wrapped by the meaningfully named method rotateRGBA. The Java clients continue to invoke Native.rotateRGBA() as before, without being affected at all by the rename.

What is interesting is that the new Native.rotateRGBA method is not native anymore, and thus can be renamed by Proguard at will. The result is that the name rotateRGBA completely disappears from the obfuscated code, on both Dalvik and native side. What’s more, Proguard optimizes away the wrapper method, thus removing the (negligible) performance impact of wrapping the native call.

Conclusion: eliminated the JNI method name from the obfuscated code (both Dalvik bytecode and native library), with minimal impact to readability and no performance impact.

来源:Obfuscating the JNI surface layer

我仍在寻找可以自动混淆 native Java 代码和关联的 JNI 的工具。