逆向必剪调试密码实录

众所不周知，必剪的设置里面有个调试入口。就像这样：

只需要在我的-设置里面快速连续点击版本号(2.85.0)多次即可看到这个输入密码的弹窗。
那么，密码是什么？
于是就有了这一期的逆向实录笔记。

MT管理器，启动！！！
一个可行的思路是直接在安装包里面通过弹窗元素定位法进行查找
提取必剪安装包，然后打开直接在里面搜索这个弹窗输入框里字符串的内容：

还真让我给找到了

文件内容：

<?xml version="1.0" encoding="utf-8"?>
<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
    android:orientation="vertical"
    android:background="#83000000"
    android:layout_width="match_parent"
    android:layout_height="100dp">
    <EditText
        android:gravity="center_horizontal"
        android:layout_gravity="center_horizontal"
        android:id="@id/edit_input"
        android:layout_width="match_parent"
        android:layout_height="wrap_content"
        android:layout_marginTop="20dp"
        android:hint="Type Your Password"
        android:inputType="textVisiblePassword" />
    <LinearLayout
        android:layout_gravity="center_horizontal"
        android:orientation="horizontal"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:layout_marginBottom="20dp"
        android:layout_marginStart="40dp"
        android:layout_marginEnd="40dp">
        <com.bilibili.widgets.BTextView
            android:id="@id/tv_confirm"
            android:layout_width="wrap_content"
            android:layout_height="wrap_content"
            android:layout_marginTop="20dp"
            android:text="@string/editor_record_delete_confirm" />
        <com.bilibili.widgets.BTextView
            android:id="@id/tv_cancel"
            android:layout_width="wrap_content"
            android:layout_height="wrap_content"
            android:layout_marginTop="20dp"
            android:text="@string/editor_record_delete_cancel"
            android:layout_marginStart="80dp" />
    </LinearLayout>
</LinearLayout>

这就是那个密码弹窗了。

刚才去Dalvik字节码文件里面搜索过了，不存在edit_input这个关键字。
所以还是要去定位资源：
找到resources.arsc，然后用Arsc编辑器打开。
再去这个路径com.bilibili.studio/id/里面过滤edit_input，最后复制ID即可

最终得到这个编辑框的ID为7f090496(注：每个版本都不一样)

终于可以去字节码文件里面搜这个id了。
Dex编辑器++把所有的字节码文件全选打开，然后像这样搜索：

于是获得关于这个ID的引用

b6h:

# classes5.dex

.class public final Lb/b6h;
.super Ljava/lang/Object;
.source "BL"


# static fields
.field public static A:I = 0x7f0907b9

.field public static A0:I = 0x7f091372

.field public static B:I = 0x7f0907c5

.field public static B0:I = 0x7f091373

.field public static C:I = 0x7f0907dc

.field public static C0:I = 0x7f091374

.field public static D:I = 0x7f0907fa

.field public static D0:I = 0x7f091377

.field public static E:I = 0x7f0907fb

.field public static F:I = 0x7f0907fc

.field public static G:I = 0x7f0907fd

.field public static H:I = 0x7f09080f

.field public static I:I = 0x7f09081d

.field public static J:I = 0x7f09082c

.field public static K:I = 0x7f09084d

.field public static L:I = 0x7f0908a1

.field public static M:I = 0x7f09091b

.field public static N:I = 0x7f090923

.field public static O:I = 0x7f090924

.field public static P:I = 0x7f090a3b

.field public static Q:I = 0x7f090a3c

.field public static R:I = 0x7f090a6b

.field public static S:I = 0x7f090a6c

.field public static T:I = 0x7f090b01

.field public static U:I = 0x7f090c19

.field public static V:I = 0x7f090c33

.field public static W:I = 0x7f090c44

.field public static X:I = 0x7f090c7c

.field public static Y:I = 0x7f090ca0

.field public static Z:I = 0x7f090d70

.field public static a:I = 0x7f090188

.field public static a0:I = 0x7f090d74

.field public static b:I = 0x7f090276

.field public static b0:I = 0x7f090eee

.field public static c:I = 0x7f09027e

.field public static c0:I = 0x7f090f61

.field public static d:I = 0x7f09028f

.field public static d0:I = 0x7f090fbe

.field public static e:I = 0x7f090387

.field public static e0:I = 0x7f090fe3

.field public static f:I = 0x7f0903e7

.field public static f0:I = 0x7f091058

.field public static g:I = 0x7f0903e8

.field public static g0:I = 0x7f0910af

.field public static h:I = 0x7f0903e9

.field public static h0:I = 0x7f0910bf

.field public static i:I = 0x7f0903eb

.field public static i0:I = 0x7f0910d3

.field public static j:I = 0x7f0903ec

.field public static j0:I = 0x7f0910dc

.field public static k:I = 0x7f09041c

.field public static k0:I = 0x7f0910e1

.field public static l:I = 0x7f090496

.field public static l0:I = 0x7f0910eb

.field public static m:I = 0x7f090506

.field public static m0:I = 0x7f091116

.field public static n:I = 0x7f09059b

.field public static n0:I = 0x7f09112a

.field public static o:I = 0x7f0905cc

.field public static o0:I = 0x7f09114f

.field public static p:I = 0x7f0905cd

.field public static p0:I = 0x7f091178

.field public static q:I = 0x7f0905ce

.field public static q0:I = 0x7f09118a

.field public static r:I = 0x7f0905d1

.field public static r0:I = 0x7f091190

.field public static s:I = 0x7f09061f

.field public static s0:I = 0x7f09121c

.field public static t:I = 0x7f0906a6

.field public static t0:I = 0x7f091369

.field public static u:I = 0x7f0906a9

.field public static u0:I = 0x7f09136a

.field public static v:I = 0x7f090728

.field public static v0:I = 0x7f09136b

.field public static w:I = 0x7f090729

.field public static w0:I = 0x7f09136c

.field public static x:I = 0x7f09072a

.field public static x0:I = 0x7f09136d

.field public static y:I = 0x7f090775

.field public static y0:I = 0x7f091370

.field public static z:I = 0x7f090780

.field public static z0:I = 0x7f091371

l6h:

# classes7.dex

.class public final Lb/l6h;
.super Ljava/lang/Object;
.source "BL"


# static fields
.field public static A:I = 0x7f09024f

.field public static A0:I = 0x7f0906cc

.field public static A1:I = 0x7f090bc0

.field public static A2:I = 0x7f090f0c

.field public static A3:I = 0x7f090f5a

.field public static B:I = 0x7f09028c

.field public static B0:I = 0x7f0906e1

.field public static B1:I = 0x7f090bd9

.field public static B2:I = 0x7f090f0d

.field public static B3:I = 0x7f090f5b

.field public static C:I = 0x7f0902b3

.field public static C0:I = 0x7f0906e8

.field public static C1:I = 0x7f090be8

.field public static C2:I = 0x7f090f10

.field public static C3:I = 0x7f090f5c

.field public static D:I = 0x7f0902c4

.field public static D0:I = 0x7f090705

.field public static D1:I = 0x7f090c25

.field public static D2:I = 0x7f090f11

.field public static D3:I = 0x7f090f5d

.field public static E:I = 0x7f0902c9

.field public static E0:I = 0x7f090715

.field public static E1:I = 0x7f090c2e

.field public static E2:I = 0x7f090f12

.field public static E3:I = 0x7f090f5f

.field public static F:I = 0x7f0902d0

.field public static F0:I = 0x7f090785

.field public static F1:I = 0x7f090c30

.field public static F2:I = 0x7f090f13

.field public static F3:I = 0x7f090f60

.field public static G:I = 0x7f0902d1

.field public static G0:I = 0x7f09079a

.field public static G1:I = 0x7f090c48

.field public static G2:I = 0x7f090f14

.field public static G3:I = 0x7f090fa7

.field public static H:I = 0x7f09037f

.field public static H0:I = 0x7f09079b

.field public static H1:I = 0x7f090c49

.field public static H2:I = 0x7f090f15

.field public static H3:I = 0x7f090fbe

.field public static I:I = 0x7f0903aa

.field public static I0:I = 0x7f0907a7

.field public static I1:I = 0x7f090c4a

.field public static I2:I = 0x7f090f16

.field public static I3:I = 0x7f090fe2

.field public static J:I = 0x7f0903e5

.field public static J0:I = 0x7f0907a9

.field public static J1:I = 0x7f090c4c

.field public static J2:I = 0x7f090f17

.field public static J3:I = 0x7f090fe3

.field public static K:I = 0x7f0903eb

.field public static K0:I = 0x7f0907c2

.field public static K1:I = 0x7f090c51

.field public static K2:I = 0x7f090f18

.field public static K3:I = 0x7f090fe4

.field public static L:I = 0x7f090485

.field public static L0:I = 0x7f0907c3

.field public static L1:I = 0x7f090c57

.field public static L2:I = 0x7f090f19

.field public static L3:I = 0x7f091000

.field public static M:I = 0x7f090496

.field public static M0:I = 0x7f0907c9

.field public static M1:I = 0x7f090c58

.field public static M2:I = 0x7f090f1a

.field public static M3:I = 0x7f09100c

.field public static N:I = 0x7f0904d0

.field public static N0:I = 0x7f0907dd

.field public static N1:I = 0x7f090c68

.field public static N2:I = 0x7f090f1b

.field public static N3:I = 0x7f09100d

.field public static O:I = 0x7f0904d5

.field public static O0:I = 0x7f0907eb

.field public static O1:I = 0x7f090c73

.field public static O2:I = 0x7f090f1d

.field public static O3:I = 0x7f091032

.field public static P:I = 0x7f0904e0

.field public static P0:I = 0x7f0907ee

.field public static P1:I = 0x7f090c7f

.field public static P2:I = 0x7f090f1e

.field public static P3:I = 0x7f091034

.field public static Q:I = 0x7f0904eb

.field public static Q0:I = 0x7f0907f4

.field public static Q1:I = 0x7f090c90

.field public static Q2:I = 0x7f090f1f

.field public static Q3:I = 0x7f09103e

.field public static R:I = 0x7f0904ec

.field public static R0:I = 0x7f0907fe

.field public static R1:I = 0x7f090ca0

.field public static R2:I = 0x7f090f21

.field public static R3:I = 0x7f09105e

.field public static S:I = 0x7f0904f9

.field public static S0:I = 0x7f090801

.field public static S1:I = 0x7f090cee

.field public static S2:I = 0x7f090f27

.field public static S3:I = 0x7f09107d

.field public static T:I = 0x7f090524

.field public static T0:I = 0x7f09080f

.field public static T1:I = 0x7f090cf5

.field public static T2:I = 0x7f090f2b

.field public static T3:I = 0x7f09108f

.field public static U:I = 0x7f090533

.field public static U0:I = 0x7f090810

.field public static U1:I = 0x7f090cf6

.field public static U2:I = 0x7f090f2c

.field public static U3:I = 0x7f091091

.field public static V:I = 0x7f090536

.field public static V0:I = 0x7f09081b

.field public static V1:I = 0x7f090cf7

.field public static V2:I = 0x7f090f2d

.field public static V3:I = 0x7f0910ae

.field public static W:I = 0x7f090537

.field public static W0:I = 0x7f090820

.field public static W1:I = 0x7f090cf8

.field public static W2:I = 0x7f090f2e

.field public static W3:I = 0x7f0910b0

.field public static X:I = 0x7f090538

.field public static X0:I = 0x7f09082a

.field public static X1:I = 0x7f090cf9

.field public static X2:I = 0x7f090f2f

.field public static X3:I = 0x7f0910b1

.field public static Y:I = 0x7f090557

.field public static Y0:I = 0x7f090835

.field public static Y1:I = 0x7f090cfa

.field public static Y2:I = 0x7f090f30

.field public static Y3:I = 0x7f0910d7

.field public static Z:I = 0x7f090558

.field public static Z0:I = 0x7f09083f

.field public static Z1:I = 0x7f090cfb

.field public static Z2:I = 0x7f090f34

.field public static Z3:I = 0x7f0910ef

.field public static a:I = 0x7f0900d4

.field public static a0:I = 0x7f090559

.field public static a1:I = 0x7f090848

.field public static a2:I = 0x7f090cfc

.field public static a3:I = 0x7f090f36

.field public static a4:I = 0x7f09111a

.field public static b:I = 0x7f0900d5

.field public static b0:I = 0x7f09055a

.field public static b1:I = 0x7f090887

.field public static b2:I = 0x7f090cfd

.field public static b3:I = 0x7f090f37

.field public static b4:I = 0x7f091124

.field public static c:I = 0x7f0900d6

.field public static c0:I = 0x7f09055f

.field public static c1:I = 0x7f09089a

.field public static c2:I = 0x7f090cfe

.field public static c3:I = 0x7f090f38

.field public static c4:I = 0x7f09112a

.field public static d:I = 0x7f0900d8

.field public static d0:I = 0x7f090560

.field public static d1:I = 0x7f0908cc

.field public static d2:I = 0x7f090d3c

.field public static d3:I = 0x7f090f39

.field public static d4:I = 0x7f09112b

.field public static e:I = 0x7f0900d9

.field public static e0:I = 0x7f090562

.field public static e1:I = 0x7f0908cf

.field public static e2:I = 0x7f090d49

.field public static e3:I = 0x7f090f3a

.field public static e4:I = 0x7f091130

.field public static f:I = 0x7f0900dd

.field public static f0:I = 0x7f090563

.field public static f1:I = 0x7f0908d2

.field public static f2:I = 0x7f090e43

.field public static f3:I = 0x7f090f3b

.field public static f4:I = 0x7f091141

.field public static g:I = 0x7f0900df

.field public static g0:I = 0x7f090564

.field public static g1:I = 0x7f0908d6

.field public static g2:I = 0x7f090e5e

.field public static g3:I = 0x7f090f3c

.field public static g4:I = 0x7f09114f

.field public static h:I = 0x7f0900e1

.field public static h0:I = 0x7f090565

.field public static h1:I = 0x7f0908fd

.field public static h2:I = 0x7f090e5f

.field public static h3:I = 0x7f090f3d

.field public static h4:I = 0x7f09115f

.field public static i:I = 0x7f0900e8

.field public static i0:I = 0x7f090566

.field public static i1:I = 0x7f090907

.field public static i2:I = 0x7f090e60

.field public static i3:I = 0x7f090f3e

.field public static i4:I = 0x7f091173

.field public static j:I = 0x7f090113

.field public static j0:I = 0x7f090567

.field public static j1:I = 0x7f090910

.field public static j2:I = 0x7f090ea4

.field public static j3:I = 0x7f090f3f

.field public static j4:I = 0x7f091192

.field public static k:I = 0x7f09015c

.field public static k0:I = 0x7f090568

.field public static k1:I = 0x7f090918

.field public static k2:I = 0x7f090ea6

.field public static k3:I = 0x7f090f40

.field public static k4:I = 0x7f091216

.field public static l:I = 0x7f09015d

.field public static l0:I = 0x7f09056a

.field public static l1:I = 0x7f09091b

.field public static l2:I = 0x7f090eb7

.field public static l3:I = 0x7f090f41

.field public static l4:I = 0x7f091222

.field public static m:I = 0x7f09015e

.field public static m0:I = 0x7f09056b

.field public static m1:I = 0x7f090931

.field public static m2:I = 0x7f090ec9

.field public static m3:I = 0x7f090f42

.field public static m4:I = 0x7f091224

.field public static n:I = 0x7f090174

.field public static n0:I = 0x7f09056c

.field public static n1:I = 0x7f090965

.field public static n2:I = 0x7f090ef5

.field public static n3:I = 0x7f090f43

.field public static n4:I = 0x7f09123c

.field public static o:I = 0x7f090175

.field public static o0:I = 0x7f09056d

.field public static o1:I = 0x7f0909b0

.field public static o2:I = 0x7f090efd

.field public static o3:I = 0x7f090f44

.field public static o4:I = 0x7f091264

.field public static p:I = 0x7f090176

.field public static p0:I = 0x7f09056e

.field public static p1:I = 0x7f0909b1

.field public static p2:I = 0x7f090eff

.field public static p3:I = 0x7f090f45

.field public static p4:I = 0x7f091268

.field public static q:I = 0x7f09017c

.field public static q0:I = 0x7f09056f

.field public static q1:I = 0x7f0909ef

.field public static q2:I = 0x7f090f01

.field public static q3:I = 0x7f090f46

.field public static q4:I = 0x7f091277

.field public static r:I = 0x7f09017d

.field public static r0:I = 0x7f090570

.field public static r1:I = 0x7f090a35

.field public static r2:I = 0x7f090f03

.field public static r3:I = 0x7f090f47

.field public static r4:I = 0x7f09128d

.field public static s:I = 0x7f090182

.field public static s0:I = 0x7f090589

.field public static s1:I = 0x7f090a41

.field public static s2:I = 0x7f090f04

.field public static s3:I = 0x7f090f49

.field public static s4:I = 0x7f091353

.field public static t:I = 0x7f090183

.field public static t0:I = 0x7f0905b3

.field public static t1:I = 0x7f090a73

.field public static t2:I = 0x7f090f05

.field public static t3:I = 0x7f090f4a

.field public static t4:I = 0x7f091358

.field public static u:I = 0x7f090186

.field public static u0:I = 0x7f0905b4

.field public static u1:I = 0x7f090aa9

.field public static u2:I = 0x7f090f06

.field public static u3:I = 0x7f090f4d

.field public static u4:I = 0x7f09135d

.field public static v:I = 0x7f090187

.field public static v0:I = 0x7f0905b5

.field public static v1:I = 0x7f090ba7

.field public static v2:I = 0x7f090f07

.field public static v3:I = 0x7f090f4f

.field public static w:I = 0x7f09018d

.field public static w0:I = 0x7f0905b6

.field public static w1:I = 0x7f090bb2

.field public static w2:I = 0x7f090f08

.field public static w3:I = 0x7f090f50

.field public static x:I = 0x7f0901da

.field public static x0:I = 0x7f090657

.field public static x1:I = 0x7f090bb3

.field public static x2:I = 0x7f090f09

.field public static x3:I = 0x7f090f55

.field public static y:I = 0x7f090230

.field public static y0:I = 0x7f09065b

.field public static y1:I = 0x7f090bb4

.field public static y2:I = 0x7f090f0a

.field public static y3:I = 0x7f090f58

.field public static z:I = 0x7f09024e

.field public static z0:I = 0x7f090672

.field public static z1:I = 0x7f090bbf

.field public static z2:I = 0x7f090f0b

.field public static z3:I = 0x7f090f59

不难看出，在b6h中的引用是l，在l6h中的引用是M
由于它们的对象都是只有一个字母，整个应用里面找简直是大海捞针。因此有个简单的方法就是直接去搜索它们引用所在的类，因为变量名整个应用内会有海量重复，而类名一定是唯一的。
就像这样：

这就好确定多了，然后我们再次筛选当前所有搜索结果中包含在b6h中的引用b6h;->l。选择“在当前结果中搜索”：

（搜索最好把区分大小写也给打开，博主这里没开。不过搜索结果很少的情况下也能直接看出来哪个是自己想要的）
显而易见，SettingActivity类就是我们想要的结果了，整个过程跟CE修改器定位游戏内存的道理是一样的。

使用MT管理器的转Java功能，将smail指令文件转换为更加可读的java代码后查找b6h的引用：


相关代码：

/* JADX WARN: Multi-variable type inference failed */
    public void z8(EditText editText, View view) {
        JSONArray a;
        if (wud.a(editText.getText().toString()).equals("98ee0e015e720c5ada2376a0afce625b")) {
            this.K.cancel();
            String config = ConfigManager.getConfig("setting.release_show_debug_panel", "");
            if (!config.isEmpty() && (a = hxb.a(config)) != null) {
                String valueOf = String.valueOf(xs1.e(this).r());
                int size = a.size();
                for (int i = 0; i < size; i++) {
                    if (a.getString(i).equals(valueOf)) {
                        startActivity(new Intent((Context) this, (Class<?>) DebugActivity.class));
                        return;
                    }
                }
            }
            n3k.d(this, "你没有权限", 2000).h();
        }
    }

可以看到是通过对比密码的MD5进行正确性验证的，如果输入的密码的MD5和98ee0e015e720c5ada2376a0afce625b相同的话再检测debug配置项后启动一个Actiity。这个Activity就是调试功能页了。
太安全了，这样到头来还是不知道密码是什么，看不了开发者选项力（悲）。如果有root设备的话倒是可以直接通过启动Activity的方式进入。
就这样，结束。