文章总结： 本文介绍了在Nexus6p手机上制作FART脱壳机的完整过程，包括解决刷机失败问题的方法、详细的刷机脚本以及测试效果展示。FART脱壳机是一种移动安全逆向分析工具，能够动态追踪并记录Android应用运行时的类加载和方法调用信息，帮助安全研究人员分析加壳应用。文章提供了实际操作步骤和脱壳日志示例，展示了工具在实际应用中的效果。 综合评分： 84 文章分类： 移动安全,逆向分析,安全工具

移动安全 | FART脱壳机制作

老梁

LTAC

2025年12月15日 22:14 山东

手机型号：Nexus 6p
项目地址：https://github.com/hanbinglengyue/FART

之前老卡在开机界面，猜测刷机失败的可能原因如下

fastboot -w update image-angler-opr6.170623.013.zip

fastboot update zip 依赖ZIP包的完整性和校验手动替换ZIP内的img后，ZIP的元数据或校验和可能不匹配，fastboot可能拒绝刷入或刷入不完整,即使某些分区刷入失败，命令也可能返回成功,于是下面采用直接Flash各分区的方式

@ECHO OFF
:: FART脱壳机直刷脚本（保留核心功能，简化格式）
PATH=%PATH%;"%SYSTEMROOT%\System32"

echo ==============================
echo FART脱壳机直刷脚本
echo ==============================
echo 警告：此操作会清空手机所有数据！
pause >nul

echo.
echo [1/6] 刷写Bootloader...
fastboot flash bootloader bootloader-angler-angler-03.73.img
if %errorlevel% neq 0 (echo 错误：Bootloader刷写失败！& pause & exit /b 1)

echo.
echo [2/6] 重启到Bootloader...
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul

echo.
echo [3/6] 刷写Radio...
fastboot flash radio radio-angler-angler-03.84.img
if %errorlevel% neq 0 (echo 错误：Radio刷写失败！& pause & exit /b 1)

echo.
echo [4/6] 重启到Bootloader...
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul

echo.
echo [5/6] 清空数据并刷写分区...
fastboot -w

echo 刷写Boot分区...
fastboot flash boot boot.img
if %errorlevel% neq 0 (echo 错误：Boot分区刷写失败！& pause & exit /b 1)

echo 刷写Recovery分区...
fastboot flash recovery recovery.img
if %errorlevel% neq 0 (echo 错误：Recovery分区刷写失败！& pause & exit /b 1)

echo 刷写System分区（需等待几分钟）...
fastboot flash system system.img
if %errorlevel% neq 0 (echo 错误：System分区刷写失败！& pause & exit /b 1)

echo 刷写Vendor分区...
fastboot flash vendor vendor.img
if %errorlevel% neq 0 (echo 错误：Vendor分区刷写失败！& pause & exit /b 1)

echo.
echo [6/6] 重启系统...
fastboot reboot

echo.
echo ==============================
echo 刷机完成！手机重启中...
echo ==============================
pause >nul

测试效果：

image

脱壳日志截取：

01-03 00:46:56.504  5300  5572 V ActivityThread: fart->try load class:androidx.lifecycle.FlowLiveDataConversions$asLiveData$1$invokeSuspend$$inlined$collect$1$1
01-03 00:46:56.612  5300  5572 I zygote64: ArtMethod::dumpArtMethodinvoked,methodname:void androidx.lifecycle.Lifecycle.addObserver(androidx.lifecycle.LifecycleObserver)from:ArtMethod:Invoke from myfartinvoke
01-03 00:46:56.750  5300  5572 I zygote64: ArtMethod::dumpArtMethodinvoked,methodname:androidx.lifecycle.Lifecycle androidx.lifecycle.LifecycleOwner.getLifecycle()from:ArtMethod:Invoke from myfartinvoke
01-03 00:46:56.750  5300  5572 V ActivityThread: fart->try load class:androidx.lifecycle.LifecycleOwnerKt
01-03 00:46:56.750  5300  5572 I zygote64: art_method.cc::Invoke is invoked by myfartinvoke:methodname:androidx.lifecycle.LifecycleCoroutineScope androidx.lifecycle.LifecycleOwnerKt.getLifecycleScope(androidx.lifecycle.LifecycleOwner)
01-03 00:46:56.750  5300  5572 I zygote64: ArtMethod::dumpArtMethodinvoked,methodname:androidx.lifecycle.LifecycleCoroutineScope androidx.lifecycle.LifecycleOwnerKt.getLifecycleScope(androidx.lifecycle.LifecycleOwner)from:ArtMethod:Invoke from myfartinvoke
01-03 00:46:56.752  5300  5572 V ActivityThread: fart->try load class:androidx.lifecycle.LifecycleRegistry$ObserverWithState
01-03 00:46:56.752 &nbsp;5300 &nbsp;5572 I zygote64: art_method.cc::Invoke is invoked by myfartinvoke:methodname:void androidx.lifecycle.LifecycleRegistry$ObserverWithState.<init>(androidx.lifecycle.LifecycleObserver, androidx.lifecycle.Lifecycle$State)
01-03 00:46:56.753 &nbsp;5300 &nbsp;5572 I zygote64: ArtMethod::dumpArtMethodinvoked,methodname:void androidx.lifecycle.LifecycleRegistry$ObserverWithState.<init>(androidx.lifecycle.LifecycleObserver, androidx.lifecycle.Lifecycle$State)from:ArtMethod:Invoke from myfartinvoke
01-03 00:46:56.753 &nbsp;5300 &nbsp;5337 I zygote64: art_method.cc::Invoke is invoked by myfartinvoke:methodname:void com.bat.base.intent.share.FileShareProcessReceiver$Companion.<init>(kotlin.jvm.internal.DefaultConstructorMarker)
01-03 00:46:56.753 &nbsp;5300 &nbsp;5337 I zygote64: ArtMethod::dumpArtMethodinvoked,methodname:void com.bat.base.intent.share.FileShareProcessReceiver$Companion.<init>(kotlin.jvm.internal.DefaultConstructorMarker)from:ArtMethod:Invoke from myfartinvoke
01-03 00:46:56.755 &nbsp;5300 &nbsp;5337 I zygote64: art_method.cc::Invoke is invoked by myfartinvoke:methodname:boolean com.bat.base.intent.share.FileShareProcessReceiver$Companion.a(android.content.Intent)

image

查看原文：《移动安全 | FART脱壳机制作》