文章总结： 本文介绍了使用jadx进行AndroidAPP反编译静态分析的方法，涵盖Windows和Mac下的安装与启动。详细讲解了针对未加固及加固APP的分析步骤，并提供了dex2jar脚本用于批量将DEX转换为JAR以便于进一步分析，适合移动安全入门学习。 综合评分： 85 文章分类： 逆向分析,移动安全,安全工具
【APP解密系列】04 APP反编译静态分析
原创
GSCL GSCL
GSCL Sec
2026年2月2日 08:02 甘肃
APP反编译静态分析
引言
jadx 是用于从 Android Dex 和 Apk 文件中生成 Java 源代码的命令行和图形用户界面工具，DEX是编译后的Android APP源代码，jadx就是反编译工具，将编译后的DEX文件反编译为可读的JAVA代码。
安装
Windows系统 直接去Github的releases中下载即可，图形化即jadx-gui https://github.com/skylot/jadx/releases/tag/v1.5.3 Macos系统 直接安装即可使用 brew install jadx
启动
直接命令行jadx-gui即可启动应用，windows打开对应的exe文件即可
未加固的APP
直接将apk文件拖入jadx工具既可打开分析
加固的APP
参考前面的文章APP脱壳【APP解密系列】02 APP脱壳
将APP脱壳之后，会形成dex文件
将整个文件夹拖入jadx既可进行简单的分析
如何批量将dex文件转换为jar文件
dex 仅适配安卓运行环境，如何将其转换为适配性更强的jar文件呢 借助dex2jar工具，解压并将其放置到脚本目录下 官方下载链接： https://github.com/pxb1988/dex2jar/releases
MAC下脚本
#!/usr/bin/env bash## 批量将 DEX 转为 JAR，并合并为一个 JAR# 优先使用 dex2jar（快），未安装时使用当前目录的 enjarify## 用法: ./dex2jar_merge.sh [DEX目录] [输出JAR路径]# 参数1: 输入的 dex 文件所在目录，默认为脚本运行时的当前目录# 参数2: 输出的合并 JAR 文件路径，默认为当前目录下的 merged.jar#set -eSCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"RUN_DIR="$(pwd)"ENJARIFY_DIR="$SCRIPT_DIR/enjarify"INPUT_DIR="${1:-$RUN_DIR}"OUTPUT_JAR="${2:-$RUN_DIR/merged.jar}"JAR_STAGE="$SCRIPT_DIR/.jar_stage"MERGE_DIR="$SCRIPT_DIR/.merge_tmp"if [[ "$1" == "-h" ]] || [[ "$1" == "--help" ]]; then echo "用法: $0 [DEX目录] [输出JAR路径]" echo " DEX目录 输入的 .dex 文件所在目录（默认: 当前目录）" echo " 输出JAR 合并后的 JAR 文件路径（默认: 当前目录/merged.jar）" echo "示例: $0 /path/to/dex_dir /path/to/out.jar" exit 0fi# 强制使用 enjarify 时可设置: USE_ENJARIFY=1 ./dex2jar_merge.shUSE_ENJARIFY="${USE_ENJARIFY:-0}"# 选择转换工具：优先 dex2jar（快很多），自动找当前目录下的 dex-toolsD2J_CMD=""if [[ "$USE_ENJARIFY" != "1" ]]; then if [[ -n "$DEX2JAR_HOME" ]] && [[ -x "$DEX2JAR_HOME/d2j-dex2jar.sh" ]]; then D2J_CMD="$DEX2JAR_HOME/d2j-dex2jar.sh" else # 当前目录下查找 dex-tools-* 或 dex-tools* for dir in "$SCRIPT_DIR"/dex-tools*; do if [[ -d "$dir" ]] && [[ -x "$dir/d2j-dex2jar.sh" ]]; then D2J_CMD="$dir/d2j-dex2jar.sh" break fi done fi if [[ -z "$D2J_CMD" ]]; then command -v d2j-dex2jar &>/dev/null && D2J_CMD="d2j-dex2jar" [[ -z "$D2J_CMD" ]] && command -v d2j-dex2jar.sh &>/dev/null && D2J_CMD="d2j-dex2jar.sh" fifiif [[ -n "$D2J_CMD" ]]; then CONVERTER="dex2jar"else if [[ ! -f "$ENJARIFY_DIR/enjarify.sh" ]]; then echo "错误: 未找到转换工具" echo "方案一（推荐，更快）: 将 dex-tools 解压到当前目录（如 dex-tools-v2.4/）" echo " 下载: https://github.com/pxb1988/dex2jar/releases" echo "方案二: 将 enjarify 放在当前目录的 enjarify/ 下" exit 1 fi CONVERTER="enjarify"firm -rf "$JAR_STAGE" "$MERGE_DIR"mkdir -p "$JAR_STAGE" "$MERGE_DIR"# 无论正常退出还是报错，都删除中间目录，只保留最终 JARtrap 'rm -rf "$JAR_STAGE" "$MERGE_DIR"' EXITecho "输入目录: $INPUT_DIR"echo "输出 JAR: $OUTPUT_JAR"echo ""echo "=== 1/2 批量 DEX -> JAR（$CONVERTER）==="count=0for dex in "$INPUT_DIR"/*.dex; do [[ -f "$dex" ]] || continue name=$(basename "$dex" .dex) out="$JAR_STAGE/${name}.jar" echo "[$((++count))] $(basename "$dex") -> $(basename "$out")" if [[ "$CONVERTER" == "dex2jar" ]]; then "$D2J_CMD" -f -o "$out" "$dex" || { echo " 失败: $dex"; exit 1; } else ( cd "$ENJARIFY_DIR" export PYTHONPATH="$ENJARIFY_DIR" python3 -O -m enjarify.main -o "$out" -f "$dex" ) || { echo " 失败: $dex"; exit 1; } fidoneif [[ $count -eq 0 ]]; then echo "未找到任何 .dex 文件" exit 1fiecho ""echo "=== 2/2 合并为单个 JAR ==="# 用 jar 解压/打包，避免 unzip 对 JAR 内中文等 UTF-8 文件名报 Illegal byte sequenceif command -v jar &>/dev/null; then for jar in "$JAR_STAGE"/*.jar; do [[ -f "$jar" ]] || continue echo " 解包: $(basename "$jar")" (cd "$MERGE_DIR" && jar xf "$jar") rm -f "$jar" done echo " 打包: $OUTPUT_JAR" (cd "$MERGE_DIR" && jar cf "$OUTPUT_JAR" .)else export LC_ALL=en_US.UTF-8 for jar in "$JAR_STAGE"/*.jar; do [[ -f "$jar" ]] || continue echo " 解包: $(basename "$jar")" unzip -o -q "$jar" -d "$MERGE_DIR" rm -f "$jar" done echo " 打包: $OUTPUT_JAR" (cd "$MERGE_DIR" && zip -r -q "$OUTPUT_JAR" .)fiecho ""echo "完成: 共转换 $count 个 DEX，已合并为 $OUTPUT_JAR"
Windwos下脚本
@echo offsetlocal EnableDelayedExpansionchcp 65001 >nultitle DEX to JAR Merge:: ============================================================:: Batch script: convert DEX to JAR and merge into one JAR:: Same behavior as dex2jar_merge.sh on Linux/Mac:::: Usage: dex2jar_merge.bat [DEX_dir] [output_jar]:: Arg1: directory containing .dex files (default: current dir):: Arg2: path of merged output JAR (default: current_dir\merged.jar):: ============================================================:: Script dir (no trailing backslash for easier concat)set "SCRIPT_DIR=%~dp0"if "%SCRIPT_DIR:~-1%"=="\" set "SCRIPT_DIR=%SCRIPT_DIR:~0,-1%"set "RUN_DIR=%CD%"set "ENJARIFY_DIR=%SCRIPT_DIR%\enjarify":: Parameters: default to current directoryif "%~1"=="" (set "INPUT_DIR=%RUN_DIR%") else (set "INPUT_DIR=%~1")if "%~2"=="" (set "OUTPUT_JAR=%RUN_DIR%\merged.jar") else (set "OUTPUT_JAR=%~2"):: Normalize paths (remove trailing backslash for INPUT_DIR)if "%INPUT_DIR:~-1%"=="\" set "INPUT_DIR=%INPUT_DIR:~0,-1%":: Helpif "%~1"=="-h" goto :helpif "%~1"=="--help" goto :helpif "%~1"=="/?" goto :help:: Temp dirs (under script dir, same as .sh)set "JAR_STAGE=%SCRIPT_DIR%\.jar_stage"set "MERGE_DIR=%SCRIPT_DIR%\.merge_tmp":: Resolve converter: dex2jar (prefer) or enjarifyset "D2J_CMD="if not "%USE_ENJARIFY%"=="1" ( if defined DEX2JAR_HOME ( if exist "!DEX2JAR_HOME!\d2j-dex2jar.bat" set "D2J_CMD=!DEX2JAR_HOME!\d2j-dex2jar.bat" ) if "!D2J_CMD!"=="" ( for /d %%D in ("%SCRIPT_DIR%\dex-tools*") do ( if exist "%%~D\d2j-dex2jar.bat" ( set "D2J_CMD=%%~D\d2j-dex2jar.bat" goto :d2j_found ) ) :: Also check run dir (current dir) for dex-tools for /d %%D in ("%RUN_DIR%\dex-tools*") do ( if exist "%%~D\d2j-dex2jar.bat" ( set "D2J_CMD=%%~D\d2j-dex2jar.bat" goto :d2j_found ) ) where d2j-dex2jar.bat >nul 2>&1 && set "D2J_CMD=d2j-dex2jar.bat" where d2j-dex2jar >nul 2>&1 && set "D2J_CMD=d2j-dex2jar" ) :d2j_found)if defined D2J_CMD ( set "CONVERTER=dex2jar") else ( if not exist "%ENJARIFY_DIR%\enjarify.sh" ( if not exist "%ENJARIFY_DIR%\enjarify\main.py" ( echo Error: No converter found. echo Option 1: Extract dex-tools to script dir or current dir ^(e.g. dex-tools-v2.4^) echo Download: https://github.com/pxb1988/dex2jar/releases echo Option 2: Put enjarify in script_dir\enjarify\ exit /b 1 ) ) set "CONVERTER=enjarify"):: Clean and create temp dirsif exist "%JAR_STAGE%" rd /s /q "%JAR_STAGE%"if exist "%MERGE_DIR%" rd /s /q "%MERGE_DIR%"mkdir "%JAR_STAGE%"mkdir "%MERGE_DIR%"echo Input dir: %INPUT_DIR%echo Output JAR: %OUTPUT_JAR%echo.echo === 1/2 DEX -^> JAR ^(%CONVERTER%^) ===set "count=0"for %%f in ("%INPUT_DIR%\*.dex") do ( set /a count+=1 set "name=%%~nf" set "out=%JAR_STAGE%\!name!.jar" echo [!count!] %%~nxf -^> !name!.jar if "!CONVERTER!"=="dex2jar" ( call "!D2J_CMD!" -f -o "!out!" "%%f" if errorlevel 1 ( echo Failed: %%f & goto :cleanup_err ) ) else ( pushd "%ENJARIFY_DIR%" set "PYTHONPATH=%ENJARIFY_DIR%" python -O -m enjarify.main -o "!out!" -f "%%f" set "pyerr=!errorlevel!" popd if !pyerr! neq 0 ( echo Failed: %%f & goto :cleanup_err ) ))if %count% equ 0 ( echo No .dex files found. goto :cleanup_err)echo.echo === 2/2 Merge into one JAR ===:: Prefer jar (Java) to avoid encoding issues with non-ASCII nameswhere jar >nul 2>&1if %errorlevel% equ 0 ( for %%j in ("%JAR_STAGE%\*.jar") do ( echo Extract: %%~nxj pushd "%MERGE_DIR%" jar xf "%%j" popd del /f /q "%%j" ) echo Pack: %OUTPUT_JAR% for %%A in ("%OUTPUT_JAR%") do ( set "OUT_DIR=%%~dpA" if not "%%~dpA"=="" if not exist "%%~dpA" mkdir "%%~dpA" ) pushd "%MERGE_DIR%" jar cf "%OUTPUT_JAR%" . popd) else ( :: Fallback: PowerShell Expand-Archive or leave merge to user echo Using jar is recommended ^(install JDK^). Checking for jar... for %%j in ("%JAR_STAGE%\*.jar") do ( echo Extract: %%~nxj powershell -NoProfile -Command "Expand-Archive -Path '%%j' -DestinationPath '%MERGE_DIR%' -Force" del /f /q "%%j" ) for %%A in ("%OUTPUT_JAR%") do ( set "OUT_DIR=%%~dpA" if not "%%~dpA"=="" if not exist "%%~dpA" mkdir "%%~dpA" ) powershell -NoProfile -Command "Compress-Archive -Path \"%MERGE_DIR%\*\" -DestinationPath \"%OUTPUT_JAR%\" -Force")echo.echo Done: %count% DEX merged into %OUTPUT_JAR%goto :cleanup_ok:cleanup_errecho.echo Aborted or failed.rd /s /q "%JAR_STAGE%" 2>nulrd /s /q "%MERGE_DIR%" 2>nulexit /b 1:cleanup_okrd /s /q "%JAR_STAGE%" 2>nulrd /s /q "%MERGE_DIR%" 2>nulexit /b 0:helpecho Usage: %~nx0 [DEX_dir] [output_jar]echo DEX_dir Directory containing .dex files ^(default: current dir^)echo output_jar Path of merged JAR ^(default: current_dir\merged.jar^)echo Example: %~nx0 C:\dex_files C:\out\merged.jarecho.echo Set DEX2JAR_HOME to use dex-tools from another location.echo Set USE_ENJARIFY=1 to force enjarify instead of dex2jar.exit /b 0
./dex2jar_merge.sh [DEX目录] [输出JAR路径]
即可直接生成jar文件
免责说明
本公众号提供的信息仅供学习和研究之用，不支持非法活动。使用者自行承担所有风险和责任。本公众号不对因使用相关信息造成的任何损失负责。
本文所有工具获取
工具下载链接，公众号回复0201
如果我分享的内容可以帮到你，欢迎一键三连（点赞+关注+星标）
免责声明：
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。
任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。
本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。
本文转载自：GSCL Sec GSCL GSCL《【APP解密系列】04 APP反编译静态分析》
版权声明
本站仅做备份收录，仅供研究与教学参考之用。
读者将信息用于其他用途的，全部法律及连带责任由读者自行承担，本站不承担任何责任。
评论