[{"data":1,"prerenderedAt":1635},["ShallowReactive",2],{"navigation_docs":3,"-android-hidden-hardening-encrypt-dex":173,"-android-hidden-hardening-encrypt-dex-surround":1630},[4,22,29,36,107,138,145,161],{"title":5,"icon":6,"path":7,"stem":8,"children":9},"博客","i-lucide-pen-line","\u002Fblog","0.blog",[10,12,17],{"title":5,"path":7,"stem":11,"icon":6},"0.blog\u002Findex",{"title":13,"path":14,"stem":15,"icon":16},"创建基于 UIKit 的原生 iOS 项目","\u002Fblog\u002Fcreate-uikit-ios-project","0.blog\u002F01.create-uikit-ios-project","i-lucide-app-window",{"title":18,"path":19,"stem":20,"icon":21},"Lockify：把账号和密码留在自己的手机里","\u002Fblog\u002Flockify","0.blog\u002F02.lockify","i-lucide-lock",{"title":23,"path":24,"stem":25,"children":26,"icon":28},"年度总结","\u002Fannual-review","1.annual-review\u002Findex",[27],{"title":23,"path":24,"stem":25,"icon":28},"i-lucide-git-commit",{"title":30,"path":31,"stem":32,"children":33,"icon":35},"故事","\u002Fstories","2.stories\u002Findex",[34],{"title":30,"path":31,"stem":32,"icon":35},"i-lucide-feather",{"title":37,"icon":38,"path":39,"stem":40,"children":41},"Android","i-simple-icons-android","\u002Fandroid","3.android",[42,44,49],{"title":37,"path":39,"stem":43,"icon":38},"3.android\u002Findex",{"title":45,"path":46,"stem":47,"icon":48},"初探Navigation","\u002Fandroid\u002Fcompose-navigation","3.android\u002F01.compose-navigation","i-lucide-route",{"title":50,"icon":51,"path":52,"stem":53,"children":54},"安卓代码加固","i-lucide-shield","\u002Fandroid\u002Fhidden-hardening","3.android\u002F02.hidden-hardening\u002Findex",[55,58,62,67,72,77,82,87,92,97,102],{"title":56,"path":52,"stem":53,"icon":57},"安卓代码加固：总览","i-lucide-map",{"title":59,"path":60,"stem":61,"icon":21},"安卓代码加固（1）：加密DEX","\u002Fandroid\u002Fhidden-hardening\u002Fencrypt-dex","3.android\u002F02.hidden-hardening\u002F01.encrypt-dex",{"title":63,"path":64,"stem":65,"icon":66},"安卓代码加固（2）：Native解密","\u002Fandroid\u002Fhidden-hardening\u002Fnative-decrypt","3.android\u002F02.hidden-hardening\u002F02.native-decrypt","i-lucide-cpu",{"title":68,"path":69,"stem":70,"icon":71},"安卓代码加固（3）：内存加载","\u002Fandroid\u002Fhidden-hardening\u002Fmemory-load","3.android\u002F02.hidden-hardening\u002F03.memory-load","i-lucide-memory-stick",{"title":73,"path":74,"stem":75,"icon":76},"安卓代码加固（4）：指令分发","\u002Fandroid\u002Fhidden-hardening\u002Fopcode-dispatch","3.android\u002F02.hidden-hardening\u002F04.opcode-dispatch","i-lucide-hash",{"title":78,"path":79,"stem":80,"icon":81},"安卓代码加固（5）：XOR混淆","\u002Fandroid\u002Fhidden-hardening\u002Fxor-obfuscate","3.android\u002F02.hidden-hardening\u002F05.xor-obfuscate","i-lucide-shuffle",{"title":83,"path":84,"stem":85,"icon":86},"安卓代码加固（6）：密钥外置","\u002Fandroid\u002Fhidden-hardening\u002Fkey-external","3.android\u002F02.hidden-hardening\u002F06.key-external","i-lucide-key",{"title":88,"path":89,"stem":90,"icon":91},"安卓代码加固（7）：依赖隔离","\u002Fandroid\u002Fhidden-hardening\u002Fdep-isolate","3.android\u002F02.hidden-hardening\u002F07.dep-isolate","i-lucide-layers",{"title":93,"path":94,"stem":95,"icon":96},"安卓代码加固（8）：构建校验","\u002Fandroid\u002Fhidden-hardening\u002Fbuild-verify","3.android\u002F02.hidden-hardening\u002F08.build-verify","i-lucide-shield-check",{"title":98,"path":99,"stem":100,"icon":101},"安卓代码加固（9）：防录屏","\u002Fandroid\u002Fhidden-hardening\u002Fflag-secure","3.android\u002F02.hidden-hardening\u002F09.flag-secure","i-lucide-eye-off",{"title":103,"path":104,"stem":105,"icon":106},"安卓代码加固（10）：ABI门禁","\u002Fandroid\u002Fhidden-hardening\u002Fabi-gate","3.android\u002F02.hidden-hardening\u002F10.abi-gate","i-lucide-git-compare",{"title":108,"icon":109,"path":110,"stem":111,"children":112},"iOS","i-simple-icons-apple","\u002Fios","4.ios",[113,115,120,125,129,133],{"title":108,"path":110,"stem":114,"icon":109},"4.ios\u002Findex",{"title":116,"path":117,"stem":118,"icon":119},"iOS面试题1","\u002Fios\u002Fios-interview1","4.ios\u002F01.ios-interview1","i-lucide-sparkles",{"title":121,"path":122,"stem":123,"icon":124},"设置启动图","\u002Fios\u002Fset-launch-screen","4.ios\u002F02.set-launch-screen","i-lucide-image",{"title":126,"path":127,"stem":128,"icon":48},"路由管理","\u002Fios\u002Frouting","4.ios\u002F03.routing",{"title":130,"path":131,"stem":132,"icon":91},"状态管理","\u002Fios\u002Fstate-management","4.ios\u002F04.state-management",{"title":134,"path":135,"stem":136,"icon":137},"事件传递","\u002Fios\u002Fevent-delivery","4.ios\u002F05.event-delivery","i-lucide-pointer",{"title":139,"path":140,"stem":141,"children":142,"icon":144},"Flutter","\u002Fflutter","5.flutter\u002Findex",[143],{"title":139,"path":140,"stem":141,"icon":144},"i-simple-icons-flutter",{"title":146,"icon":147,"path":148,"stem":149,"children":150,"page":160},"面试","i-lucide-graduation-cap","\u002Finterview","6.interview",[151,156],{"title":152,"path":153,"stem":154,"icon":155},"Flutter面试题1","\u002Finterview\u002Fflutter-interview1","6.interview\u002F01.flutter-interview1","i-lucide-boxes",{"title":157,"path":158,"stem":159,"icon":66},"Flutter面试题2","\u002Finterview\u002Fflutter-interview2","6.interview\u002F02.flutter-interview2",false,{"title":162,"icon":163,"path":164,"stem":165,"children":166},"算法学习","i-lucide-binary","\u002Falgorithm","7.algorithm",[167,169],{"title":162,"path":164,"stem":168,"icon":163},"7.algorithm\u002Findex",{"title":170,"path":171,"stem":172},"算法基础1：复杂度分析","\u002Falgorithm\u002Ftime-space-complexity","7.algorithm\u002F01.time-space-complexity",{"id":174,"title":59,"body":175,"description":1613,"extension":1614,"links":1615,"meta":1618,"navigation":1625,"path":60,"seo":1626,"stem":61,"__hash__":1629},"docs\u002F3.android\u002F02.hidden-hardening\u002F01.encrypt-dex.md",{"type":176,"value":177,"toc":1600},"minimark",[178,199,207,211,214,362,365,373,386,394,397,474,732,740,743,757,1184,1191,1203,1207,1225,1485,1495,1498,1560,1574,1577,1596],[179,180,181,182,186,187,190,191,194,195,198],"p",{},"业务实现不进入主 DEX。",[183,184,185],"code",{},":hidden-landing-page"," 先编成 jar，再用 ",[183,188,189],{},"d8 --release"," 打成 ",[183,192,193],{},"classes.dex","，最后用 AES-256-GCM 写成 ",[183,196,197],{},"assets\u002Fpayload\u002Fhidden.dex.enc","。",[200,201,202,203,206],"note",{},"接入方不用跑这条流水线。更换实现时，在 SDK 仓库重新 ",[183,204,205],{},"assemble","，把新 AAR 交给宿主即可。",[208,209,210],"h2",{"id":210},"密文布局",[179,212,213],{},"Java 加密器固定了 HDX1 头、nonce 长度和 GCM tag 位数。运行时 so 用同一套常量拆开密文。",[215,216,222],"pre",{"className":217,"code":218,"filename":219,"language":220,"meta":221,"style":221},"language-java shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","static final byte[] MAGIC = new byte[] {'H', 'D', 'X', '1'};\nstatic final int NONCE_LEN = 12;\nstatic final int TAG_BITS = 128;\nstatic final int KEY_LEN = 32;\n","tools\u002FPayloadEncryptor.java","java","",[183,223,224,302,324,343],{"__ignoreMap":221},[225,226,229,233,236,239,243,247,250,254,256,258,261,264,268,270,273,276,279,281,283,285,288,290,292,294,297,299],"span",{"class":227,"line":228},"line",1,[225,230,232],{"class":231},"spNyl","static",[225,234,235],{"class":231}," final",[225,237,238],{"class":231}," byte",[225,240,242],{"class":241},"sMK4o","[]",[225,244,246],{"class":245},"sTEyZ"," MAGIC ",[225,248,249],{"class":241},"=",[225,251,253],{"class":252},"s7zQu"," new",[225,255,238],{"class":231},[225,257,242],{"class":241},[225,259,260],{"class":241}," {",[225,262,263],{"class":241},"'",[225,265,267],{"class":266},"sfazB","H",[225,269,263],{"class":241},[225,271,272],{"class":241},",",[225,274,275],{"class":241}," '",[225,277,278],{"class":266},"D",[225,280,263],{"class":241},[225,282,272],{"class":241},[225,284,275],{"class":241},[225,286,287],{"class":266},"X",[225,289,263],{"class":241},[225,291,272],{"class":241},[225,293,275],{"class":241},[225,295,296],{"class":266},"1",[225,298,263],{"class":241},[225,300,301],{"class":241},"};\n",[225,303,305,307,309,312,315,317,321],{"class":227,"line":304},2,[225,306,232],{"class":231},[225,308,235],{"class":231},[225,310,311],{"class":231}," int",[225,313,314],{"class":245}," NONCE_LEN ",[225,316,249],{"class":241},[225,318,320],{"class":319},"sbssI"," 12",[225,322,323],{"class":241},";\n",[225,325,327,329,331,333,336,338,341],{"class":227,"line":326},3,[225,328,232],{"class":231},[225,330,235],{"class":231},[225,332,311],{"class":231},[225,334,335],{"class":245}," TAG_BITS ",[225,337,249],{"class":241},[225,339,340],{"class":319}," 128",[225,342,323],{"class":241},[225,344,346,348,350,352,355,357,360],{"class":227,"line":345},4,[225,347,232],{"class":231},[225,349,235],{"class":231},[225,351,311],{"class":231},[225,353,354],{"class":245}," KEY_LEN ",[225,356,249],{"class":241},[225,358,359],{"class":319}," 32",[225,361,323],{"class":241},[179,363,364],{},"拼出的字节流如下：",[215,366,371],{"className":367,"code":369,"language":370,"meta":221},[368],"language-text","HDX1 (4)  ||  nonce (12)  ||  ciphertext + tag (16)\n","text",[183,372,369],{"__ignoreMap":221},[179,374,375,378,379,382,383,385],{},[183,376,377],{},"HDX1"," 供 Gradle 和自检脚本用文件头判断：这是加密 payload，不是明文 dex。明文 dex 的头是 ",[183,380,381],{},"dex","。如果 APK 里还能搜到以 ",[183,384,381],{}," 开头的 hidden 文件，说明加密没有执行。",[387,388,389,390,393],"warning",{},"每次打包时，nonce 由 ",[183,391,392],{},"SecureRandom"," 重新生成，并写入密文头，不随密钥一起分发。同一份源码打包两次，密文也会不同。",[208,395,396],{"id":396},"构建流水线",[398,399,400,405,415,419,439,443,460,464],"steps",{},[401,402,404],"h3",{"id":403},"编-landing-page-jar","编 landing-page jar",[179,406,407,410,411,414],{},[183,408,409],{},":hidden-sdk"," 依赖 ",[183,412,413],{},":hidden-landing-page:bundleLibRuntimeToJar*","，拿到实现 class。",[401,416,418],{"id":417},"用-d8-打-release-dex","用 d8 打 release dex",[179,420,421,422,425,426,429,430,433,434,438],{},"脚本使用最新 build-tools 中的 ",[183,423,424],{},"d8","，以 ",[183,427,428],{},"android.jar"," 和 SDK jar 作为 ",[183,431,432],{},"--lib","。这些类",[435,436,437],"strong",{},"不会打进","加密 dex。",[401,440,442],{"id":441},"aes-gcm-加密","AES-GCM 加密",[179,444,445,448,449,452,453,456,457,198],{},[183,446,447],{},"javac"," 编译 ",[183,450,451],{},"PayloadEncryptor.java","，把 ",[183,454,455],{},"HIDDEN_PAYLOAD_KEY"," 传入子进程环境，写出 ",[183,458,459],{},"hidden.dex.enc",[401,461,463],{"id":462},"放进-sdk-assets","放进 SDK assets",[179,465,466,469,470,473],{},[183,467,468],{},"sourceSets"," 把 ",[183,471,472],{},"generated\u002Fencrypted_assets\u002F\u003Cvariant>\u002Fpayload"," 指定给 debug \u002F release，随后打进 AAR。",[215,475,480],{"className":476,"code":477,"filename":478,"language":479,"meta":221,"style":221},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","d8_cmd = [str(d8), \"--release\", \"--lib\", str(android_jar)]\nif args.sdk_jar is not None and args.sdk_jar.exists():\n    d8_cmd += [\"--lib\", str(args.sdk_jar)]\nd8_cmd += [\"--output\", str(dex_dir), str(hidden_jar)]\nsubprocess.check_call(d8_cmd)\nplain = dex_path.read_bytes()\nif plain[:3] != b\"dex\":\n    raise SystemExit(\"非法 dex 头\")\n","tools\u002Fencrypt_hidden_payload.py","python",[183,481,482,535,576,607,642,661,680,712],{"__ignoreMap":221},[225,483,484,487,489,492,496,499,502,505,508,511,514,516,518,520,522,524,527,529,532],{"class":227,"line":228},[225,485,486],{"class":245},"d8_cmd ",[225,488,249],{"class":241},[225,490,491],{"class":241}," [",[225,493,495],{"class":494},"sBMFI","str",[225,497,498],{"class":241},"(",[225,500,424],{"class":501},"s2Zo4",[225,503,504],{"class":241},"),",[225,506,507],{"class":241}," \"",[225,509,510],{"class":266},"--release",[225,512,513],{"class":241},"\"",[225,515,272],{"class":241},[225,517,507],{"class":241},[225,519,432],{"class":266},[225,521,513],{"class":241},[225,523,272],{"class":241},[225,525,526],{"class":494}," str",[225,528,498],{"class":241},[225,530,531],{"class":501},"android_jar",[225,533,534],{"class":241},")]\n",[225,536,537,540,543,546,550,553,556,559,562,564,566,568,570,573],{"class":227,"line":304},[225,538,539],{"class":252},"if",[225,541,542],{"class":245}," args",[225,544,545],{"class":241},".",[225,547,549],{"class":548},"swJcz","sdk_jar",[225,551,552],{"class":241}," is",[225,554,555],{"class":241}," not",[225,557,558],{"class":241}," None",[225,560,561],{"class":241}," and",[225,563,542],{"class":245},[225,565,545],{"class":241},[225,567,549],{"class":548},[225,569,545],{"class":241},[225,571,572],{"class":501},"exists",[225,574,575],{"class":241},"():\n",[225,577,578,581,584,586,588,590,592,594,596,598,601,603,605],{"class":227,"line":326},[225,579,580],{"class":245},"    d8_cmd ",[225,582,583],{"class":241},"+=",[225,585,491],{"class":241},[225,587,513],{"class":241},[225,589,432],{"class":266},[225,591,513],{"class":241},[225,593,272],{"class":241},[225,595,526],{"class":494},[225,597,498],{"class":241},[225,599,600],{"class":501},"args",[225,602,545],{"class":241},[225,604,549],{"class":548},[225,606,534],{"class":241},[225,608,609,611,613,615,617,620,622,624,626,628,631,633,635,637,640],{"class":227,"line":345},[225,610,486],{"class":245},[225,612,583],{"class":241},[225,614,491],{"class":241},[225,616,513],{"class":241},[225,618,619],{"class":266},"--output",[225,621,513],{"class":241},[225,623,272],{"class":241},[225,625,526],{"class":494},[225,627,498],{"class":241},[225,629,630],{"class":501},"dex_dir",[225,632,504],{"class":241},[225,634,526],{"class":494},[225,636,498],{"class":241},[225,638,639],{"class":501},"hidden_jar",[225,641,534],{"class":241},[225,643,645,648,650,653,655,658],{"class":227,"line":644},5,[225,646,647],{"class":245},"subprocess",[225,649,545],{"class":241},[225,651,652],{"class":501},"check_call",[225,654,498],{"class":241},[225,656,657],{"class":501},"d8_cmd",[225,659,660],{"class":241},")\n",[225,662,664,667,669,672,674,677],{"class":227,"line":663},6,[225,665,666],{"class":245},"plain ",[225,668,249],{"class":241},[225,670,671],{"class":245}," dex_path",[225,673,545],{"class":241},[225,675,676],{"class":501},"read_bytes",[225,678,679],{"class":241},"()\n",[225,681,683,685,688,691,694,697,700,703,705,707,709],{"class":227,"line":682},7,[225,684,539],{"class":252},[225,686,687],{"class":245}," plain",[225,689,690],{"class":241},"[:",[225,692,693],{"class":319},"3",[225,695,696],{"class":241},"]",[225,698,699],{"class":241}," !=",[225,701,702],{"class":231}," b",[225,704,513],{"class":241},[225,706,381],{"class":266},[225,708,513],{"class":241},[225,710,711],{"class":241},":\n",[225,713,715,718,721,723,725,728,730],{"class":227,"line":714},8,[225,716,717],{"class":252},"    raise",[225,719,720],{"class":494}," SystemExit",[225,722,498],{"class":241},[225,724,513],{"class":241},[225,726,727],{"class":266},"非法 dex 头",[225,729,513],{"class":241},[225,731,660],{"class":241},[179,733,734,736,737,198],{},[183,735,432],{}," 只提供 classpath（例如 KeepAlive 等符号），不会把 SDK 类拷进 payload。实现类也不再实现已经删除的 ",[183,738,739],{},"HiddenApi",[208,741,742],{"id":742},"加密过程",[179,744,745,748,749,752,753,756],{},[183,746,747],{},"encrypt"," 先生成 12 字节 nonce，再使用 ",[183,750,751],{},"AES\u002FGCM\u002FNoPadding","。Java 的 ",[183,754,755],{},"doFinal"," 会把 16 字节 tag 接在密文后面，写出时不必再单独追加 tag。",[215,758,760],{"className":217,"code":759,"filename":219,"language":220,"meta":221,"style":221},"static byte[] encrypt(byte[] plain, byte[] key) throws Exception {\n    byte[] nonce = new byte[NONCE_LEN];\n    new SecureRandom().nextBytes(nonce);\n    Cipher cipher = Cipher.getInstance(\"AES\u002FGCM\u002FNoPadding\");\n    cipher.init(\n            Cipher.ENCRYPT_MODE,\n            new SecretKeySpec(key, \"AES\"),\n            new GCMParameterSpec(TAG_BITS, nonce)\n    );\n    byte[] ct = cipher.doFinal(plain);\n    byte[] out = new byte[MAGIC.length + NONCE_LEN + ct.length];\n    System.arraycopy(MAGIC, 0, out, 0, MAGIC.length);\n    System.arraycopy(nonce, 0, out, MAGIC.length, NONCE_LEN);\n    System.arraycopy(ct, 0, out, MAGIC.length + NONCE_LEN, ct.length);\n    Arrays.fill(nonce, (byte) 0);\n    return out;\n}\n",[183,761,762,800,825,847,875,888,901,926,945,951,977,1020,1060,1096,1140,1168,1178],{"__ignoreMap":221},[225,763,764,766,768,770,773,775,778,780,782,784,786,788,791,794,797],{"class":227,"line":228},[225,765,232],{"class":231},[225,767,238],{"class":231},[225,769,242],{"class":241},[225,771,772],{"class":501}," encrypt",[225,774,498],{"class":241},[225,776,777],{"class":231},"byte",[225,779,242],{"class":241},[225,781,687],{"class":245},[225,783,272],{"class":241},[225,785,238],{"class":231},[225,787,242],{"class":241},[225,789,790],{"class":245}," key",[225,792,793],{"class":241},")",[225,795,796],{"class":245}," throws Exception ",[225,798,799],{"class":241},"{\n",[225,801,802,805,807,810,812,814,816,819,822],{"class":227,"line":304},[225,803,804],{"class":231},"    byte",[225,806,242],{"class":241},[225,808,809],{"class":245}," nonce ",[225,811,249],{"class":241},[225,813,253],{"class":252},[225,815,238],{"class":231},[225,817,818],{"class":241},"[",[225,820,821],{"class":245},"NONCE_LEN",[225,823,824],{"class":241},"];\n",[225,826,827,830,833,836,839,841,844],{"class":227,"line":326},[225,828,829],{"class":252},"    new",[225,831,832],{"class":501}," SecureRandom",[225,834,835],{"class":241},"().",[225,837,838],{"class":501},"nextBytes",[225,840,498],{"class":241},[225,842,843],{"class":245},"nonce",[225,845,846],{"class":241},");\n",[225,848,849,852,855,857,860,862,865,867,869,871,873],{"class":227,"line":345},[225,850,851],{"class":231},"    Cipher",[225,853,854],{"class":245}," cipher ",[225,856,249],{"class":241},[225,858,859],{"class":245}," Cipher",[225,861,545],{"class":241},[225,863,864],{"class":501},"getInstance",[225,866,498],{"class":241},[225,868,513],{"class":241},[225,870,751],{"class":266},[225,872,513],{"class":241},[225,874,846],{"class":241},[225,876,877,880,882,885],{"class":227,"line":644},[225,878,879],{"class":245},"    cipher",[225,881,545],{"class":241},[225,883,884],{"class":501},"init",[225,886,887],{"class":241},"(\n",[225,889,890,893,895,898],{"class":227,"line":663},[225,891,892],{"class":245},"            Cipher",[225,894,545],{"class":241},[225,896,897],{"class":245},"ENCRYPT_MODE",[225,899,900],{"class":241},",\n",[225,902,903,906,909,911,914,916,918,921,923],{"class":227,"line":682},[225,904,905],{"class":252},"            new",[225,907,908],{"class":501}," SecretKeySpec",[225,910,498],{"class":241},[225,912,913],{"class":245},"key",[225,915,272],{"class":241},[225,917,507],{"class":241},[225,919,920],{"class":266},"AES",[225,922,513],{"class":241},[225,924,925],{"class":241},"),\n",[225,927,928,930,933,935,938,940,943],{"class":227,"line":714},[225,929,905],{"class":252},[225,931,932],{"class":501}," GCMParameterSpec",[225,934,498],{"class":241},[225,936,937],{"class":245},"TAG_BITS",[225,939,272],{"class":241},[225,941,942],{"class":245}," nonce",[225,944,660],{"class":241},[225,946,948],{"class":227,"line":947},9,[225,949,950],{"class":241},"    );\n",[225,952,954,956,958,961,963,966,968,970,972,975],{"class":227,"line":953},10,[225,955,804],{"class":231},[225,957,242],{"class":241},[225,959,960],{"class":245}," ct ",[225,962,249],{"class":241},[225,964,965],{"class":245}," cipher",[225,967,545],{"class":241},[225,969,755],{"class":501},[225,971,498],{"class":241},[225,973,974],{"class":245},"plain",[225,976,846],{"class":241},[225,978,980,982,984,987,989,991,993,995,998,1000,1003,1006,1008,1010,1013,1015,1018],{"class":227,"line":979},11,[225,981,804],{"class":231},[225,983,242],{"class":241},[225,985,986],{"class":245}," out ",[225,988,249],{"class":241},[225,990,253],{"class":252},[225,992,238],{"class":231},[225,994,818],{"class":241},[225,996,997],{"class":245},"MAGIC",[225,999,545],{"class":241},[225,1001,1002],{"class":245},"length ",[225,1004,1005],{"class":241},"+",[225,1007,314],{"class":245},[225,1009,1005],{"class":241},[225,1011,1012],{"class":245}," ct",[225,1014,545],{"class":241},[225,1016,1017],{"class":245},"length",[225,1019,824],{"class":241},[225,1021,1023,1026,1028,1031,1033,1035,1037,1040,1042,1045,1047,1049,1051,1054,1056,1058],{"class":227,"line":1022},12,[225,1024,1025],{"class":245},"    System",[225,1027,545],{"class":241},[225,1029,1030],{"class":501},"arraycopy",[225,1032,498],{"class":241},[225,1034,997],{"class":245},[225,1036,272],{"class":241},[225,1038,1039],{"class":319}," 0",[225,1041,272],{"class":241},[225,1043,1044],{"class":245}," out",[225,1046,272],{"class":241},[225,1048,1039],{"class":319},[225,1050,272],{"class":241},[225,1052,1053],{"class":245}," MAGIC",[225,1055,545],{"class":241},[225,1057,1017],{"class":245},[225,1059,846],{"class":241},[225,1061,1063,1065,1067,1069,1071,1073,1075,1077,1079,1081,1083,1085,1087,1089,1091,1094],{"class":227,"line":1062},13,[225,1064,1025],{"class":245},[225,1066,545],{"class":241},[225,1068,1030],{"class":501},[225,1070,498],{"class":241},[225,1072,843],{"class":245},[225,1074,272],{"class":241},[225,1076,1039],{"class":319},[225,1078,272],{"class":241},[225,1080,1044],{"class":245},[225,1082,272],{"class":241},[225,1084,1053],{"class":245},[225,1086,545],{"class":241},[225,1088,1017],{"class":245},[225,1090,272],{"class":241},[225,1092,1093],{"class":245}," NONCE_LEN",[225,1095,846],{"class":241},[225,1097,1099,1101,1103,1105,1107,1110,1112,1114,1116,1118,1120,1122,1124,1126,1128,1130,1132,1134,1136,1138],{"class":227,"line":1098},14,[225,1100,1025],{"class":245},[225,1102,545],{"class":241},[225,1104,1030],{"class":501},[225,1106,498],{"class":241},[225,1108,1109],{"class":245},"ct",[225,1111,272],{"class":241},[225,1113,1039],{"class":319},[225,1115,272],{"class":241},[225,1117,1044],{"class":245},[225,1119,272],{"class":241},[225,1121,1053],{"class":245},[225,1123,545],{"class":241},[225,1125,1002],{"class":245},[225,1127,1005],{"class":241},[225,1129,1093],{"class":245},[225,1131,272],{"class":241},[225,1133,1012],{"class":245},[225,1135,545],{"class":241},[225,1137,1017],{"class":245},[225,1139,846],{"class":241},[225,1141,1143,1146,1148,1151,1153,1155,1157,1160,1162,1164,1166],{"class":227,"line":1142},15,[225,1144,1145],{"class":245},"    Arrays",[225,1147,545],{"class":241},[225,1149,1150],{"class":501},"fill",[225,1152,498],{"class":241},[225,1154,843],{"class":245},[225,1156,272],{"class":241},[225,1158,1159],{"class":241}," (",[225,1161,777],{"class":231},[225,1163,793],{"class":241},[225,1165,1039],{"class":319},[225,1167,846],{"class":241},[225,1169,1171,1174,1176],{"class":227,"line":1170},16,[225,1172,1173],{"class":252},"    return",[225,1175,1044],{"class":245},[225,1177,323],{"class":241},[225,1179,1181],{"class":227,"line":1180},17,[225,1182,1183],{"class":241},"}\n",[179,1185,1186,1187,1190],{},"写完后立刻用同一把密钥解密并比对。成功后对 plaintext、key 和临时 buffer 执行 ",[183,1188,1189],{},"fill(0)","，避免明文 dex 长时间留在构建机内存里。",[1192,1193,1194,1195,1198,1199,198],"tip",{},"密钥必须是 ",[435,1196,1197],{},"64 个 hex 字符","，解码后为 32 字节。不能把可打印字符串的 UTF-8 直接当作 AES key。解析逻辑见 ",[1200,1201,1202],"a",{"href":84},"密钥外置",[208,1204,1206],{"id":1205},"注册-gradle-任务","注册 Gradle 任务",[179,1208,1209,1210,1213,1214,1217,1218,1221,1222,198],{},"每个 library variant 注册 ",[183,1211,1212],{},"encryptHiddenPayloadDebug"," \u002F ",[183,1215,1216],{},"encryptHiddenPayloadRelease","。release ",[435,1219,1220],{},"不允许","自动生成密钥，所以脚本不带 ",[183,1223,1224],{},"--allow-generate",[215,1226,1231],{"className":1227,"code":1228,"filename":1229,"language":1230,"meta":221,"style":221},"language-kotlin shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","val encrypt = tasks.register(\"encryptHiddenPayload$capital\") {\n    dependsOn(\n        \":hidden-landing-page:bundleLibRuntimeToJar$capital\",\n        \"bundleLibCompileToJar$capital\",\n    )\n    doLast {\n        check(!jar.jarHasClass(\"com\u002Fexample\u002Fminidex\u002Fsdk\u002FHiddenSdk\")) {\n            \":hidden-landing-page 把 HiddenSdk 打进了 jar。必须 compileOnly。\"\n        }\n        exec {\n            val args = mutableListOf(\n                \"python3\",\n                \"tools\u002Fencrypt_hidden_payload.py\",\n                \"--hidden-jar\", jar.absolutePath,\n                \"--sdk-jar\", sdkJar.get().asFile.absolutePath,\n                \"--output-dir\", payloadDir.get().asFile.absolutePath,\n                \"--dex-dir\", dexDir.get().asFile.absolutePath,\n            )\n            if (variantName != \"release\") {\n                args += \"--allow-generate\"\n            }\n            commandLine(args)\n        }\n    }\n}\n","hidden-sdk\u002Fbuild.gradle.kts","kotlin",[183,1232,1233,1262,1269,1280,1291,1296,1304,1328,1333,1338,1345,1360,1367,1374,1382,1396,1408,1420,1426,1443,1454,1460,1469,1474,1480],{"__ignoreMap":221},[225,1234,1235,1238,1241,1243,1246,1249,1251,1254,1257,1259],{"class":227,"line":228},[225,1236,1237],{"class":241},"val",[225,1239,1240],{"class":245}," encrypt ",[225,1242,249],{"class":241},[225,1244,1245],{"class":245}," tasks.",[225,1247,1248],{"class":501},"register",[225,1250,498],{"class":245},[225,1252,1253],{"class":266},"\"encryptHiddenPayload",[225,1255,1256],{"class":245},"$capital",[225,1258,513],{"class":266},[225,1260,1261],{"class":245},") {\n",[225,1263,1264,1267],{"class":227,"line":304},[225,1265,1266],{"class":501},"    dependsOn",[225,1268,887],{"class":245},[225,1270,1271,1274,1276,1278],{"class":227,"line":326},[225,1272,1273],{"class":266},"        \":hidden-landing-page:bundleLibRuntimeToJar",[225,1275,1256],{"class":245},[225,1277,513],{"class":266},[225,1279,900],{"class":245},[225,1281,1282,1285,1287,1289],{"class":227,"line":345},[225,1283,1284],{"class":266},"        \"bundleLibCompileToJar",[225,1286,1256],{"class":245},[225,1288,513],{"class":266},[225,1290,900],{"class":245},[225,1292,1293],{"class":227,"line":644},[225,1294,1295],{"class":245},"    )\n",[225,1297,1298,1301],{"class":227,"line":663},[225,1299,1300],{"class":501},"    doLast",[225,1302,1303],{"class":245}," {\n",[225,1305,1306,1309,1311,1314,1317,1320,1322,1325],{"class":227,"line":682},[225,1307,1308],{"class":501},"        check",[225,1310,498],{"class":245},[225,1312,1313],{"class":241},"!",[225,1315,1316],{"class":245},"jar.",[225,1318,1319],{"class":501},"jarHasClass",[225,1321,498],{"class":245},[225,1323,1324],{"class":266},"\"com\u002Fexample\u002Fminidex\u002Fsdk\u002FHiddenSdk\"",[225,1326,1327],{"class":245},")) {\n",[225,1329,1330],{"class":227,"line":714},[225,1331,1332],{"class":266},"            \":hidden-landing-page 把 HiddenSdk 打进了 jar。必须 compileOnly。\"\n",[225,1334,1335],{"class":227,"line":947},[225,1336,1337],{"class":245},"        }\n",[225,1339,1340,1343],{"class":227,"line":953},[225,1341,1342],{"class":501},"        exec",[225,1344,1303],{"class":245},[225,1346,1347,1350,1353,1355,1358],{"class":227,"line":979},[225,1348,1349],{"class":241},"            val",[225,1351,1352],{"class":245}," args ",[225,1354,249],{"class":241},[225,1356,1357],{"class":501}," mutableListOf",[225,1359,887],{"class":245},[225,1361,1362,1365],{"class":227,"line":1022},[225,1363,1364],{"class":266},"                \"python3\"",[225,1366,900],{"class":245},[225,1368,1369,1372],{"class":227,"line":1062},[225,1370,1371],{"class":266},"                \"tools\u002Fencrypt_hidden_payload.py\"",[225,1373,900],{"class":245},[225,1375,1376,1379],{"class":227,"line":1098},[225,1377,1378],{"class":266},"                \"--hidden-jar\"",[225,1380,1381],{"class":245},", jar.absolutePath,\n",[225,1383,1384,1387,1390,1393],{"class":227,"line":1142},[225,1385,1386],{"class":266},"                \"--sdk-jar\"",[225,1388,1389],{"class":245},", sdkJar.",[225,1391,1392],{"class":501},"get",[225,1394,1395],{"class":245},"().asFile.absolutePath,\n",[225,1397,1398,1401,1404,1406],{"class":227,"line":1170},[225,1399,1400],{"class":266},"                \"--output-dir\"",[225,1402,1403],{"class":245},", payloadDir.",[225,1405,1392],{"class":501},[225,1407,1395],{"class":245},[225,1409,1410,1413,1416,1418],{"class":227,"line":1180},[225,1411,1412],{"class":266},"                \"--dex-dir\"",[225,1414,1415],{"class":245},", dexDir.",[225,1417,1392],{"class":501},[225,1419,1395],{"class":245},[225,1421,1423],{"class":227,"line":1422},18,[225,1424,1425],{"class":245},"            )\n",[225,1427,1429,1432,1435,1438,1441],{"class":227,"line":1428},19,[225,1430,1431],{"class":252},"            if",[225,1433,1434],{"class":245}," (variantName ",[225,1436,1437],{"class":241},"!=",[225,1439,1440],{"class":266}," \"release\"",[225,1442,1261],{"class":245},[225,1444,1446,1449,1451],{"class":227,"line":1445},20,[225,1447,1448],{"class":245},"                args ",[225,1450,583],{"class":241},[225,1452,1453],{"class":266}," \"--allow-generate\"\n",[225,1455,1457],{"class":227,"line":1456},21,[225,1458,1459],{"class":245},"            }\n",[225,1461,1463,1466],{"class":227,"line":1462},22,[225,1464,1465],{"class":501},"            commandLine",[225,1467,1468],{"class":245},"(args)\n",[225,1470,1472],{"class":227,"line":1471},23,[225,1473,1337],{"class":245},[225,1475,1477],{"class":227,"line":1476},24,[225,1478,1479],{"class":245},"    }\n",[225,1481,1483],{"class":227,"line":1482},25,[225,1484,1183],{"class":245},[179,1486,1487,1488,1213,1491,1494],{},"加密失败时，",[183,1489,1490],{},"package*Assets",[183,1492,1493],{},"merge*Assets"," 不会继续，避免打出缺少 payload 的 AAR。",[208,1496,1497],{"id":1497},"中间文件",[1499,1500,1501,1517],"table",{},[1502,1503,1504],"thead",{},[1505,1506,1507,1511,1514],"tr",{},[1508,1509,1510],"th",{},"文件",[1508,1512,1513],{},"路径",[1508,1515,1516],{},"给接入方吗",[1518,1519,1520,1534,1547],"tbody",{},[1505,1521,1522,1526,1531],{},[1523,1524,1525],"td",{},"明文 dex",[1523,1527,1528],{},[183,1529,1530],{},"hidden-sdk\u002Fbuild\u002Fgenerated\u002Fhidden_dex\u002F\u003Cvariant>\u002Fclasses.dex",[1523,1532,1533],{},"否",[1505,1535,1536,1539,1544],{},[1523,1537,1538],{},"加密 payload",[1523,1540,1541],{},[183,1542,1543],{},"hidden-sdk\u002Fbuild\u002Fgenerated\u002Fencrypted_assets\u002F\u003Cvariant>\u002Fpayload\u002Fhidden.dex.enc",[1523,1545,1546],{},"否，只随 AAR",[1505,1548,1549,1552,1557],{},[1523,1550,1551],{},"压缩包装",[1523,1553,1554],{},[183,1555,1556],{},"app\u002Fbuild\u002Fintermediates\u002Fcompressed_assets\u002F...\u002Fhidden.dex.enc.jar",[1523,1558,1559],{},"否，AGP 中间物",[1561,1562,1563,1564,1566,1567,1569,1570,1573],"caution",{},"不要把明文 ",[183,1565,193],{}," 或单独一份 ",[183,1568,459],{}," 再拷进宿主 ",[183,1571,1572],{},"src\u002Fmain\u002Fassets\u002F","。AAR 已经带了这些文件，重复拷贝容易造成版本错位。",[208,1575,1576],{"id":1576},"下一步",[1578,1579,1580,1590],"ul",{},[1581,1582,1583,1586,1587,1589],"li",{},[1200,1584,1585],{"href":64},"Native解密","：so 如何核对 ",[183,1588,377],{}," 头并校验 tag",[1581,1591,1592,1595],{},[1200,1593,1594],{"href":94},"构建校验","：AAR 里的 payload 没有 HDX1 头会直接失败",[1597,1598,1599],"style",{},"html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}",{"title":221,"searchDepth":304,"depth":304,"links":1601},[1602,1603,1609,1610,1611,1612],{"id":210,"depth":304,"text":210},{"id":396,"depth":304,"text":396,"children":1604},[1605,1606,1607,1608],{"id":403,"depth":326,"text":404},{"id":417,"depth":326,"text":418},{"id":441,"depth":326,"text":442},{"id":462,"depth":326,"text":463},{"id":742,"depth":304,"text":742},{"id":1205,"depth":304,"text":1206},{"id":1497,"depth":304,"text":1497},{"id":1576,"depth":304,"text":1576},"构建期把 :hidden-landing-page 打成 AES-256-GCM 密文，以 HDX1 头写入 AAR assets。","md",[1616,1617],{"label":63,"icon":66,"to":64},{"label":83,"icon":86,"to":84},{"date":1619,"categories":1620,"tags":1622},"2026-09-21",[1621],"android",[37,1623,1624],"AES-GCM","DEX",{"icon":21},{"title":1627,"description":1628},"安卓代码加固（1）：构建期 AES-256-GCM 加密 Hidden DEX","hidden-dex-minidemo 用 d8 把 landing-page jar 编成 dex，再以 AES-256-GCM 写成 hidden.dex.enc。密文布局为 HDX1 + nonce + ciphertext + tag。","RNa5zvO7oU_hA-pq1kdqbpcyU158ARMFJHmtUY44dCg",[1631,1633],{"title":56,"path":52,"stem":53,"description":1632,"icon":57},"hidden-dex-minidemo 把业务实现编成加密 DEX。运行时由 so 解密后在内存里加载。主 DEX 只保留公开接口。",{"title":63,"path":64,"stem":65,"description":1634,"icon":66},"libhiddendecrypt.so 自实现 AES-256-GCM。Java 不接触明文 DEX，用完立刻清零。",1790767045893]