大土豆安全笔记 | OPPO的移动安全团队很不错

mx\x00\x01\x00\x02\x00\x00\x00\xb5
{
    "hash":"FA730A013D17D705CAF504B5CA560501",
    "id":0,
    "name":"cool_video",
    "suffix":"mp4",
    "size":5976,
    "type":0
}

mx\x00\x01\x00\x02\x00\x00\x00\xb5
{
    "hash":"FA730A013D17D705CAF504B5CA560501",
    "id":0,
    "name":"../cool_video",
    "suffix":"mp4",
    "size":5976,
    "type":0
}

<appPath>/files/oat/<arch>/*.odex

private void c(File file, String arg8) throws myException {
    CipherInputStream cipherInputStream_1;
    ZipInputStream zipInputStream;  // 解密后的数据类型转为ZipInputStream
    BufferedInputStream bufferedInputStream_1;
    CipherInputStream cipherInputStream_2;  // 解密传入的数据流
    BufferedInputStream bufferedInputStream_2;  // 将文件读入缓冲区流
    Closeable closeable = null;
    try {
        if(!file.exists()) {
            throw new e();
        }
        this.a();  // cipher = "AES/ECB/PKCS5PADDING"
        bufferedInputStream_2 = new BufferedInputStream(new FileInputStream(file));  // 将文件读入缓冲区流
    }
    try {
        if(TextUtils.isEmpty(((CharSequence)arg8))) {
            arg8 = "3d6b27465424597a55443e7532";  // 加密秘钥，可以由用户传入，若用户不传入，则由默认秘钥加密
        }
        this.cipher.init(2, this.b(arg8));  // 用秘钥初始化cipher，秘钥为b("3d6b27465424597a55443e7532")的值
        b.a(((InputStream)bufferedInputStream_2), this.cipher);  // 仿佛在做CRC32校验
        cipherInputStream_2 = new CipherInputStream(((InputStream)bufferedInputStream_2), this.cipher);  // 解密传入的数据流
    }
    try {
        zipInputStream = new ZipInputStream(((InputStream)cipherInputStream_2));  // 解密后的数据类型转为ZipInputStream
    }
    try {
        File selfMainFile = new File(this.context.getApplicationInfo().dataDir);  // 获取程序主目录
        while(true) {
            ZipEntry zipEntry = zipInputStream.getNextEntry();
            if(zipEntry == null) {
                break;
            }
            BufferedOutputStream bufferedOutputStream = new BufferedOutputStream(new FileOutputStream(new File(selfMainFile + File.separator + zipEntry.getName())));  // 拼接解压目录，此处校验文件名，可造成路径穿越漏洞
            IOUtilities.copy(((InputStream)zipInputStream), ((OutputStream)bufferedOutputStream));  // 拷贝数据
            bufferedOutputStream.flush();  // 刷新缓冲区，将数据写出到文件
            bufferedOutputStream.close();
            zipInputStream.closeEntry();
        }
    }
    try {
        IOUtilities.closeStream(((Closeable)zipInputStream));
    }
    return;
}