Tool Installation & Configuration Guide

This guide covers all tool installation steps required for the course. It is recommended to complete the installations before class to avoid taking up lecture time.

1. Base Environment

1.1 JDK (Java Development Kit)

Purpose: apktool, jadx, uber-apk-signer, and other tools depend on the Java runtime.

Installation Steps:

1. Visit Oracle JDK 17 or OpenJDK 17
2. Choose the Windows x64 Installer, download and run the installer
3. Configure environment variables:
4. • Add a new system variable JAVA_HOME, set its value to the JDK installation path (e.g. C:\Program Files\Java\jdk-17)
   • In the Path variable, append %JAVA_HOME%\bin

Verification:

java -version
# openjdk version "17.0.x" ...
javac -version
# javac 17.0.x

1.2 Android SDK Platform Tools (ADB)

Purpose: Provides adb, fastboot, and other command-line tools for communication between a PC and an Android device/emulator.

Installation Steps:

1. Visit Android SDK Platform Tools
2. Download the Windows version (ZIP archive)
3. Extract to a fixed directory (e.g. C:\platform-tools)
4. Add C:\platform-tools to the system Path environment variable

Verification:

adb version
# Android Debug Bridge version 1.0.41
# Version 35.0.x ...

1.3 Python 3

Purpose: Frida's Python bindings (frida-tools), blackboxprotobuf, and others depend on Python.

Installation Steps:

1. Visit python.org
2. Download Python 3.10 or later (Windows Installer)
3. During installation, check "Add Python to PATH"
4. Verification:python --version

Install required libraries:

pip install frida-tools blackboxprotobuf

2. Static Analysis Tools

2.1 apktool

Purpose: An APK decompilation/recompilation tool that decodes APK files into Smali code and resource files.

Version: 2.9.3 (the version used in this course; staying consistent is recommended)

Installation Steps:

1. Visit the apktool official site or GitHub Releases
2. Download apktool_2.9.3.jar
3. Download the Windows wrapper script (right-click → Save as apktool.bat)
4. Place apktool.bat and apktool_2.9.3.jar in the same directory
5. Add that directory to the system Path

Verification:

apktool --version
# 2.9.3

2.2 jadx

Purpose: Decompiles DEX bytecode into Java source code, supporting both command-line and GUI modes.

Version: 1.5.0 (the version used in this course)

Installation Steps:

1. Visit jadx GitHub Releases
2. Download jadx-gui-1.5.0-with-jre-win.zip (bundles its own JRE; no separate Java configuration needed)
3. Extract to a fixed directory (e.g. C:\jadx)
4. Double-click jadx-gui.bat to launch the GUI

Verification:

• GUI mode: double-click jadx-gui.bat → the jadx window should appear
• CLI mode: jadx --version → should output the version number

2.3 uber-apk-signer

Purpose: An APK signing tool. After modifying Smali code and recompiling, the APK must be re-signed before installation.

Installation Steps:

1. Visit uber-apk-signer GitHub Releases
2. Download the latest JAR (e.g. uber-apk-signer-1.3.0.jar)
3. Place it in a directory convenient for invocation

Usage:

java -jar uber-apk-signer-1.3.0.jar --apks target.apk

3. Dynamic Analysis Tools

3.1 Frida

Purpose: A cross-platform dynamic instrumentation framework used for runtime hooking of Java methods and native functions.

Version Requirement: The PC-side frida-tools version and the Android-side frida-server version must be exactly identical.

3.1.1 PC Side (frida-tools)

pip install frida-tools
frida --version
# 记录版本号，例如 16.5.9

3.1.2 Android Side (frida-server)

Steps:

1. Visit Frida GitHub Releases
2. Select the release that exactly matches your PC-side version (e.g. 16.5.9)
3. Choose the appropriate file based on the emulator's CPU architecture:
4. • MuMu emulator uses the x86_64 build:frida-server-16.5.9-android-x86_64.xz
   • Physical device (ARM64):frida-server-16.5.9-android-arm64.xz
4. After downloading, extract (using 7-Zip or xz -d):

7z x frida-server-16.5.9-android-x86_64.xz

5. Push to the emulator and configure:

adb push frida-server-16.5.9-android-x86_64 /data/local/tmp/frida-server
adb shell chmod 755 /data/local/tmp/frida-server

Launch:

# 需要 root 权限
adb shell su -c "/data/local/tmp/frida-server &"

Verification:

frida-ps -U
# 应显示模拟器上运行的进程列表

Common Troubleshooting:

4. Traffic Analysis Tools

4.1 Reqable

Purpose: An HTTP/HTTPS/HTTP2/HTTP3(QUIC) packet capture and debugging tool. Supports breakpoints, replay, rule rewriting, and script extensions.

Version: 2.8.0 or later

Installation Steps:

1. Visit the Reqable official website
2. Download the Windows installer
3. Run the installer and complete installation with default settings
4. Launch Reqable

Initial Configuration:

1. Settings → Enable HTTPS decryption
2. Note the proxy port (default 9000)
3. Export the root certificate (PEM format, for installation into the emulator's system directory)

Emulator-Side Certificate Installation (Android 7.0+ requires installation into the system certificate store):

# 1. 计算证书的 Android 命名哈希值
openssl x509 -inform PEM -subject_hash_old -in reqable-ca.pem | head -1
# 输出示例：2a5b6c7d

# 2. 生成 Android 格式证书文件
openssl x509 -inform PEM -text -in reqable-ca.pem > 2a5b6c7d.0

# 3. 推送至系统证书目录
adb root
adb remount
adb push 2a5b6c7d.0 /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/2a5b6c7d.0
adb reboot

Configure the proxy on the emulator:

# 方式一：全局代理（推荐）
adb shell settings put global http_proxy <PC的IP地址>:9000

# 验证
adb shell settings get global http_proxy
# 输出：192.168.x.x:9000

# 取消代理
adb shell settings put global http_proxy :0

5. Android Emulator

5.1 MuMu Emulator

Purpose: An Android runtime environment that provides root access and ADB debugging support.

Version: MuMu Emulator 12 (Android 12, x86_64 architecture)

Installation Steps:

1. Visit the MuMu Emulator official website
2. Download the Windows installer
3. After installation, launch for the first time and wait for the Android system to initialize
4. Required Configuration:
5. • Settings → Other Settings → Enable ROOT access → Restart the emulator
   • Settings → Other Settings → Disk Sharing → Select "Writable"

Connect ADB:

adb connect 127.0.0.1:7555
adb devices
# 127.0.0.1:7555   device

Required System Configuration:

# 开启未知来源安装
adb shell settings put secure install_non_market_apps 1

# 关闭 Google Play 保护
adb shell settings put global package_verifier_enable 0

# SELinux 设为 Permissive（Day 1 讲解原因）
adb shell su -c "setenforce 0"
adb shell getenforce
# 应输出：Permissive

6. Mini Program Analysis Tools

6.1 unveilr

Purpose: A WeChat Mini Program .wxapkg file unpacking tool that restores readable JavaScript/HTML source code.

Installation Steps:

1. Visit unveilr GitHub Releases
2. Download the Windows x64 version (.exe file)
3. Place it in a directory convenient for invocation, or add it to the system Path

Usage:

unveilr ./target.wxapkg -o ./output/

Notes:

• Newer versions of WeChat (8.0+) may encrypt wxapkg files, in which case unveilr will throw an error: Unsupported .wxapkg format
• Solution: use the PC WeChat client to extract unencrypted Mini Program packages, or use a dedicated decryption script

7. Optional Tools

7.1 Ghidra

Purpose: An NSA open-source reverse engineering tool for analyzing native code in .so (ELF) files. Supports disassembly and decompilation (pseudo-C code).

Installation Steps:

1. Visit the Ghidra official website
2. Download the latest version (requires JDK 17+)
3. Extract to a fixed directory
4. Run ghidraRun.bat to launch

7.2 BlackDex

Purpose: An APK unpacking tool that runs on the Android device, suitable for quickly unpacking first-generation packers.

Installation Steps:

1. Visit the BlackDex project page and download the APK
2. adb install blackdex.apk
3. Open BlackDex in the emulator → select the target app → automatic unpacking

8. Environment Self-Check Checklist

Before the course begins, please verify each item:

基础环境
□ java -version → 17.x
□ adb version → 1.0.41+
□ python --version → 3.10+

静态分析
□ apktool --version → 2.9.3
□ jadx-gui.bat 可正常启动
□ uber-apk-signer JAR 已下载

动态分析
□ frida --version → 与 frida-server 一致
□ frida-ps -U → 显示进程列表（frida-server 已启动）

流量分析
□ Reqable 已安装，HTTPS 解密已开启
□ Reqable 根证书已安装到模拟器系统证书目录
□ adb shell settings get global http_proxy → 指向 Reqable 端口

模拟器
□ MuMu 模拟器已启动
□ adb devices → 127.0.0.1:7555  device
□ adb shell su -c "id" → uid=0(root)
□ adb shell getenforce → Permissive

小程序
□ unveilr --version → 正常输出

可选
□ Ghidra 已安装（用于 Day 4-5 Native 分析）

Version Pinning Advice: It is recommended to use the exact versions of Frida, apktool, and jadx specified in this guide. Cross-version differences may cause discrepancies between the instructor's demo and student operations.