DEX 소스코드 분석 실습

195페이지

 

 

 

Login.java

package com.vulnerable.kisaapp2;

import android.content.Intent;
import android.os.Bundle;
import android.support.v7.app.AlertDialog;
import android.support.v7.app.AlertDialog.Builder;
import android.support.v7.app.AppCompatActivity;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.Button;
import android.widget.EditText;
import android.widget.TextView;
import com.android.volley.RequestQueue;
import com.android.volley.Response.Listener;
import com.android.volley.toolbox.Volley;
import org.json.JSONObject;

public class LoginActivity
  extends AppCompatActivity
{
  private AlertDialog dlg;
  
  protected void onCreate(Bundle paramBundle)
  {
    super.onCreate(paramBundle);
    setContentView(2130968605);
    paramBundle = (TextView)findViewById(2131689601);
    Button localButton = (Button)findViewById(2131689600);
    paramBundle.setOnClickListener(new View.OnClickListener()
    {
      public void onClick(View paramAnonymousView)
      {
        paramAnonymousView = new Intent(LoginActivity.this, RegisterActivity.class);
        LoginActivity.this.startActivity(paramAnonymousView);
      }
    });
    localButton.setOnClickListener(new View.OnClickListener()
    {
      public void onClick(final View paramAnonymousView)
      {
        paramAnonymousView = this.val$textID.getText().toString();
        String str = this.val$textPWD.getText().toString();
        if ((paramAnonymousView.equals("test0001")) && (str.equals("!@#qwerty0001")))
        {
          paramAnonymousView = new Intent(LoginActivity.this, SettingsActivity.class);
          LoginActivity.this.startActivity(paramAnonymousView);
          LoginActivity.this.finish();
          return;
        }
        paramAnonymousView = new LoginRequest(paramAnonymousView, str, new Response.Listener()
        {
          public void onResponse(String paramAnonymous2String)
          {
            try
            {
              if (new JSONObject(paramAnonymous2String).getBoolean("OK"))
              {
                paramAnonymous2String = new Intent(LoginActivity.this, MainActivity.class);
                paramAnonymous2String.putExtra("ID", paramAnonymousView);
                LoginActivity.this.startActivity(paramAnonymous2String);
                LoginActivity.this.finish();
                return;
              }
              paramAnonymous2String = new AlertDialog.Builder(LoginActivity.this);
              paramAnonymous2String.setMessage("������ ���� ���������� ��������.");
              paramAnonymous2String.setPositiveButton("����", null);
              LoginActivity.access$002(LoginActivity.this, paramAnonymous2String.create());
              LoginActivity.this.dlg.show();
              return;
            }
            catch (Exception paramAnonymous2String)
            {
              paramAnonymous2String.printStackTrace();
            }
          }
        });
        Volley.newRequestQueue(LoginActivity.this).add(paramAnonymousView);
      }
    });
  }
  
  protected void onStop()
  {
    super.onStop();
    if (this.dlg != null)
    {
      this.dlg.dismiss();
      this.dlg = null;
    }
  }
}

 

소스코드에 하드코딩된 계정정보를 이용하여 앱 로그인

⇐ 인증 후 보여지는 중요한 정보를 포함한 액티비티

 

 

c:\AndroidSecurity\Tools>jadx-gui.bat c:\Users\Msecure\Desktop\APK\1_KisaBank.apk