#!/bin/bash
# ============================================================
#  APK 逆向分析 SOP 脚本
#  用法: bash apk-reverse-sop.sh [path/to/xxx.apk]
#  输出: 分析报告 /workspace/report_xxx.txt
# ============================================================

APK="${1:-}"
if [ -z "$APK" ] || [ ! -f "$APK" ]; then
    echo "用法: bash apk-reverse-sop.sh path/to/xxx.apk"
    exit 1
fi

APK_NAME=$(basename "$APK" .apk)
REPORT="/workspace/report_${APK_NAME}.txt"
DECODED_DIR="/workspace/decoded_${APK_NAME}"
ANDROID_HOME="/workspace/android-dev-toolkit/.tools/android-sdk"
PATH="$ANDROID_HOME/build-tools/33.0.2:$PATH"

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; BLUE='\033[0;34m'; NC='\033[0m'
info()  { echo -e "${BLUE}[INFO]${NC}  $1"; }
ok()    { echo -e "${GREEN}[OK]${NC}    $1"; }
warn()  { echo -e "${YELLOW}[WARN]${NC}  $1"; }

echo "" > "$REPORT"
write_report() { echo -e "$1" >> "$REPORT"; }
write_report "=========================================="
write_report "  APK 逆向分析报告: $APK_NAME"
write_report "  时间: $(date '+%Y-%m-%d %H:%M:%S')"
write_report "=========================================="
write_report ""

# ===================== 1. 基本信息 =====================
step1_basic() {
    info "1. 基本信息 + 权限..."
    write_report "=== 1. 基本信息 ==="
    aapt dump badging "$APK" 2>/dev/null >> "$REPORT" || warn "aapt badging 失败"
    write_report ""
    write_report "=== 权限列表 ==="
    aapt dump permissions "$APK" 2>/dev/null >> "$REPORT" || warn "aapt permissions 失败"
    write_report ""
    ok "基本信息获取完成"
}

# ===================== 2. 解码 =====================
step2_decode() {
    info "2. 解码 APK..."
    rm -rf "$DECODED_DIR" 2>/dev/null || true
    unzip -q "$APK" -d "$DECODED_DIR" 2>&1 | tail -1
    write_report "=== 2. APK 解码 ==="
    write_report "解码目录: $DECODED_DIR"
    write_report "文件数: $(find "$DECODED_DIR" -type f | wc -l)"
    write_report "DEX 文件数: $(find "$DECODED_DIR" -name '*.dex' | wc -l)"
    write_report ""
    ok "解码完成，$(find "$DECODED_DIR" -name '*.dex' | wc -l) 个 DEX 文件"
}

# ===================== 3. 搜索关键词 =====================
step3_search() {
    info "3. 搜索关键词..."
    write_report "=== 3. 关键词搜索 ==="

    # 会员/付费
    write_report "--- [会员/付费] ---"
    for f in "$DECODED_DIR"/*.dex; do
        [ -f "$f" ] && strings "$f" | grep -iE "license|premium|vip|billing|pro|subscribe|unlock|purchase|subscription" | grep -vE "^[0-9a-fA-F]{4,}$" | sort -u | head -20 >> "$REPORT"
    done 2>/dev/null
    write_report ""

    # 广告
    write_report "--- [广告] ---"
    for f in "$DECODED_DIR"/*.dex; do
        [ -f "$f" ] && strings "$f" | grep -iE "interstitial|appopen|showAd|admob|ad_config|loadAd|rewarded|ad_|BannerAd|AdManager" | grep -vE "^[0-9a-fA-F]{4,}$" | sort -u | head -20 >> "$REPORT"
    done 2>/dev/null
    write_report ""

    # 危险操作
    write_report "--- [危险操作] ---"
    for f in "$DECODED_DIR"/*.dex; do
        [ -f "$f" ] && strings "$f" | grep -iE "clipboard|SYSTEM_ALERT|BOOT_COMPLETED|Runtime\.exec|ProcessBuilder|root|shell_exec|su|busybox|chmod|chown|mount" | grep -vE "^[0-9a-fA-F]{4,}$" | sort -u | head -20 >> "$REPORT"
    done 2>/dev/null
    write_report ""

    # 更新/弹窗
    write_report "--- [更新/弹窗] ---"
    for f in "$DECODED_DIR"/*.dex; do
        [ -f "$f" ] && strings "$f" | grep -iE "update|dialog|upgrade|rate|version_check|force_update|download_url|update_url|apk_url" | grep -vE "^[0-9a-fA-F]{4,}$" | sort -u | head -20 >> "$REPORT"
    done 2>/dev/null
    write_report ""
    ok "关键词搜索完成"
}

# ===================== 4. Native 库 =====================
step4_native() {
    info "4. Native 库检查..."
    write_report "=== 4. Native 库 ==="
    if [ -d "$DECODED_DIR/lib/arm64-v8a" ]; then
        ls -lh "$DECODED_DIR/lib/arm64-v8a/" >> "$REPORT"
    else
        write_report "无 arm64-v8a Native 库"
    fi
    write_report ""
    if [ -d "$DECODED_DIR/lib/armeabi-v7a" ]; then
        ls -lh "$DECODED_DIR/lib/armeabi-v7a/" >> "$REPORT" 2>/dev/null
    fi
    write_report ""
    ok "Native 库检查完成"
}

# ===================== 5. 组件分析 =====================
step5_components() {
    info "5. 组件分析（Activity/Service/Receiver/Provider）..."
    write_report "=== 5. 组件分析 ==="
    write_report ""

    # 5a. 用 aapt dump xmltree 提取所有组件（最准确）
    local manifest_xml
    manifest_xml=$(aapt dump xmltree "$APK" AndroidManifest.xml 2>/dev/null)

    # 提取所有组件到变量
    local all_components
    all_components=$(echo "$manifest_xml" | awk '
      /E: (activity|service|receiver|provider)/ { type=$2; gsub(/[\(\)]/,"",type); getline; if (/android:name/) { gsub(/.*android:name\(0x01010003\)="/,""); gsub(/".*/,""); print type "|"$0 } }
    ')

    local activities services receivers providers
    activities=$(echo "$all_components"  | grep "^activity|"  | sed 's/^activity|//' | sort -u)
    services=$(echo "$all_components"   | grep "^service|"   | sed 's/^service|//'   | sort -u)
    receivers=$(echo "$all_components"  | grep "^receiver|"  | sed 's/^receiver|//'  | sort -u)
    providers=$(echo "$all_components"  | grep "^provider|"  | sed 's/^provider|//'  | sort -u)

    # 提取 Activities
    write_report "--- Activity ($(echo "$activities" | grep -c . 2>/dev/null || echo 0) 个) ---"
    echo "$activities" | while read -r name; do
        [ -n "$name" ] && write_report "  $name"
    done 2>/dev/null
    write_report ""

    # 提取 Services
    write_report "--- Service ($(echo "$services" | grep -c . 2>/dev/null || echo 0) 个) ---"
    echo "$services" | while read -r name; do
        [ -n "$name" ] && write_report "  $name"
    done 2>/dev/null
    write_report ""

    # 提取 Receivers
    write_report "--- Receiver ($(echo "$receivers" | grep -c . 2>/dev/null || echo 0) 个) ---"
    echo "$receivers" | while read -r name; do
        [ -n "$name" ] && write_report "  $name"
    done 2>/dev/null
    write_report ""

    # 提取 Providers
    write_report "--- Provider ($(echo "$providers" | grep -c . 2>/dev/null || echo 0) 个) ---"
    echo "$providers" | while read -r name; do
        [ -n "$name" ] && write_report "  $name"
    done 2>/dev/null
    write_report ""

    # 5b. 提取 intent-filter actions
    write_report "--- Intent Filters / Actions ---"
    echo "$manifest_xml" | grep "E: action" | grep "android:name(0x01010003)=\"" | sed 's/.*android:name(0x01010003)="//;s/".*//' | sort -u | while read -r action; do
        [ -n "$action" ] && write_report "  $action"
    done 2>/dev/null
    write_report ""

    # 5c. meta-data
    write_report "--- meta-data (SDK 集成) ---"
    echo "$manifest_xml" | grep "android:name(0x01010003)=\"" | sed 's/.*android:name(0x01010003)="//;s/".*//' | grep -v "^android\." | grep -v "theme\|label\|icon\|name\|authorities\|exported\|enabled\|process\|directBootAware\|foregroundServiceType\|protectionLevel\|grantUriPermissions\|initOrder\|multiProcess\|required\|scheme\|host\|path\|mimeType" | sort -u | while read -r name; do
        [ -n "$name" ] && write_report "  $name"
    done 2>/dev/null
    write_report ""

    # 5d. 分析可去除的组件
    write_report "=== 5b. 可去除组件分析 ==="
    write_report ""

    # 定义已知框架/SDK组件模式（通常可安全去除）
    local sdk_patterns=(
        "google.android.gms"
        "google.firebase"
        "google.android.datatransport"
        "google.mlkit"
        "androidx.profileinstaller"
        "androidx.work.impl"
        "androidx.startup.InitializationProvider"
        "androidx.lifecycle.ProcessLifecycleInitializer"
        "androidx.camera.core.impl.MetadataHolderService"
        "com.google.android.play.core"
    )

    # 已知关键组件模式（不能去除）
    local critical_patterns=(
        "me.rerere"
        "RouteActivity"
        "ShortcutHandler"
        "SafeMode"
        "WebServerService"
    )

    write_report "[ 可安全去除 ]"
    local found_removable=false
    for pattern in "${sdk_patterns[@]}"; do
        echo -e "$activities\n$services\n$receivers\n$providers" 2>/dev/null | grep -i "$pattern" | sort -u | while read -r m; do
            found_removable=true
            write_report "  [去除] $m"
        done
    done
    if [ "$found_removable" = false ]; then
        write_report "  (未发现可去除的 SDK/框架组件)"
    fi
    write_report ""

    write_report "[ 核心组件 - 不可去除 ]"
    local found_critical=false
    for pattern in "${critical_patterns[@]}"; do
        echo -e "$activities\n$services\n$receivers\n$providers" 2>/dev/null | grep -i "$pattern" | sort -u | while read -r m; do
            found_critical=true
            write_report "  [保留] $m"
        done
    done
    if [ "$found_critical" = false ]; then
        write_report "  (未检测到已知核心组件)"
    fi
    write_report ""

    # 权限分析
    write_report "[ 按权限分析 - 建议去除 ]"
    local permissions
    permissions=$(aapt dump permissions "$APK" 2>/dev/null)
    if echo "$permissions" | grep -q "AD_ID"; then
        write_report "  去除 AD_ID 权限 → 删除 Manifest 中的 <uses-permission android:name=\"android.permission.ACCESS_ADSERVICES_AD_ID\" />"
    fi
    if echo "$permissions" | grep -q "BOOT_COMPLETED"; then
        write_report "  去除 BOOT_COMPLETED → 如果不需要开机自启，可删除此权限及对应 Receiver"
    fi
    write_report ""

    ok "组件分析完成"
}

# ===================== 6. 深度分析 =====================
step6_deep() {
    info "6. 深度分析..."
    write_report "=== 6. 深度分析 ==="

    # 6a. 包结构
    write_report "--- 包结构 ---"
    for f in "$DECODED_DIR"/*.dex; do
        [ -f "$f" ] && dexdump "$f" 2>/dev/null | grep "Class descriptor" | sed 's/.*Class descriptor.*: //' | grep -vE '\$|android|kotlin|kotlinx|okhttp|okio|gson|firebase|coil|glide|retrofit|hilt|dagger|javax|compose' | sort -u | head -40 >> "$REPORT"
    done 2>/dev/null
    write_report ""

    # 6b. URL 端点
    write_report "--- URL 端点 ---"
    for f in "$DECODED_DIR"/*.dex; do
        [ -f "$f" ] && strings "$f" | grep -E "https?://" | grep -vE "android\.com|googleapis|github\.com/|maven|jcenter|schemas\.android|w3\.org" | sort -u | head -20 >> "$REPORT"
    done 2>/dev/null
    write_report ""
    ok "深度分析完成"
}

# ===================== 7. 总结 =====================
step7_summary() {
    info "7. 生成总结..."
    write_report "=== 7. 总结 ==="
    write_report ""
    write_report "分析结果摘要:"
    write_report ""

    # 检查是否有会员系统
    if grep -qiE "billing|purchase|subscription|premium|vip|pro" "$REPORT" 2>/dev/null; then
        write_report "⚠️  [存在] 会员/付费系统"
    else
        write_report "✅  [无] 会员/付费系统"
    fi

    # 检查是否有广告
    if grep -qiE "interstitial|admob|ad_config|rewarded|BannerAd|AdManager" "$REPORT" 2>/dev/null; then
        write_report "⚠️  [存在] 广告系统"
    else
        write_report "✅  [无] 广告系统"
    fi

    # 检查是否有危险操作
    if grep -qiE "clipboard|Runtime\.exec|ProcessBuilder|shell_exec|SYSTEM_ALERT|BOOT_COMPLETED" "$REPORT" 2>/dev/null; then
        write_report "⚠️  [存在] 危险操作权限/API"
    fi

    # 检查是否有更新检查
    if grep -qiE "update_check|download_url|force_update|version_check" "$REPORT" 2>/dev/null; then
        write_report "⚠️  [存在] 更新检查/下载"
    fi

    write_report ""
    write_report "详细报告: $REPORT"
    write_report "解码目录: $DECODED_DIR"
    write_report "（如需修改，用 Mt 管理器打开 $DECODED_DIR 目录下的 smali 文件）"
    write_report ""
    ok "总结完成"
}

# ===================== 主流程 =====================
main() {
    echo ""
    info "开始分析: $APK_NAME.apk"
    echo ""

    step1_basic
    echo ""
    step2_decode
    echo ""
    step3_search
    echo ""
    step4_native
    echo ""
    step5_components
    echo ""
    step6_deep
    echo ""
    step7_summary

    echo ""
    echo "=========================================="
    echo -e "  ${GREEN}分析完成!${NC}"
    echo "  报告: $REPORT"
    echo "  解码: $DECODED_DIR"
    echo "=========================================="
}

main