project-nomad/
├── core/               # 核心分析引擎
│   ├── decompiler.py   # 反编译模块
│   ├── analyzer.py     # 代码分析器
│   └── extractor.py    # API 提取器
├── plugins/            # 可扩展插件
│   ├── retrofit.py     # Retrofit 注解解析
│   ├── okhttp.py       # OkHttp 拦截器
│   └── websocket.py    # WebSocket 分析
├── utils/              # 工具函数
│   ├── logger.py       # 日志模块
│   └── config.py       # 配置管理
├── output/             # 输出目录
│   ├── reports/        # 分析报告
│   └── graphs/         # 调用关系图
└── scripts/            # 自动化脚本
    ├── decompile.sh    # 反编译脚本
    └── find-api-calls.sh  # API 查找脚本

// AndroidManifest.xml 中的组件声明
<application android:name=".App">
    <activity android:name=".MainActivity">
        <intent-filter>
            <action android:name="android.intent.action.MAIN"/>
            <category android:name="android.intent.category.LAUNCHER"/>
        </intent-filter>
    </activity>
    <service android:name=".SyncService"/>
    <receiver android:name=".NetworkReceiver">
        <intent-filter>
            <action android:name="android.net.conn.CONNECTIVITY_CHANGE"/>
        </intent-filter>
    </receiver>
    <provider android:name=".DataProvider"
              android:authorities="com.example.provider"/>
</application>

.class public Lcom/example/MainActivity;
.super Landroidx/appcompat/app/AppCompatActivity;

.method public onCreate(Landroid/os/Bundle;)V
    .registers 2
    invoke-super {p0, p1}, \
        Landroidx/appcompat/app/AppCompatActivity;->onCreate(Landroid/os/Bundle;)V

    const v0, 0x7f0a0001    # R.layout.activity_main
    invoke-virtual {p0, v0}, \
        Lcom/example/MainActivity;->setContentView(I)V

    # 调用 API 初始化方法
    invoke-direct {p0}, \
        Lcom/example/MainActivity;->initApi()V

    return-void
.end method

// 三种常见的 Android 网络请求方式

// 方式1：Retrofit（最常用）
Retrofit retrofit = new Retrofit.Builder()
    .baseUrl("https://api.example.com/")
    .addConverterFactory(GsonConverterFactory.create())
    .build();

ApiService service = retrofit.create(ApiService.class);
Call<User> call = service.getUser("123");
call.enqueue(new Callback<User>() {
    @Override
    public void onResponse(Call<User> call, Response<User> response) {
        User user = response.body();
    }
});

// 方式2：OkHttp（底层）
OkHttpClient client = new OkHttpClient();
Request request = new Request.Builder()
    .url("https://api.example.com/users/123")
    .addHeader("Authorization", "Bearer " + token)
    .build();
try (Response response = client.newCall(request).execute()) {
    String json = response.body().string();
}

// 方式3：HttpURLConnection（原生）
URL url = new URL("https://api.example.com/users/123");
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod("GET");
conn.setRequestProperty("Authorization", "Bearer " + token);
int code = conn.getResponseCode();

# 环境安装命令
# 安装 jadx（macOS）
brew install jadx

# 安装 apktool
brew install apktool

# 安装 Frida（需要 Python3）
pip3 install frida-tools

# 验证安装
jadx --version
apktool --version
frida --version

# 反编译 APK
jadx -d output/ target_app.apk

# 输出目录结构：
# output/
# ├── resources/          # 资源文件
# │   ├── AndroidManifest.xml   # 应用清单（组件声明）
# │   ├── res/                  # 布局、图片、字符串等
# │   └── assets/               # 原始资源文件
# └── sources/            # 反编译的 Java 源代码
#     └── com/
#         └── example/
#             ├── MainActivity.java
#             ├── api/
#             │   ├── ApiClient.java       # API 客户端
#             │   ├── ApiService.java      # API 接口定义
#             │   └── ApiInterceptor.java  # 请求拦截器
#             ├── model/
#             │   ├── User.java
#             │   └── Response.java
#             └── utils/
#                 ├── Constants.java       # 常量定义（含 API URL）
#                 └── CryptoUtil.java      # 加密工具

// Retrofit API 接口定义示例
public interface ApiService {
    @GET("api/v1/users/{id}")
    Call<User> getUser(@Path("id") String userId);

    @POST("api/v1/auth/login")
    Call<AuthResponse> login(@Body LoginRequest request);

    @GET("api/v1/products")
    Call<List<Product>> getProducts(
        @Query("category") String category,
        @Query("page") int page
    );

    @Multipart
    @POST("api/v1/upload")
    Call<UploadResponse> uploadFile(
        @Part MultipartBody.Part file
    );
}

# API 自动提取器核心逻辑
class ApiExtractor:
    """从反编译的源代码中自动提取 API 端点"""

    def extract(self, source_dir: str) -> List[ApiEndpoint]:
        endpoints = []

        # 策略 1：扫描 Retrofit 注解
        for file in find_java_files(source_dir):
            if "@GET" in file.content or "@POST" in file.content:
                endpoints.extend(
                    self._parse_retrofit(file)
                )

        # 策略 2：扫描 OkHttp 请求构建
        for file in find_java_files(source_dir):
            if "Request.Builder" in file.content:
                endpoints.extend(
                    self._parse_okhttp(file)
                )

        # 策略 3：扫描硬编码 URL
        for url in find_urls(source_dir):
            endpoints.append(
                ApiEndpoint(url=url, source="hardcoded")
            )

        return self._deduplicate(endpoints)

    def _parse_retrofit(self, file):
        """解析 Retrofit 接口定义"""
        endpoints = []
        for match in re.finditer(
            r'@(GET|POST|PUT|DELETE|PATCH)\("([^"]+)"\)',
            file.content
        ):
            method = match.group(1)
            path = match.group(2)
            endpoints.append(
                ApiEndpoint(method=method, path=path,
                           source_file=file.path)
            )
        return endpoints

# 反混淆工具的核心逻辑
class Deobfuscator:
    """基于上下文推断混淆代码的含义"""

    def __init__(self, decompiled_source):
        self.source = decompiled_source
        self.rename_map = {}

    def analyze(self):
        # 策略 1：通过字符串常量推断方法功能
        string_methods = self._find_string_references()

        # 策略 2：通过 API 调用推断类功能
        api_classes = self._find_api_callers()

        # 策略 3：通过 UI 资源 ID 关联
        resource_mappings = self._find_resource_refs()

        # 策略 4：通过继承关系推断
        inheritance_map = self._analyze_inheritance()

        # 生成重命名映射
        self.rename_map = self._build_rename_map(
            string_methods, api_classes,
            resource_mappings, inheritance_map
        )

        return self.rename_map

// 典型的 MVVM 调用链路
// 1. 用户点击登录按钮
LoginActivity.onLoginClick()
    → LoginViewModel.login(email, password)
        → AuthRepository.login(credentials)
            → ApiService.login(request)      // Retrofit 接口
                → HTTP POST /api/v1/auth/login
            ← AuthResponse (token, user)
        ← Result.success(user)
    → navigateTo(MainActivity)

// Frida 脚本：拦截网络请求
Java.perform(function() {
    // 拦截 OkHttp 的请求
    var OkHttpClient = Java.use("okhttp3.OkHttpClient");
    var Request = Java.use("okhttp3.Request");
    var RealCall = Java.use("okhttp3.internal.connection.RealCall");

    // Hook execute 方法
    RealCall.execute.implementation = function() {
        var request = this.request();
        var url = request.url().toString();
        var method = request.method();
        var headers = request.headers().toString();

        console.log("[HTTP] " + method + " " + url);
        console.log("[Headers] " + headers);

        // 获取请求体
        var body = request.body();
        if (body !== null) {
            console.log("[Body] " + body.toString());
        }

        // 调用原始方法
        var response = this.execute();

        // 打印响应
        console.log("[Response] " + response.code());
        return response;
    };
});

# 练习二参考框架：API 分类器
class ApiClassifier:
    """将提取的 API 端点按功能分类"""

    def classify(self, endpoints: List[ApiEndpoint]) -> dict:
        categories = {
            "auth": [],       # 认证相关
            "data": [],       # 数据获取
            "upload": [],     # 文件上传
            "social": [],     # 社交功能
            "payment": [],    # 支付功能
            "analytics": [],  # 数据统计
            "unknown": [],    # 未分类
        }

        keywords = {
            "auth": ["login", "token", "auth", "session"],
            "data": ["get", "list", "search", "query"],
            "upload": ["upload", "file", "image", "media"],
            "social": ["share", "comment", "like", "follow"],
            "payment": ["pay", "order", "cart", "purchase"],
            "analytics": ["track", "log", "event", "metric"],
        }

        for ep in endpoints:
            category = self._match_category(ep, keywords)
            categories[category].append(ep)

        return categories