1.执行流程

1. 通过apktool反编译apk（输入参数apk路径）
2. 得到反编译后的AndroidManifest.xml文件
3. 通过FindActivity.py得到Activity_List（activity列表）
4. 删除Activity_List中含有不需要调起的activity
5. 运行NullPointer.py，输出log在指定文件夹
6. 手动分析log

2.环境

1. MacBook
2. Python 2.7
3. apktool（https://ibotpeaches.github.io/Apktool/install/）

3.遇到的问题

1.只能用启动activity来测试空指针，无法做其他操作，例如传参点击操作
2.activity不允许外部被调用，无法测试

报错：java.lang.SecurityException: Permission Denial: starting Intent
因为在AndroidManifest.xml文件中activity默认是android:exported="false"不允许被外部调用

4.总结

所以使用空指针脚本来测试空指针问题，并不是很完美。

5.代码示例

1. 找出所有activity

'''
import xml.dom.minidom as minidom
import sys
def find_activities(filePath):
    xml = minidom.parse(filePath)
    root = xml.getElementsByTagName('manifest')
    appNode = None
    for node in root[0]._get_childNodes():
        if(node._get_localName() == "application"):
            appNode = node
            break
    content = ''
    for item in appNode._get_childNodes():
        if(item._get_localName() == 'activity'):
            content = content + item.getAttribute("android:name") + '\n'

    fs = open("Activity_List", 'w')
    fs.write(content)
    fs.close()
if __name__ == '__main__':
    filePath = sys.argv[1]
    find_activities(filePath)
'''

2. 空指针检查脚本

'''
import os
import sys
import time
import threading

PATH = sys.path[0]
PKG_NAME = sys.argv[1]

#先判断设备是否连接
os.popen("adb wait-for-device")
os.popen("adb logcat -c")


#遍历文件获得activities 的值
def CheckNullPoint():
    f = open(PATH + "/" + "AC_list_filter", "r")
    for line in f.readlines():
        os.popen('adb shell am start -n %s/%s' % (PKG_NAME, line))
        # print("adb shell am start -n %s/%s" % (PKG_NAME, line))
    time.sleep(3)
    f.close()


def CatLog():
    os.popen('adb logcat >> %s/log.txt' % PATH)


def kill_adb():
    os.popen('adb kill-server')


def quit_app():
    os.popen('adb shell input keyevent 4')


t2 = threading.Thread(target=CatLog)
t1 = threading.Thread(target=CheckNullPoint)
t2.start()
t1.start()
t1.join()

print("Success")
#back键退出应用
for i in range(10):
    quit_app()

kill_adb()'''

3. sell脚本

'''
if [[ -d "apkFile" ]]; then
    rm -r AC_list_filter Activity_List apkFile log.txt
fi
WORKSPACE=`pwd`
#apk地址
echo "Please enter the apk file address:"
read apk_address
#读取包名
echo "Please enter the package name:"
read pkg_name
#反编译
apktool d ${apk_address} -o apkFile
#获取安卓manifest文件
ANDROID_MANIFEST=${WORKSPACE}/apkFile/AndroidManifest.xml
#通过FindActivity.py获取Activity列表
python FindActivity.py ${ANDROID_MANIFEST}
#删除包含"loader.a.ActivityN1/loader.a.ActivityP0/loader.a.ActivityP1/loader.a.ActivityP2"的Activity
sed '/ads.naga/d;/ss.android/d;/baidu.mobads/d;/qq/d;/bytedance/d' Activity_List > AC_list_filter
#运行python nullpointer.py，输出log在指定文件夹
echo "Starting..."
python NullPointer.py ${pkg_name}
echo "log文件：${WORKSPACE}/log.txt"
'''