如何分析混淆的第 3 方库代码的泄漏痕迹

Question

我发现了内存泄漏（使用 LeakCanary），但泄漏跟踪中的代码被混淆了。我对代码混淆没有太多经验，我想知道是否有办法对其进行反混淆，或者是否可以禁用第三个库代码的代码混淆？

我使用的第三个库代码是yandex-ads-sdk。泄漏痕迹：

2020-10-20 12:03:00.931 D/LeakCanary: ?
????
? GC Root: System class
?
?? com.yandex.metrica.impl.ob.dr class
?    Leaking: NO (a class is never leaking)
?    ? static dr.a
?                ~
?? com.yandex.metrica.impl.ob.dr instance
?    Leaking: UNKNOWN
?    Retaining 125 bytes in 5 objects
?    f instance of com.example.Application
?    ? dr.h
?         ~
?? com.yandex.metrica.impl.ob.bj instance
?    Leaking: UNKNOWN
?    Retaining 1538 bytes in 60 objects
?    q instance of com.example.MainActivity with mDestroyed = false
?    a instance of com.example.Application
?    ? bj.n
?         ~
?? com.yandex.metrica.impl.ob.aao instance
?    Leaking: UNKNOWN
?    Retaining 249 bytes in 13 objects
?    ? aao.i
?          ~
?? com.yandex.metrica.uiaccessor.a instance
?    Leaking: UNKNOWN
?    Retaining 12 bytes in 1 objects
?    ? a.b
?        ~
?? com.yandex.metrica.uiaccessor.a$1 instance
?    Leaking: UNKNOWN
?    Retaining 368482 bytes in 3462 objects
?    Anonymous subclass of androidx.fragment.app.FragmentManager$FragmentLifecycleCallbacks
?    a instance of com.example.MainActivity with mDestroyed = true
?    ? a$1.a
?          ~
?? com.example.MainActivity instance
?     Leaking: YES (ObjectWatcher was watching this because com.example.MainActivity received
?     Activity#onDestroy() callback and Activity#mDestroyed is true)
?     Retaining 368470 bytes in 3461 objects
?     key = 5b3ef21a-0cf4-4dae-b329-9dd2e9d2657e
?     watchDurationMillis = 5398
?     retainedDurationMillis = 397
?     mApplication instance of com.example.Application
?     mBase instance of android.app.ContextImpl, not wrapping known Android context

METADATA

Build.VERSION.SDK_INT: 26
Build.MANUFACTURER: samsung
LeakCanary version: 2.5
App process name: com.example.app
Stats: LruCache[maxSize=3000,hits=2461,misses=58027,hitRate=4%]
RandomAccess[bytes=2861846,reads=58027,travel=20176117749,range=13550252,size=16944114]
Analysis duration: 32101 ms

Answer 1

不幸的是，Yandex 库被混淆了，您需要映射文件才能对泄漏跟踪进行反混淆（请参阅https://square.github.io/leakcanary/changelog/#deobfuscating-hprof-files）

如果你想进一步挖掘，你可以在 Maven 中心下载 mobmetricalib AAR （直接链接，然后使用JD-GUI反编译字节码。它仍然会被混淆，但你可以导航它。例如，这里是泄漏跟踪底部的类：

package com.yandex.metrica.uiaccessor;

import android.app.Activity;
import android.support.annotation.NonNull;
import android.support.annotation.Nullable;
import android.support.v4.app.FragmentActivity;
import android.support.v4.app.FragmentManager;

public class a implements b {
  @NonNull
  private final a a;
  
  @Nullable
  private FragmentManager.FragmentLifecycleCallbacks b;
  
  public a(@NonNull a parama) throws Throwable {
    this
      .a = parama;
  }
  
  public void b(@NonNull Activity paramActivity) throws Throwable {
    if (paramActivity instanceof FragmentActivity) {
      if (this.b == null)
        this
          .b = new FragmentLifecycleCallback(this.a, paramActivity); 
      ((FragmentActivity)paramActivity)
        .getSupportFragmentManager()
        .unregisterFragmentLifecycleCallbacks(this.b);
      ((FragmentActivity)paramActivity).getSupportFragmentManager().registerFragmentLifecycleCallbacks(this.b, true);
    } 
  }
  
  public void a(@NonNull Activity paramActivity) throws Throwable {
    if (paramActivity instanceof FragmentActivity && this.b != null)
      ((FragmentActivity)paramActivity).getSupportFragmentManager().unregisterFragmentLifecycleCallbacks(this.b); 
  }
  
  public static interface a {
    void a(@NonNull Activity param1Activity);
  }
}

我建议通过泄漏跟踪与图书馆的所有者联系并要求他们修复它。