最近，由于一款逆向REA的软件爆火，笔者尝试利用其并结合WORKBUDDY 软件进行了逆向，并对其恶意行为进行了预测和分析。废话少说，直接上干货。
本来只是相结合本机现有的工具ida7.0来分析，无奈在实施过程中，该rea多次提醒，本机ida 7.0 版本太低，需要升级到8.3及更高版本。在此情形下，智能求助workbuddy AI来进行协助。
以上截图是在命令行执行rea analyze app 命令行的结果：Agent 应用 对rea analyze E:\应急工具集\勇少哥GPS定位.apk
error: Analysis failed
code: capability_unavailable
category: unsupported_provider
message: The selected analysis provider does not support this target. Choose another provider or open a supported extracted binary.
retryable: false
remediation:
action: The selected analysis provider does not support this target. Choose another provider or open a supported extracted binary.
details:
operation: read_binary_inventory_summary
selection_reason: target_unsupported
requested_provider_id: auto
candidate_ids[4]: ghidra,hopper,ida,kuna
rejections[8]:
- provider_id: ghidra code: not_configured reason: Set GHIDRA_INSTALL_DIR to an extracted Ghidra 12.1.x release directory. diagnostics: install_dir: null analyze_headless_path: null native_decompiler_path: null application_properties_path: null provider_version: null java_command: "C:\Program Files\Java\jre1.8.0_351\bin\bin\java.exe" java_home: "C:\Program Files\Java\jre1.8.0_351\bin" java_version: null java_vm_name: null java_os_arch: null java_os_name: null platform: win32 architecture: x64 checks[8]{name,ok,code,detail}: configuration,false,not_configured,GHIDRA_INSTALL_DIR is not set platform,true,null,win32 architecture,true,null,x64 installation,false,executable_missing,Ghidra application properties unavailable version,false,version_unresolved,unknown headless,false,executable_missing,analyzeHeadless unavailable native_decompiler,false,executable_missing,Matching native decompiler for win32/x64 was not found java,false,version_unresolved,"C:\Program Files\Java\jre1.8.0_351\bin\bin\java.exe; application.properties is unavailable"
- provider_id: ghidra code: target_kind_unsupported reason: "Ghidra v1 imports executable targets, not archive targets." diagnostics: host_platform: win32 target_kind: archive target_format: apk architecture: null available_architectures: null executable_role: null managed: null
- provider_id: hopper code: unsupported_host reason: Hopper integration is not supported on win32. diagnostics: launcher_path: /Applications/Hopper Disassembler.app/Contents/MacOS/hopper platform: win32
- provider_id: hopper code: target_kind_unsupported reason: Hopper cannot directly analyze archive targets. diagnostics: target_kind: archive target_format: apk architecture: null
- provider_id: ida code: not_configured reason: "REA configuration is invalid: Set REA_IDA_MCP_CONFIG to an upstream IDA MCP JSON registration; see docs/ida-provider.md." diagnostics: configured: false registration_path: null live_connection_probed: false configuration_details: settings[1]{setting,constraint}: REA_IDA_MCP_CONFIG,Set REA_IDA_MCP_CONFIG to an upstream IDA MCP JSON registration; see docs/ida-provider.md. configuration_remediation: "Correct REA_IDA_MCP_CONFIG in the environment that starts REA (your shell or the MCP client's registration), then rerun."
- provider_id: ida code: target_kind_unsupported reason: "IDA MCP integration admits executable inputs, not analysis databases. Select the original input binary." diagnostics: target_kind: archive target_format: apk
- provider_id: kuna code: not_configured reason: "Set REA_KUNA_COMMAND to the absolute path of a caller-supplied kuna executable (verified with 1.833). REA does not download, install or update Kuna." diagnostics: configured: false version_probed: false
- provider_id: kuna code: target_kind_unsupported reason: "Kuna decompiles executable images, not databases or archives." diagnostics: target_kind: archive target_format: apk
接下来，我才用了workbuddy 辅助做进一步的分析取证工作。
其具体内容如下：
我已经把这份 APK 完整分析完了，并生成了报告。下面是核心结论。
报错 capability_unavailable / unsupported_provider 是双重原因造成的，不是单点故障：
目标类型不被支持：APK 是 ZIP 归档，而 REA 的 4 个提供方（Ghidra / Hopper / IDA / Kuna）全都只接受可执行镜像，因此全部以 target_kind_unsupported: archive 拒绝——即使换提供方也无解。 本机没有一个提供方可真正运行（就算解包成可执行文件也不行）：
Ghidra：GHIDRA_INSTALL_DIR 未设置，且 Java 检测失败（你机器上的 jre1.8.0_351\bin\bin\java.exe 路径畸形、application.properties 不可用）； Hopper：只支持 macOS，unsupported_host（win32）； IDA / Kuna：REA_IDA_MCP_CONFIG、REA_KUNA_COMMAND 均未配置。
解决路径：先解包 → 对 classes.dex（恶意逻辑所在）或 lib/armeabi/liblocSDK_2.3.so 单独分析；再配置一个提供方（推荐装 Ghidra 12.1.x 并设 GHIDRA_INSTALL_DIR，建议配 JDK 17 而不是你现有的 jre1.8）。 鉴于此种情形，继续推进我们的目标：
分析结论：这是一个恶意监控类木马
~~**哥~~GPS定位.apk（包名 com.suimeng，应用名「碎梦GPS定位」，versionName 1.1）是用易安卓 E4A 开发的定位+短信+通讯录+录音监控木马（Stalkerware），关键证据：
- 权限极其激进（29 项）：
RECEIVE/READ/WRITE/SEND_SMS、READ/WRITE_CONTACTS、CALL_PHONE、RECORD_AUDIO、SYSTEM_ALERT_WINDOW、RECEIVE_BOOT_COMPLETED、ACCESS_FINE/COARSE_LOCATION。 - 开机自启 + 后台常驻：
BootBroadcastReceiver（监听BOOT_COMPLETED）+com.baidu.location.f服务运行于:remote进程。 - 数据外传 C2：动态域名
yixuan0608.vicp.net，数据文件/smGPSdw.txt、/juz.dat、/yo.dat；上传数据用DES/CBC/PKCS5Padding+ Base64 加密，IV 全零，硬编码密钥7CF4E86855F9E0745B2DB84BEFED8C68。 - 监控功能：接收短信广播、读
content://sms、可代发短信（SEND_SMS_CONTENT/SEND_SMS_NUM）、读通讯录、拨号、录音、悬浮窗覆盖、采集设备指纹（/proc/meminfo、cpufreq）、WiFi 扫描，并经中国移动 APN 网关10.0.0.172外传。 - 定位展示：
assets/dingwei.html（百度地图打点「你当前的位置」）、assets/quanjing.html（百度全景）。 - 原生库
liblocSDK_2.3.so是标准百度定位 SDK（Java_com_baidu_location_Jni_encode/coorEncry），非恶意代码；恶意逻辑全在classes.dex。
⚠️ 请只在隔离环境（沙箱/模拟器）分析，切勿在个人手机安装运行。 至此，该手机应用软件的危害已跃然纸上，所以建议大家今后在下载安装收集应用时一定要擦亮眼睛，千万不要将不安全或者恶意软件来安装，以免造成不必要的伤害。
