以下每一条代码，无论其通过什么方式被调用，在哪个类里被调用，传入什么参数，都具有唯一不变性（在逆向出来的的smali文件里），故可以作为匹配的凭证。

网络操作相关：

Ljava/net/URL;->openConnection()Ljava/net/URLConnection;

Ljava/net/HttpURLConnection;->connect()V

Ljava/io/ByteArrayOutputStream;->write([BII)V

Lorg/apache/http/client/methods/HttpPost;->(Ljava/lang/String;)V

Lorg/apache/http/impl/client/DefaultHttpClient;->execute(Lorg/apache/http/client/methods/HttpUriRequest;)Lorg/apache/http/HttpResponse;

Ljava/io/FileInputStream;->read([B)I

Landroid/net/NetworkInfo;->getState()Landroid/net/NetworkInfo$State;

Landroid/net/NetworkInfo/isConnectedOrConnecting()Z

Ljavax/mail/internet/MimeMessage;->setFrom(Ljavax/mail/Address;)V

Ljavax/mail/Transport;->connect(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V

Ljavax/mail/Transport;->sendMessage(Ljavax/mail/Message;[Ljavax/mail/Address;)V

Lorg/apache/http/client/HttpClient;->execute(Lorg/apache/http/client/methods/HttpUriRequest;)Lorg/apache/http/HttpResponse;

Ljavax/mail/Transport;->sendMessage(Ljavax/mail/Message;[Ljavax/mail/Address;)V

Ljava/net/URL/openStream()Ljava/io/InputStream;

短信操作相关：

content://sms/inbox

content://sms/

Lcn/android/emial/SmSserver;->a(Lcn/android/emial/SmSserver;)Lcn/android/emial/d;

cn.android.emial.SmSserver

Lcn/android/emial/SmSserver;->getPackageName()Ljava/lang/String;

Lcn/android/emial/SmSReceiver;->abortBroadcast()V

Lcn/android/emial/SmSserver;->stopForeground(Z)V

Lcn/android/emial/SmSserver;->unregisterReceiver(Landroid/content/BroadcastReceiver;)V

Landroid/telephony/SmsManager;->getDefault()Landroid/telephony/SmsManager;

Landroid/telephony/SmsMessage;->createFromPdu([B)Landroid/telephony/SmsMessage;

Landroid/telephony/SmsMessage;->getMessageBody()Ljava/lang/String;

Landroid/telephony/SmsMessage;->getOriginatingAddress()Ljava/lang/String;

Landroid/telephony/SmsManager;->divideMessage(Ljava/lang/String;)Ljava/util/ArrayList;

Landroid/telephony/SmsManager;->getDefault()Landroid/telephony/SmsManager;

Landroid/telephony/SmsMessage;->getDisplayMessageBody()Ljava/lang/String;

Landroid/telephony/SmsManager;->sendMultipartTextMessage(Ljava/lang/String;Ljava/lang/String;Ljava/util/ArrayList;Ljava/util/ArrayList;Ljava/util/ArrayList;)V

Landroid/app/PendingIntent;->getBroadcast(Landroid/content/Context;ILandroid/content/Intent;I)Landroid/app/PendingIntent;

Lcn/android/emial/SmSReceiver;->getResultCode()I

Lcn/android/emial/SmSserver;->registerReceiver(Landroid/content/BroadcastReceiver;Landroid/content/IntentFilter;Ljava/lang/String;Landroid/os/Handler;)Landroid/content/Intent;

Landroid/content/Context;->getDatabasePath(Ljava/lang/String;)Ljava/io/File;

Landroid/telephony/SmsManager;->sendTextMessage(Ljava/lang/String;Ljava/lang/String;

Ljava/lang/String;Landroid/app/PendingIntent;Landroid/app/PendingIntent;)V

危害权限相关：

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.READ_LOGS

android.permission.GET_TASKS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_PHONE_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CHANGE_WIFI_STATE

android.app.action.ADD_DEVICE_ADMIN

android.provider.Telephony.SMS_RECEIVED

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.RECEIVE_WAP_PUSH

android.permission.RECORD_AUDIO

android.permission.READ_CONTACTS

android.permission.WRITE_CONTACTS

android.permission.CAMERA

android.permission.INSTALL_PACKAGES

android.permission.SYSTEM_ALERT_WINDOW

android.permission.CALL_PHONE

android.permission.MODIFY_PHONE_STATE

android.permission.PROCESS_OUTGOING_CALLS

android.permission.REBOOT

android.permission.CHANGE_NETWORK_STATE

android.permission.WRITE_SMS

android.permission.SEND_SMS

android.permission.WAKE_LOCK

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.WRITE_SETTINGS

android.permission.DISABLE_KEYGUARDandroid.permission.WRITE_CONTACTS

android.permission.GET_TASKS

android.permission.WRITE_SECURE_SETTINGS

android.permission.READ_USER_DICTIONARY

文件操作相关：

Ljava/io/FileOutputStream;->write([B)V;

Landroid/content/Context;->getFilesDir()Ljava/io/File;

Ljava/io/File;->mkdirs()Z

Ljava/io/File;->exists()Z

Ljava/io/ByteArrayOutputStream;->write([B)V

Ljava/io/File;->listFiles()[Ljava/io/File;

Ljava/io/File;->delete()Z

Landroid/os/Environment;->getExternalStorageDirectory()Ljava/io/File;

Landroid/media/MediaRecorder;->start()V

Landroid/content/Context;->getCacheDir()Ljava/io/File;

系统服务相关：

Landroid/app/ActivityManager;->getRunningTasks(I)Ljava/util/List;

Landroid/app/ActivityManager;->getRunningServices(I)Ljava/util/List;

Landroid/content/ComponentName;->getPackageName()Ljava/lang/String;

Landroid/net/ConnectivityManager;->getActiveNetworkInfo()Landroid/net/NetworkInfo;

Landroid/net/NetworkInfo;->isAvailable()Z

Landroid/net/NetworkInfo;->getType()I

Landroid/net/NetworkInfo;->getSubtype()I

Landroid/content/pm/PackageManager;->getPackageInfo(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;

Landroid/content/pm/PackageInfo;->versionName:Ljava/lang/String;

Landroid/telephony/TelephonyManager;->getNetworkOperator()Ljava/lang/String;

Landroid/telephony/TelephonyManager;->getNetworkOperatorName()Ljava/lang/String;

Landroid/telephony/TelephonyManager;->getSimState()I

Landroid/content/pm/PackageInfo;->versionCode:I

Landroid/telephony/TelephonyManager/getLine1Number()Ljava/lang/String;

Landroid/content/pm/PackageManager;->getApplicationInfo(Ljava/lang/String;I)Landroid/content/pm/ApplicationInfo;

Landroid/telephony/TelephonyManager;->getDeviceId()Ljava/lang/String;

Landroid/telephony/TelephonyManager;->getSubscriberId()Ljava/lang/String;

Landroid/os/Build;->MODEL:Ljava/lang/String;

Landroid/location/Location;->getLatitude()D

Landroid/location/Location;->getLongitude()D

Landroid/location/LocationManager;->removeUpdates(Landroid/location/LocationListener;)V

Landroid/net/ConnectivityManager;->getActiveNetworkInfo()Landroid/net/NetworkInfo;

Landroid/net/NetworkInfo;->isAvailable()Z

Landroid/content/Context;->getPackageManager()Landroid/content/pm/PackageManager;

Landroid/content/pm/ActivityInfo;->packageName:Ljava/lang/String;

Landroid/content/pm/ResolveInfo;->activityInfo:Landroid/content/pm/ActivityInfo;

Landroid/content/pm/PackageManager;->getInstalledPackages(I)Ljava/util/List;

Landroid/os/Build;->MODEL:Ljava/lang/String;

Landroid/app/admin/DevicePolicyManager;->isAdminActive(Landroid/content/ComponentName;)Z

Landroid/location/LocationManager;->requestLocationUpdates(Ljava/lang/String;JFLandroid/location/LocationListener;)V

Landroid/app/NotificationManager/notify(I Landroid/app/Notification;)V

Landroid/media/AudioManager/setRingerMode(I)V

Ljava/lang/Runtime/exec([Ljava/lang/String;)Ljava/lang/Process;

Landroid/content/pm/PackageManager/setComponentEnabledSetting(Landroid/content/ComponentName;II)V

Landroid/provider/Settings$Secure/putString(Landroid/content/ContentResolver;

Ljava/lang/String; Ljava/lang/String;)Z

Landroid/net/ConnectivityManager/getAllNetworkInfo()[Landroid/net/NetworkInfo;

Landroid/content/ContentResolver/openInputStream(Landroid/net/Uri;)Ljava/io/InputStream;

Landroid/location/LocationManager/isProviderEnabled(Ljava/lang/String;)Z

Landroid/content/Context;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;

（network      location  phone     alarm     connectivity     download     device_policy     activity     notification）

解释：

通过字符串network、location、phone等，调用Landroid/content/Context;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;来获取不同的系统服务管理器。故，这些字符串，可以作为获取的系统服务的凭证。

数据库操作：

Landroid/database/sqlite/SQLiteDatabase;->query(Ljava/lang/String;[Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Landroid/database/Cursor

Landroid/database/sqlite/SQLiteDatabase;->rawQuery(Ljava/lang/String;[Ljava/lang/String;)Landroid/database/Cursor;

Lcom/android/tunkoo/scan/n;->getWritableDatabase()Landroid/database/sqlite/SQLiteDatabase;

Lcom/android/tunkoo/scan/n;->getReadableDatabase()Landroid/database/sqlite/SQLiteDatabase;

Landroid/database/sqlite/SQLiteDatabase;->insert(Ljava/lang/String;Ljava/lang/String;Landroid/content/ContentValues;)J

Landroid/database/sqlite/SQLiteDatabase;->update(Ljava/lang/String;Landroid/content/ContentValues;Ljava/lang/String;[Ljava/lang/String;)I

Landroid/database/sqlite/SQLiteDatabase;->delete(Ljava/lang/String;Ljava/lang/String;[Ljava/lang/String;)I

Landroid/database/sqlite/SQLiteDatabase;->execSQL(Ljava/lang/String;)V