1

Been trying at this for over a week, and I'm able to modify the needed sections, however I'm running into a major issue while trying to recompile the APK that is making the whole task atrocious. So I've sucked up my pride and am asking for help from other people.

I've been tasked with RE'ing an android app that has been giving me issues. To date, I've been able to decompile and recompile the app into an "almost working" apk. Without modifying anything, recompiling the app is fine, but when I try to run it on the AVM or an actual test device, it crashes repeatedly with a stack trace due to the following:

2173-2173/com.[removed].[removed] E/[removed]﹕ java.lang.UnsatisfiedLinkError: Native method not found: com.[removed].crypto.openssl.OpenSSLWrapper.GenerateSeedHash:([BLjava/lang/String;)[B

I've removed the apk name as it is work-related information and hopefully not necessary to solving the issue.

Right before I get the stack trace, I've noticed a bit more of information that might be helpful:

    04-27 12:00:07.599    2173-2173/com.[removed].[removed] ﹕ CPU -- Arch same ? -> true
    04-27 12:00:07.599    2173-2173/com.[removed].[removed] : libcrypto.so.1.0.0 already exists
    04-27 12:00:07.599    2173-2173/com.[removed].[removed] ﹕ CPU -- Arch same ? -> true
    04-27 12:00:07.599    2173-2173/com.[removed].[removed] ﹕ libssl.so.1.0.0 already exists
    04-27 12:00:07.599    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Trying to load lib /data/data/com.[removed].[removed]/files/libcrypto.so.1.0.0 0xb310e1f0
    04-27 12:00:07.609    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Added shared lib /data/data/com.[removed].[removed]/files/libcrypto.so.1.0.0 0xb310e1f0
    04-27 12:00:07.609    2173-2173/com.[removed].[removed] D/dalvikvm﹕ No JNI_OnLoad found in /data/data/com.[removed].[removed]/files/libcrypto.so.1.0.0 0xb310e1f0, skipping init
    04-27 12:00:07.619    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Trying to load lib /data/data/com.[removed].[removed]/files/libssl.so.1.0.0 0xb310e1f0
    04-27 12:00:07.619    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Added shared lib /data/data/com.[removed].[removed]/files/libssl.so.1.0.0 0xb310e1f0
    04-27 12:00:07.619    2173-2173/com.[removed].[removed] D/dalvikvm﹕ No JNI_OnLoad found in /data/data/com.[removed].[removed]/files/libssl.so.1.0.0 0xb310e1f0, skipping init

Any help is extremely appreciated as it's been quite some time tinkering, googling, etc. and I've had no success of getting the APK to run without issue.

Thanks all

Improve this question
9
  • Have you tried just modifying the smali? Actually a good first step would be to just run apktool to unpack and repack it without modifying anything. That's a good way to check if it's say, introspecting its certs for obfuscation purposes. Speaking of which, have you checked what kind of obfuscation if any it's using?
    – Antimony
    Apr 28, 2015 at 2:34
  • Yeah I've done that. After I kept running into issues I tried unpacking, repacking (no changes) and running. It has a built in tamper detection, but setting a breakpoint on that and bypassing it still causes the crash, so it's a tad frustrating... It doesn't seem to be using any obfuscation as I can convert it back into readable java, but if I'm missing anything please let me know. edit - going to start looking into the cert thing. Unfortunately not familiar with that technique so will do research and try to find areas in the code reflecting it. Thanks for the help!
    – dunless
    Apr 28, 2015 at 14:08
  • @Antimony - since this crash is specifically related to native methods not being found in the .so, I figured it was something to do with the "No JNI_OnLoad found" error being spit out. Couldn't find any information online about explicit techniques to induce this for anyone RE'ing it.
    – dunless
    Apr 28, 2015 at 14:13
  • Have you checked whether the unmodified app runs on your device? If the problem is libcrypto/libssl specifically, this is probably due to the issue of apps that link to openssl without including it suddenly crashing in newer versions of Android where the platform openssl changed. They're not supposed to do that but that doesn't stop app authors from doing it in practice.
    – Antimony
    Apr 28, 2015 at 15:37
  • @Antimony - yes. The default app works fine on the phone. Decompiling / Recompiling forces the issue. Seems strange that it can't recompile and work as it did originally. Wondering if its an issue with apktool or a built in defense.
    – dunless
    Apr 28, 2015 at 15:44

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.