2

As part of a bug bounty program, I am trying to reverse engineer the bumble android mobile application via dynamic analysis. I find that if I use apktool to disassemble the apk and reassemble it again without even changing anything, the app will cease to function. It is able to start up but it complains that there is a problem with the internet connection. What are some ways apks use to prevent debugging and are there any known ways to overcome them?

Update: Actually when i mentioned debugging i meant smali debugging where the apk is disassembled to smali code, android:debuggable="true" is added to the manifest and the apk is recompiled to become debuggable. An IDE is then used to attach the debugger to the already running app process, where debugging is done via the disassembled smali code. Details: http://d-kovalenko.blogspot.sg/2012/08/debugging-smali-code-with-apk-tool-and.html

1
  • Have you tried searching the disassembled smali for the error message?
    – Antimony
    Jul 24, 2017 at 14:33

3 Answers 3

0

If you recompile the apk, you need to resign the app, which will change the certificate.. And the application can use some method to "detect" such changes which is very similar to "INT 3" detection under x86... So yes, the application can check/use its certificate as a way for anti-debugging/tampering

Another way to make the change much "stealthy" is to use xposed module to hook the debuggable flag, however, it can still be detected since xposed module introduced stack changes and the program can also find that.

Bottom line is if there's a "delta" between debugging and running normally, the way to detect such "delta" is a potentially anti-debug technique.

0

An APK downloaded from Google Play will almost always be impossible to debug. The reason for this is that APK files require signing before they can be published, and for a signed APK, the following flag:

android:debuggable="false"

is assigned automatically in the application manifest. So unless the developer has set it to true (unlikely), you're out of luck.

In any case, your question is somewhat ambiguous, as the term debugging implies the presence of source code. The only way to "debug" an APK is to obtain the source code, build and compile it and thereby debug it. That means that you need to decompile the APK, and quite many APK files are sealed off with DexGuard so as to make reverse engineering impossible.

Moreover, there are a whole host of other techniques that make it very difficult to extricate the source code from an APK file. For example, various kinds of constants such as login keys and credentials are stored persistently, and what's more, they're stored in encrypted form. This is just one example, but there you go.

4
  • 2
    impossible->difficult. DexGuard or other protections do not make RE "impossible".
    – Igor Skochinsky
    Jul 24, 2017 at 13:31
  • 1
    In addition, Google Play will reject any apps with debuggable set to true on upload. So the only way you'd find a debuggable app on Play is if it's a really old app that was grandfathered in.
    – Antimony
    Jul 24, 2017 at 14:32
  • actually when i mentioned debugging i meant smali debugging where the apk is disassembled to smali code, android:debuggable="true" is added to the manifest and the apk is recompiled to become debuggable. An IDE is then used to attach the debugger to the already running app process, where debugging is done via the disassembled smali code. Details: d-kovalenko.blogspot.sg/2012/08/… Jul 24, 2017 at 14:41
  • 1
    Instead of modifying the apk to be debuggable, you can also modify a device to allow debugging. E.g. you can debug any app on a userdebug device. I forget the exact system property that controls this. If you don't have a rooted/userdebug device laying around, the emulator images that come with the android sdk are either userdebug or eng. Of course, this still doesn't guaratee successs debugging, because apps may attempt to detect if the devices is rooted, if it's a userdebug device, if it's an emulator, etc.
    – JesusFreke
    Jul 24, 2017 at 17:49
0

After many hours of reverse-engineering, I finally discovered that the app was actually throwing a FacebookAuthorizationException, where the stored key hash in the apk does not match with the one in the developer's portal.(due to re-compilation). I suppose there is no way to surpass this since the access token is needed to log in with facebook. I believe I can therefore safely say that apks that only allow log in with facebook would be almost impossible to modify (and still work) since the access token would not be returned by facebook which is needed for authorization. (Unless the reverser is able to log in to the developer's portal to add the new key hash but that is a different matter)

1
  • 1
    It sounds a checksum error caused the exception. But if it's a checksum verification, it won't detect the modifications done by xposed hooks
    – Y M
    Aug 4, 2017 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.