Timeline for Android - Analyzing complex hash algorithm
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 2, 2018 at 19:10 | comment | added | Arya | @Antimony would using dynamic instrumentation such as Frida be of any use here? | |
| Dec 28, 2017 at 6:15 | comment | added | Arya | Did you end up finding the algorithm? If so how? | |
| Mar 12, 2016 at 21:48 | vote | accept | 43.52.4D. | ||
| Feb 7, 2016 at 22:00 | comment | added | Antimony | Apart from that, you probably forgot to specify a path to all the dependencies. Here's the command line I used. You'll need to replace stuff/android with the path to your Android SDK. python Krakatau/decompile.py -out temp apk_apps/Instagram_v7.15.0_apkpure.com-enjarify.jar -path stuff/android/android-23/android.jar -path stuff/android/android-23/optional/org.apache.http.legacy.jar -path stuff/android/android-23/data/layoutlib.jar | |
| Feb 7, 2016 at 21:59 | comment | added | Antimony | Sorry it took so long to get back to you. I looked into it, and there actually was a bug in Krakatau, which I fixed. It decompiles without errors with the latest version of Krakatau. | |
| Jan 14, 2016 at 23:02 | comment | added | 43.52.4D. | @Antimony any tips? | |
| Jan 14, 2016 at 5:06 | comment | added | 43.52.4D. | @Antimony I just tried out Enjarify with Krakatau (nice code btw) but I don't think it's useful in this situation. Krakatau had many errors and couldn't decompile all the code correctly (The error logs were written in the java files). Although Krakatau had nicer output than others, it's still difficult to understand. Also: it's obvious Proguard has been used on this app. The algorithm is spread out between an infuriating amount of files. There are so many calls to so many different useless functions jumping around everywhere. How do I find out meaningful information in a situation like this? | |
| Jan 13, 2016 at 22:07 | comment | added | Antimony | I wouldn't use IDA Pro for Java. It's designed for native code. There's lots of free Java tools to choose from. Personally I'd go with Apktool + Enjarify + Krakatau. | |
| Jan 13, 2016 at 20:43 | comment | added | 43.52.4D. | @Antimony what approach would you take personally to learning how an algorithm generates a value? Do you mean decompiler like Apktool or disassembler like IDA Pro? | |
| Jan 13, 2016 at 19:41 | comment | added | Antimony | I took a look, but I didn't see any unusual obfuscation. Just a bit of identifier renaming. Any recent decompiler should work here. | |
| Jan 13, 2016 at 18:55 | comment | added | 43.52.4D. | @Antimony yes that's correct. I pulled the APK from my phone with adb. Then I used Apktool to convert to SMALI. I can tell you more about the app in a chatroom if you need. | |
| Jan 13, 2016 at 18:48 | comment | added | Antimony | com.instagram.android? | |
| Jan 13, 2016 at 14:54 | comment | added | Antimony | What is the apk name and sha256? If it really has strong bytecode obfuscation, I'd be curious to take a look. You don't see that on Android often. Most apps either have weak obfuscation (Proguard) or just use a packer. | |
| Jan 13, 2016 at 8:36 | answer | added | w s | timeline score: 1 | |
| Jan 13, 2016 at 5:50 | history | asked | 43.52.4D. | CC BY-SA 3.0 |