3

In the case of an PE file or an ELF file, there is quite a lot of material out there on how to approach deobfuscation, dumping from memory, reconstructing symbols etc. For android binaries that does not seem to be the case.

  1. How do you approach APKs that are obfuscated with ProGuard, DexGuard or custom obfuscators?
  2. How do you deal with string encryption and reflection? Do you debug via jdb and look for class loading?
  3. Any reading recommendations?
  • 2
    github.com/CalebFenton/simplify might be useful. Wrt *Guard obfuscators - their mangling is one-way and not recoverable, so perhaps get a decompiler that lets you edit method names etc or at least comment them – Vitaly Osipov Feb 1 '16 at 8:11
  • some way to be able to make this possible to revert the new code as long as I use proguard – Gorge Santana Aug 17 '18 at 5:57
  • Was wondering if more people can chip in with additional answers, this is something that is relevant even today. Any tips would be really helpful! – skep Aug 26 at 20:43
5

Here's how I would approach it. Which isn't necessarily the best approach.

The first step is to find out what kind of obfuscation the app is using by looking around with your favorite decompiler. Most apps actually aren't obfuscated, or only have name obfuscation. If the names are obfuscated, it will still be annoying to RE, but the code is at least intact.

If the app has name obfuscation, you can try to see if they also obfuscated any popular libraries or sdks. Google some of the string literals and see if anything is recognizable as an open source library. If so, you can write a script to match up the obfuscated code with the open source library code and replace everything with the unobfuscated names. This usually takes some heuristics and manual tuning since things won't match up exactly. Once you've removed the libraries, the amount of code you need to manually RE is greatly reduced.

A few apps have more complicated obfuscation methods. For example, string encryption. Some people will actually run the code to dump the decrypted strings, which has the advantage of (mostly) working regardless of encryption method. I prefer to do everything statically, so I just look at what the decryption functions do and write a script to decrypt all the strings in the code and replace them with the original strings.

I actually haven't seen any Android apps which use reflection for obfuscation (using it to access private apis is another story). But I have seen it in Java programs, and it's still pretty simple to handle. Once you've decrypted all the strings, you can write another script to replace the reflection calls with the original methods.

That's about it as far as Java code obfuscators go. Packers and native code loaders are a different story. I don't have experience with them, but the usual approach is to run the app and dump the unpacked code.

1

I cannot help much with the deobfuscation step, as i'm also struggling with that. My best option is to decompile the code and use Sublime Text 3 to do the refactoring (its "Add Folder to Project" option also helps a lot in code analysis).

Bytecode Viewer will also be helpful as it gives you the output of 5 differente decompilers along with smali output. Might not seem like much, but comparing the outputs side-by-side really speeds up the reading of some "bottleneck region" code

What i can offer you is the name of a tool that will aid you in those string decryption and reflection issues.

FRIDA is a dynamic instrumentation tool for Android apps, letting you add your own code into the application using Javascript. It will let you print decrypted text, tweak the app code so that it gives you more information about the data, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy