5

I'm trying to reverse engineer certain Samsung system apps in the Galaxy S6 firmware system image, such as KnoxAttestationAgent.apk. I'm a noob when it comes to reverse engineering, and so far my attempts have been unsuccessful. Here's what I've done so far.

  • Run apktool on the APK. I got a few XML files, including the AndroidManifest, but no source. Apparently this is because there is no classes.dex in the package.
  • Noticing that there's a KnoxAttestationAgent.odex in the arm64/ folder, I tried to run baksmali 2.1.1 on it. However, this version apparently doesn't support Android 5 versions of oat. The S6 firmware I'm working on is 5.1.1.
  • I tried an earlier version of baksmali 2.0.8 which doesn't have the limitation, but I get another error "KnoxAttestationAgent.odex is not an apk, dex file or odex file."
  • I tried to run AndroGuard on the APK, but was also unsuccessful. A bunch of errors.

Is there a way for these tools (or others) to work on system apps such as the Samsung Knox ones?

Thanks!

Improve this question
1
  • A lot of system apps are also uploaded to Play. If it is, you can get an ordinary non-odexed apk that way.
    – Antimony
    Apr 11, 2016 at 14:01

1 Answer 1

Reset to default
3

Run apktool on the APK. I got a few XML files, including the AndroidManifest, but no source. Apparently this is because there is no classes.dex in the package.

That's because these are odexed apps: when an app is odexed, the classes.dex is extracted from the apk.

I tried an earlier version of baksmali 2.0.8 which doesn't have the limitation, but I get another error "KnoxAttestationAgent.odex is not an apk, dex file or odex file."

That's right, because the .odex file is not an apk. An odex file is basically an optimized version of the classes.dex

So, in order to disassemble this app, you have to deodex it.

Here is an HOW-TO guide (I haven't tested it personally): http://www.naldotech.com/how-to-deodex-applications-on-android-5-0-lollipop/

Eventually, if you follow all the steps correctly, you will have an apk ready to be reversed using APKTool. Good luck.

Improve this answer
1
  • 2
    Thanks. I ended up just using oat2dex on the odex file, which generated a dex file, and then dex2jar on the generated dex file, which generated a jar file, and finally used JD-GUI on the jar file.
    – user1118764
    Apr 12, 2016 at 2:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.