1

Im reversing an apk that uses a native library .so to make calls to some Java methods thru reflexion

I know by analysing the app that exist the followings calls:

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
//This metods are called from native c++ 
//via reflection
Mac mac= Mac.getInstance(method);
//Log this methods parameters
SecretKeySpec key=new SecretKeySpec(byte[],string);
mac.init(key);
ret=m.doFinal();//log the return

The aplication is debuggeable in the manifest

How I can log the parameters of this methods?

1 Answer 1

1

There are several ways you can go about doing this.

Rooted android:
Use Xposed with Inspeckage or your own module to log the calls to these methods.

For a non-rooted android, it's a bit more complicated but shouldn't be too much of a problem.
Decompile the APK and add smali classes that have the same signature of the functions that you intend to log.
inside the functions you created.
For example, if you're looking to hook the method Log.e, then your smali file would look something like this:

.class public LmyLog;
.super Ljava/lang/Object;

.method public e(Ljava/lang/String;Ljava/lang/String;)I
    .locals 1
    # log whatever params you need 
    invoke-static {p0, p1}, LsomeClassForLoggin;->log(Ljava/lang/String;Ljava/lang/String;)V

    invoke-static {p0,p1}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

    move-result v0

    return v0
.end method 

Now, this alone won't be enough because your methods won't get called from the .so.
So next step would be to locate the classname of the method you're looking to hook and log and edit it in a hex editor.
So in this example we'll be looking for Landroid/util/Log; and we'll be replacing it with LmyLog;
That should redirect the calls from smali to your own code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.