How to reverse engineer mobile app image?

Question

Scenario

On my phone I have an app. When I login into the app and goto my profile there is an profile picture of me. I want to that picture because I need it. Simple way is just goto an local shop an take an picture but the cool way would be to get that image from the app.

Question

How can I get the image from the app on my mobile?

How I think it could be done:

Use wireshark listen to the mobile traffic from the app and somehow try to get the image. Is this the right way or are there better ones?

Information

Android 8.1.1

Answer 1

Wireshark will be ok, if the traffic is not encrypted. Otherwise you'll have to setup a proxy which will do sniffering of SSL traffic. Also the picture may be sent encoded in some application specific way, so you wouldn't be able to just save it as JPG.

The most thorough way is to decompile the application and find how exactly it gets the picture from the server.

If your device is rooted you may try to search the /mnt/sdcard/Android/data/ for folder where the application stores its temporary data. Most likely your profile picture is cached. But it may be stored as BLOB in some database file. So, there are a lot of possibilities...

Answer 2

To get an image from an mobile app you first want to know if it is stored on your device or if it is loaded when you log in to your account. In my case it was an profile picture witch will be loaded when you login into your app. In that case you can do the following:

1. The first thing to do is Download and install Packet Capture. This app can be used to sniff the network traffic of any app you want.
2. Open the Packet Capture app and click on the `GreenArrow/triangle, select the wanted app you want to listen to. (The first time you have to create a certificate, but this is very easy, just follow the instructions on the screen)
3. If a red stop button appears on the top it means that packet capture is now listening to all the data that the app uses.
4. Open the app you want to listen to and go to the page where the image will be loaded. Now you can stop Packet Capture by clicking on the red stop button
5. When you have stopped the listening you now see in a list a new row appearing with the total captures the app Packet Capture has done. These are the network requests and responses that the app has done. Click on a row and all the captures will be shown.
6. You have to search all the captures and check the json response and see if you see any link from the image page. When you have found the link, then copy and save it for later.

Now you have the image link it depends on the current situation what you want to do.

1. The link can be to an HTML document with the foto. Then you can simply save the image.
2. The link can be from an api witch returns some binary data.

In my case it was an API call. Before I created a script to make that API call I wanted to check the source code of the app and see if there are any descriptions or decoding needs to be done. The following steps are not necessary, but if there is some encryption is encoding you can do the following.

1. Get the APK file from the app and save it to your phone, this can be done with this app

2. Convert the APK to the Java source code, this can be done with this Site. Download the source code and install an editor for it.

3. Now you have the source code find the code where the image will be loaded from the API or just an HTTP call. And just find any clues on decryption decoding or autoriensation that the app uses. You have to figure this out because every situation can be diffrent. In my sittation the app did not had any autherisation for the API and the data returend whas not encrypted. I just searched for the code where the my profile picture was stored form there I searched to all refrences and found the place where the profile picture was loaded from an API call.

Now I know where I can get my image from I can create an C# program to get the bytes from the API and convert that to an image.

// Create a request for the URL.   
WebRequest request = WebRequest.Create(
            "weburl/to/the/api");

// Get the response.  
WebResponse response = request.GetResponse();

// Get the stream containing content returned by the server.  
Stream dataStream = response.GetResponseStream();

var bitmap = Bitmap.FromStream(dataStream);

response.Close();

bitmap.Save("mypicture.png");

If your device is rooted you may try to search the /mnt/sdcard/Android/data/ for folder where the application stores its temporary data. Most likely your profile picture is cached. But it may be stored as BLOB in some database file. Actualy you don't always need root access to access the cache of an app. Go to the folder: /mnt/sdcard/Android/data//Cache. If this folder is not located it can be that the app has made the cache invisible in this case you need to root you phone.