0

Lets say an Android application sends out a traffic out to the server and expects a Json Response

Request:

https://server:port/userid=user1&token=randomstring7345

We want to replicate the traffic using python library now, the 'randomstring7345' keeps changing everytime, there is a function logic inside the application which generates it on the fly.

If this was a web application we would have used chrome network tab to do a stack trace once the traffic is generated and then use technical breakpoints to find out the Javascript code which generates the 'randomstring7345'. How can we do the same in Android. first step would be to decompile the application apk I guess and then how do we proceed from there to find out the exact function/logic?

what I am trying to do.

  • reverse engineer an android apk (bit novice here)
  • create a python library to automate the apk api calls (i can do this once i get the equivalent android code logic)

for sake of simplicity, lets say there is an flight reservation android app

Here is the flow:

  • open the apk, which presents a login screen (user | pass)
  • once you click login you get a Json reply from server a. {Fail: Wrong pass} or b. {Success: login_tokenID}
  • now I put sourceAirport as A DestinationAirport as B and flydate '2018-06-09' and click on Confirm

The traffic that goes out:

https://myflights.com:port/userid=user1&token=login_tokenID&accesstoken=8833456&from=A&to=b&date=2018-06-09

Server sends back Json a. {Fail : Choose another date} b. {Success: confirmed}

note the flow here the app computes internally accesstoken=8833456 which it supplies in the request else server wont respond to it. I need to find exactly where this logic resides in the app so that I can replicate it.

1

Hello you can start with the following approach:

  1. Decompile the apk file with apktool
  2. convert classes.dex to .jar with dex2jar
  3. open the file with some java decompiler. My favorite is Luyten
  4. Find the specific function
$ apktool d app-uat-release.apk -s -o dex
$ cd dex
$ d2j-dex2jar classes.dex 
dex2jar classes.dex -> classes-dex2jar.jar
$ java -jar /path/to/Luyten.jar classes-dex2jar.jar

I can point you in the right direction, but to this i need to know what exactly you want to do.

  • Hi Thanks for your reply. I have been playing around with similar approach used jg-gui in the third step instead of luyten. I get partial error while using dex2jar I got most code though but here and there it looks broken... dex2jar classes.dex -> .\classes-dex2jar.jar Detail Error Information in File .\classes-error.zip Please report this file to code.google.com/p/dex2jar/issues/entry if possible. What I am looking for is a way which can set up breakpoints on the code which stops when maybe when a button is clicked or all the function required to generate a traffic – Curi0usM3 Jun 27 '18 at 14:08
  • @Curi0usM3 You can setup the debugger with smali files & github.com/JesusFreke/smali/wiki/smalidea. To get smali sources you need to run apktool without -s. Setting up smalidea can be tricky so i wish you good luck. :) btw. cant you just find the endpoint in the jd-gui search and read the app logic from there? – TheKalin Jun 27 '18 at 14:28
  • jd-gui search i coudnt get the function. yet maybe hidden somewhere or obfuscated. next step would be learning smali. sigh! – Curi0usM3 Jun 27 '18 at 14:54
  • Reverse engineering is not an easy task. In 99% cases you have to combine multiple techniques to achieve the goal. PS: I would appreciate if you could accept my answer. PS2: Don't be afraid to ask more questions. – TheKalin Jun 27 '18 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.