1

I'm trying to reverse engineering an android app and it's mostly for an experiment but I have a problem that I can't find a solution or even what is the problem.

I decompiled an app with JADX-gui and the whole app only have a single class named

public class ProtectedMyApplication extends Application

and its a really large file and my IDE can't open it well but on this class file there is a byte[] with almost 2000 lines of bytes I can't find any other classes but in the manifest file I can see the other classes

my questions are : what is this method? and how can I study it? and is there a way to see the original smali or java code?

UPDATE:

app is using Dexprotecter I think and I watched the changing files and when I start the app there is two folders that will be modify one of them is the encrypted code (a .dat file with a .dex file) and there is another folder named app_outdex and I think this is the decrypted code but I can't catch the file app will remove it immediately is there any way to catch the file? I'm really so dumb in the Linux

Improve this question
14
  • 1
    It's been obfuscated specifically to frustrate you, maybe even in a way tuned to make decompilers produce garbage. If you really want to study this, you'll probably need to look at the smali code and not try to turn it back into Java, at least not until you can find meaningful patterns. Typically what is most accessible to analysis is interaction with the system libraries, which can't distorted too much without measured more extreme than usually taken. What goal are you trying to accomplish, anyway? – Chris Stratton Mar 22 '19 at 19:45
  • @ChrisStratton hi I find the method its Dexguard Decrypting the bytes in runtime and I just want to find the way app connects to API – Amin Mar 22 '19 at 21:10
  • 1
    Can you elaborate on what exactly you want to study? May be don't really need to de-obfuscate the file. – PhoeniX Mar 23 '19 at 19:12
  • @PhoeniX hi I'm trying to see the API requests and the API calls is encrypted and i can't see it with MITM – Amin Mar 24 '19 at 20:02
  • 1
    @Amit, use Frida to hook unlink/remove API call to backup the file that is being removed. – PhoeniX Mar 26 '19 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.