1

I am debugging a library that is heavily packed / encrypted. Here is a flowchart of the operation of this library and where I am at in my reverse engineering:

flowchart

Assume it is not possible to modify lib__6090__ due to the complexity of the unpacking operation. The problem I am having is this library is detecting something on my android system related to having root access or a modified apk and quitting. I am currently stepping through the program in sections but if I make one mistake, the program quits and I have to start over. Any breakpoints or subroutine names in debug segments cannot be used again as these debug segments relocate to different areas of memory on each run. I am unsure if the offset from the main library is the same or not.

Therefore every time I rerun the program I have to manually search for the subroutines that move to the next debug segment, run to cursor, step into the next segment, it's very time consuming. Is there a way to automatically do this? Maybe with python? Or is there a way to save these debug segments and have them automatically rebase on each run of the program, thus naming functions isn't a waste of time? I also have to manually tell IDA the debug segments are code on every run by highlighting the entire segment and pressing c.

Note: I have tried intercepting c library calls to find the checking code. Unfortunately this has had limited degrees of success and without a call stack I have no idea where I am in the program at that time, or how deep I am in function calls relative to the library.

0

You can save the debug-time segments in the IDB for “offline” analysis but on subsequent runs this will be useful only if they are allocated at exactly the same addresses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.