21

I am an Android app developer, and recently I encountered a problem with in-app purchase. I discovered that in some apps, in-app purchases can be done for free using this application.

I know this app generates free cards but the proportion of free cards being generated is very high.

How do I analyze the .apk file? What basic steps should I follow to reverse engineer the .apk and get an idea of the application logic?

Improve this question
7
  • 2
    This is a QA about reverse engineering, I don't see how this fits on this site. I don't even see the question. SO elaborate and try to form a question that has an answer (not an opinion)
    – Stolas
    Aug 28 '13 at 6:42
  • @Stolas there, question is provided with bold style.
    – Tirath
    Aug 28 '13 at 7:24
  • 1
    The biggest problem I see with your question is that it reads like an advertisement. Other than that, see the close banner.
    – asheeshr
    Aug 28 '13 at 7:32
  • 1
    I have made some improvements. If this is not what you intended to ask, then feel free to edit it further. If your primary question was asking how the in-app purchase system works, then that would be off-topic.
    – asheeshr
    Aug 28 '13 at 9:53
  • 1
    @Tirath now this is a valid question. Answer posted :)
    – Stolas
    Aug 29 '13 at 7:02
13

Basic steps to analyse an android APK

Analysing a APK is like any reverse engineering process. If there is no-prior knowledge I do assume you know Java and like to puzzle. Lets have a look at the most basic steps of reversing an APK.

  • The first and most important rule in Reverse Engineering is, you want to know what makes it tick. This requires research, thus first research how APK works.
  • First I would read the basic information about the file format, use Wikipedia ( APK on Wikipedia
  • After having an idea what I want to reverse I'll look for known tooling, either use Google or recommended Woodmann
  • Ok, so Wikipedia said it was a zip file. So first unzip it, then pick-up the file and tooling that you are interested in ( classes.dex )
  • A quick Google resulted produced a stackoverflow question
  • After that you got Java, so woodmann has some Java decompilation tools. Java Decompilation at Woodmann

Good luck, don't give up and remember if it's hard it is worth it. If it is too hard, try harder. :)

Improve this answer
3
  • 2
    The list of decompilers at Woodman is out of date. It's missing all the best ones.
    – Antimony
    Aug 30 '13 at 5:23
  • Feel free to tell mister woodmann, or share the best decompilers here.
    – Stolas
    Aug 30 '13 at 6:15
  • @tirath feel free to upload or create an entry at Mr Woodmann :) or update an outdated entry with latest ones for the repository is collaborative and it needs collaborators like you :P
    – blabb
    Jan 8 '16 at 4:26
3

Steps to Reverse Engineer an APK

  1. Use an APK Extractor tool to filter out the APK file.
  2. Create a new directory and copy the APK file there.
  3. Change the extension of the file from .apk to .zip
  4. Unzip the file.
  5. Download dex2jar from http://sourceforge.net/projects/dex2jar/
  6. Extract the file into the same directory and copy the classes.dex file from the .zip file into the extracted file.
  7. Use terminal or command prompt to navigate the directory and type sh d2j-dex2jar.sh classes.dex
  8. You will have a folder containing the source code
  9. List item
Improve this answer
2

Many people here aren't including the important information... If you decompile to "Java", you will likely lose information in the process and recompiling will not work. However it is much easier to read. Here's a link:

https://www.decompiler.com/

If you want to be able to edit the APK and recompile, use "ApkTool" and edit the SMALI code. You'll need to jar sign the APK and use zipalign before reinstalling the APK to your phone.

You can also use IDA Pro to help analyze the code, however I don't know anything about IDA Pro.

Improve this answer
1

A decompiler and more of a suite as far as i can understand (my friend recommends it at least) is http://www.virtuous-ten-studio.com/index.php/downloads which seems to do dex2jar at least. Hope it's an alternative at the very least.

Improve this answer
1

Okay!!!...so need to follow this much steps for decompilation and no need to download dex2jar and follow this much steps....here's one simple soultion..

https://www.decompiler.com/jar/07e53b681fff4e9cb3e734353adc7307/com.ednamos.bluetoothlive.apk

just go through this link and upload your apk file...it will convert your apk file into whole project..and you can download that project in zip format directly ..... so simple!..Happy coding!!

Improve this answer
3
0

Lot of tools and documentation can be found here https://github.com/ashishb/android-security-awesome

Improve this answer
1
  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – Glorfindel
    Feb 3 '18 at 12:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.