0

i have two apk files , when i decompile them using apktool i can take a look at decompile code , so here is what really confuse me , in the first apk if i searched the hole files for strings witch begin with "https" or "http" i can get all the api urls for that app , but the second apk doesn't work the same way it give me nothing just some google api urls witch belong to google that i dont need , so my question is , why my searching method work in the first apk but not in the second apk , maybe in the second app the urls string are encrypted ,but why the developer would do something like this seems pointless to me because even if the urls are encrypted i can capture them using Wireshark or others capturing tools (i don't want to use the capturing tools just decompiling tools if you could just help on that it would be great)

0

They might be stored encoded/encrypted and decoded/decrypted in runtime, you can validate this if you can capture any API calls in runtime (Not sure if you tried this, but maybe give it a try, in that case you may deal with SSL Certificate Pinning). Another possibility is that they might be split, I faced that case couple of times where only the base address of the APIs were stored at the resources string XML files, while the rest of the URIs are declared when used only. You may validate this by looking for some common substrings found in APIs like "/api", "/v", "/send", "/user", etc...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.