4

My goal is to control my drone with my raspberry pi using python and not the app that is being delivered together with it.

  • First I connected the app to the drone, flew and used aircrack-ng to get the pcap.

  • I looked at it in wireshark and could not make sense of it.

  • I presume it to be unencrypted UDP though.

  • So I decompiled the java apk with APK Studio and looked at the source code.

  • I looked for a random button in an xml to find the corresponding method in a java file.

  • It did not exist.

There are some small files.

Which approach do you suggest for reverse engineering?

Improve this question
2
  • For decompiling the Android app I would use Jadx. Try to identify where the UDP packets are sent and then trace back the calls where the packets are generated. As you have a running set-up you may use Frida on certain methods you have identified via Jadx and hook them to see what parameters they are called with at run-time.
    – Robert
    Commented Apr 15, 2021 at 12:44
  • Feel free to try it with the A20 app: m.apkpure.com/de/potensic/com.udirc.Potensic Using APK Studio, which is a gui for jadx, I wasn't able to extract the methods that referred to the buttons. If you are more successful, I'd appreciate the steps you took, not necessarily the result. PS: Is Frida a stacktracer, ie it points out the command route?
    – Pascal Widmann
    Commented Apr 15, 2021 at 18:02

2 Answers 2

Reset to default
1

If you use an android app, you may use network debuggers such as

https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture

this also supports UDP

This might be easier to use/retrieve your data.

I used this myself to gain independent access to my Iot devices.

Be aware: Some apps have their own client certificates pinned in their apps for authorization purposes. So this method might not work. You'd need to find a way to extract the client certificate and use it to get the traffic data.

Improve this answer
0

If it's a drone, it's probably MAVLink. Check that first. https://mavlink.io/en/guide/serialization.html

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.