I'm reversing engineering an app and after analyzing with man-in-the-middle, I find that it obfuscates its messages to the server so it looks like a gibberish.
String stc = ("msg=" + URLEncoder.encode(m20b.m60c(C22d.f54b), "UTF-8"));
the fuction which obfuscates the messages is m20b.m60c and I need to log the string to the console without it. The problem is that the editable code is in Smali, a very difficult lower level language. Everything I tried so far made the app crash.
...
invoke-direct {v1}, Ljava/lang/StringBuilder;-><init>()V
const-string v2, "msg="
invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
sget-object v2, Lc/b/a/a;->b:Ljava/lang/String;
invoke-static {v2}, Lc/b/a;->c(Ljava/lang/String;)Ljava/lang/String;
move-result-object v2
const-string v3, "UTF-8"
invoke-static {v2, v3}, Ljava/net/URLEncoder;->encode(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;
move-result-object v2
invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v1
new-instance v2, Ljava/lang/StringBuilder;
invoke-direct {v2}, Ljava/lang/StringBuilder;-><init>()V
invoke-virtual {v2, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
m20b.m60c
is the method that obfuscated the string, It may be easier to modifym20b.m60c
and just print it's argument. If you have a rooted phone https//frida.re may be easier as it allows to you to hook this method with little effort at run-time (the hooking code is written in JavaScript).myLog(String)
that logs the argument to logcat. Compile the app and decompile it using apktool and you can copy the method into the class you modify. Then you only have to add aninvoke-static
to call this method using the desired argument you want to log.