I'm reversing engineering an app and after analyzing with man-in-the-middle, I find that it obfuscates its messages to the server so it looks like a gibberish.

String stc = ("msg=" + URLEncoder.encode(m20b.m60c(C22d.f54b), "UTF-8"));

the fuction which obfuscates the messages is m20b.m60c and I need to log the string to the console without it. The problem is that the editable code is in Smali, a very difficult lower level language. Everything I tried so far made the app crash.


invoke-direct {v1}, Ljava/lang/StringBuilder;-><init>()V

    const-string v2, "msg="
    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    sget-object v2, Lc/b/a/a;->b:Ljava/lang/String;

    invoke-static {v2}, Lc/b/a;->c(Ljava/lang/String;)Ljava/lang/String;

    move-result-object v2

    const-string v3, "UTF-8"

    invoke-static {v2, v3}, Ljava/net/URLEncoder;->encode(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;

    move-result-object v2

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    new-instance v2, Ljava/lang/StringBuilder;

    invoke-direct {v2}, Ljava/lang/StringBuilder;-><init>()V

    invoke-virtual {v2, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
  • Assuming m20b.m60c is the method that obfuscated the string, It may be easier to modify m20b.m60c and just print it's argument. If you have a rooted phone https//frida.re may be easier as it allows to you to hook this method with little effort at run-time (the hooking code is written in JavaScript).
    – Robert
    Jan 23 at 15:11
  • If you want to continue using apktool/Smali my recommendation is to use AndroidStudio to create a dummy app that contains a static method like myLog(String) that logs the argument to logcat. Compile the app and decompile it using apktool and you can copy the method into the class you modify. Then you only have to add an invoke-static to call this method using the desired argument you want to log.
    – Robert
    Jan 23 at 15:15


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.