1

I have an apk for an app that contacts a web API that no longer exists. I do not have the source code. The app will not work normally without getting a response from the API.

Something like this:
request: GET api.server.com/status
response: {"status":"ok","session":"xxxx"}

I am able to recreate this request by bypassing certificate pinning with frida and using an proxy to send the correct response and the app works fine, however what I would like to do is modify the apk such that this API response is hard coded and the app will work normally without needing to intercept the request.

I have experience decompiling and modifying apks with apktool; also the app appears to be written in react native. I am able to decompile/recompile the react native hermes bytecode using hbctool and hermes-dec but am having trouble finding where the request is made and the response is parsed.
What should I be searching for in the decompiled code to find out where the request is being made and the response is being checked?
Is there a simpler way to accomplish modifying the apk? Is there some already made tool that can patch web requests in an apk?
Or is there some way to create a Magisk/xposed module that can hook http(s) requests from an app and send a pre-defined response?

Or if anyone has any suggestions of what information to search for to go about solving this problem that would also be helpful.

2
  • 1
    So you don't find the server name or the URL in the byte code? Modifying the url and redirecting it to any other existing server would be the easiest way (assuming the Hermes byte code can also be recompiled to replace the byte code bundle in the app).
    – Robert
    Aug 3, 2023 at 12:36
  • I have found the complete URL for the API request. But the app needs a very specific response in order for it to work correctly. I suppose I could create my own server somewhere to send this response but I really wanted to modify the app so that it could work completely offline. I wonder how difficult it would be to add a web server to the app that would send the response to itself...pretty ridiculous but it would work...
    – garbb
    Aug 4, 2023 at 3:33

1 Answer 1

1

If the request would use the standard Java classes, then modifying would be easy, but react-native makes everything complicated. Xposed only works for Java calls, so most likely this one can not be used.

My guess is that all network related functions are implemented in the Hermes engine which executes the byte code. If you want to modify the network request without having to understand the Hermes byte code you would have to find and hook the function that handles the network requests.

You can check the source code of Hermes Engine and hope that you are able to identify a release that matches the version included in your app. Decompile the libraries using Ghidra, IDA Pro or a similar decompiler.

Once you have identified the function you could try to hook it with Frida and fake a response or an error that let the app continue.

Once you have the working frida script you could modify the app by including the frida-gadget that it is started together with app. Usually this is done by adding a System.loadLibrary(...) call. Frida Gadget itself then loads a configuration file where you can specify the script file to be loaded at start-up. The config file and script file both are also included into the APK.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.