APK Reversing. Some code is hidden?

Question

Sorry for my English. I accepted a challenge (part of the partial exams of the year) from my university professor of IT Security and Privacy. He gave me an APK and I need to find out how the login is handled, therefore how the data is sent to an endpoint I don't know.

I currently have the APK installed on the Genymotion emulator. I extracted the installed APK with APK Extractor. At this point I converted the dex files to jar with dex2jar and opened the two jar classes in jd-gui.

The strange thing is that I can't find any reference to login or passwords. The only thing I find is:

public final class PasswordAuthentication {
    private String userName;
    private char[] password;

    public PasswordAuthentication(String userName, char[] password) {
        this.userName = userName;
        this.password = (char[])password.clone();
    }

    public String getUserName() {
        return this.userName;
    }

    public char[] getPassword() {
        return this.password;
    }
}

I wonder if somehow this information could be hidden or if I'm doing something wrong. Also jd-gui is a very poor string search editor.

How should I proceed, in your opinion?

Answer 1

There are two possibilities:

Decompiler can fail

The used decompiler is wrong or fails to decode certain classes. Community driven decompilers like dex2jar aren't perfect decompilers, they often fail or create incorrect output. Therefore in case of problems it is always a good idea to use more than one decompiler and compare the results.

For example I would use Jadx-Gui as a second decompiler. It also decompiles whole APK files to Java code and has an integrated full-text search engine for code and XML resources.

And as a third decompiler I would recommend Apktool. It does decompile to Smali instead of Java code so the generated code is more like assembler, however if you are just searching for where a certain class is referenced apktool + grep or a similar search tool can be very helpful. Note that class names in Smali are not written as com.example.packagename.Classname but as Lcom/example/packagename/Classname;. My recommendation is to search for both variants, the first may capture usages via dynamic class loading, the second via static class references.

Apps developed using other languages than Java/Kotlin

Another possibility is that the decompiled APK file is not a pure Java/Kotlin (thus DEX) code APK file. Nowadays there are quite a few alternative languages and compiler systems which can build APK files. Those generated APK files will still contain some DEX code files, but other parts are implemented in different languages common decompiler like dex2jar and Jadx-Gui can not decompile. From within this alternative code resources it is possible to instantiate classes present in the DEX files.

• Native .so files containing armv7/armv8a/x86/x86_64 code (-> use e.g. Ghidra or IDA Pro,.. to decompile).
• React-Native allows to develop Android Applications using JavaScript that is in the end packed into some special byte code and interpreted using a JS-Runtime
• Xamarin allows to develop Android apps using .Net/Mono code (C#, F#..). Usually you will see some .dll files inside the APK or a file named assemblies.blob.
• Flutter ...
• ...