1

I am analysing Android ad libraries. I have downloaded apps from Google play and used dex2jar and JDGUI to recover the Java code of the app. As expected a lot of apps use ad libraries (such ad Google Ads, Inmobi, Millenalmedia etc.). As one would expect, ad libraries come in different versions (for eg. the latest version of inmobi is 4.3). Some apps that I downloaded use Inmobi 4.3 but a larger no. of apps use older versions of Inmobi (staring from version 3.6).

Hence, I wish to find the version of the ad library contained in apps. One novice approach is to search for the string "version" inside the app. Is there any better way of doing it? Will the ad libraries typically mention/register their version with Android framework through some code snippet? If so, I could search for that.

Please suggest some professional/appropriate way of doing it.

Improve this question
2

There is no perfect answer for this, it will greatly depend on your tolerance to false positives. Though there are three answers that come to mind depending on you level of effort you're willing to put in. The options are listed from easiest/least work to hardest/most work - if each one is done correctly - the risk of FP also should go down as well.

  1. The novice approach you mention, looking for versioning strings, is not a bad way. Though you are relying on the developer of the SDK to properly increment this value and trusting that they are correct. It is possible that this value changes or does not change when the Ad SDK itself changes. I've personally seen some that only change these types of values when API styling has changed.
  2. A "simplistic" approach you could take is to model the ad SDK's you want to profile. Grab the SDK, run it through dx to get the Davlik code and then baksmali this. When performing a comparison against an application with this ad network code, you could in theory - compare it to each iteration of the SDK that you have collected. Assuming the SDK was not changed in any ways (ProGuard/DexGuard/etc may have changed something) - this could show you which iteration of the SDK it is most like. This would be a bit more trustable than simply looking for strings, though it would be more work to catalog the SDK's and building a script to do the comparisons automatically.
  3. Using an off-the-shelf difference finder, such as AndroDiff. This might be a bit heavy for what you are attempting to do, though all the code is there to both create signatures and find the differences between Android APKs. While this was mainly developer for malware/rip-off applications, you could modify it to compare the Ad SDK's you have previously extracted and run new applications against these.

Depending on what the exact output you want is, you might choose a different answer. Though the first step would definitely to be start cataloging the SDKs you want and find the actual different between them.

Improve this answer
0

Have you tried JEB's library signatures?

https://www.pnfsoftware.com/blog/jeb-1-3-how-to-sign-and-match-third-party-library-code/

This was implemented in the earliest versions of that decompiler platform and I think will only get better over time

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.