I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this largely constitues learning by myself but I really don't know what to look or where to look. Some examples would be really helpful. Thanks!

Edit:

When I extract everything from APK, I get some SMALI files (I tried JD-GUI but the strings contained random names. Probably obfuscated using Proguard.), some resource files and a ".so" files in the lib directory. How do I analyze the ".so" file. I know that SO files are, kind of DLLs of the Linux world but what are the tools that can be used to analyze SO files. Any links to videos would be very helpful. :)

Also, how would I get around if there were a JAR file instead of SO file in the APK?

  • 1
    This is a bad question as the topic of obfuscation is huge. Try to narrow it down. – Stolas Jun 17 '14 at 8:33
  • 1
    What should I do to narrow it down? – Pervy Sage Jun 17 '14 at 13:27
  • Try to make it a 'googlaleble' question. For example: when I open my PE I am missing an import table? How can this be? or I noticed my APK is packed with dexprotector what would be the best way to approach this? – Stolas Jun 17 '14 at 19:10
  • @Stolas - Please see my edit. Does that narrow it down? – Pervy Sage Jun 18 '14 at 8:28
  • Perfect! I've nominated it for reopening. When it is reopened I'll answer the question for you. – Stolas Jun 18 '14 at 13:30
up vote 65 down vote accepted

The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app in C.

In some cases, there is existing C code and it's just easier for the programmer to build a JNI interface to call the library from java; in other cases, the programmer wants the speed advantage that compiled C has over java. And of course, if i want to hide how some part of my application works, writing that in C and compiling it to a .so makes it much harder to reverse.

If you want to reverse an android .so, these are the options you have:

  • Buy the commercial version of IDA pro. The demo versions will not do, as they can't disassemble ARM code. This is expensive, but by far the best tool to work with unknown object code.
  • If the app includes versions of the .so for different hardware, and if it has a library for android on x86, you can use the free IDA 5.1 version to disassemble it.
  • If you have access to a linux system, get a gcc toolchain for ARM that includes objdump, and use objdump --disassemble to get a huge text file containing disassembled code. Then, have fun with that text file. There might be gcc toolchains for ARM targets that run on windows as well, but i never tried.
  • You could also upload the .so file to http://onlinedisassembler.com/ to get a disassembled file, if you don't want to install a gcc toolchain.

Beware, though, in all of these cases, you need a thorough understanding of the ARM processor architecture, assembler language, JNI conventions, and compiler ABI to make any sense of the disassembly. Prepare for many long nights if you're unexperienced.

  • Android has x86 version so I think the OP can grab the same .so file from x86 image and decompile it – phuclv Jun 19 '14 at 4:14
  • 1
    Unfortunately onlinedisassembler.com has limitation. Maximum upload size is 256KB. – Dr.jacky Jun 22 '15 at 11:04
  • Bokken supports ARM too, right? – dcow Jan 8 '16 at 0:52
  • ~"Then, have fun with that text file." What do you mean? What is the best way to inspect this text file sensibly. – Igor Ganapolsky Nov 1 '16 at 15:32
  • In fact, the demo version of IDA does support ARM (freeware doesn't). – Igor Skochinsky Nov 2 '16 at 9:25

Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ARM binaries).

It works very well for sketching you the rough workings of the shared object.

A plugin for select IDA versions exists, but the main limitation is that it doesn't support 64-bit code.

  • it's not really good. Hexrays decompiler for the win. – Krypton Jan 7 '16 at 7:53
  • 2
    @Krypton Why is it ~"not really good"? – Igor Ganapolsky Nov 1 '16 at 15:37
  • 1
    Hexrays decompiler works with IDA Pro. And IDA is the best reversing tool out there. This combo means much more than just a decompiler. – Krypton Nov 2 '16 at 3:36

You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with network protocols. Check out the Frida instrumentation toolkit for an open source cross-platform solution (Android, iOS, Windows, Mac and Linux). There's a tutorial showing how to build an interactive instrumentation tool in a few minutes, which injects code into the “Yo” app on iOS and plots network connections using Google Maps.

  • Frida would disassemble .so files? – Igor Ganapolsky May 11 '16 at 22:11
  • Can Frida be used to hook into .so libraries? – Sam Oct 31 at 8:06

Use android-ndk, https://developer.android.com/ndk/downloads/index.html.

You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and get a .so library out of it, I will do :

./android-ndk-r15b/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-objdump -T "SAMPLE.so | less

To get an objdump.

You can also try the Snowman tool: https://derevenets.com/.

Snowman is a native code to C/C++ decompiler

It supports ARM, x86, and x86-64 architectures as specified on their website.

  • 1
    Snowman possibly has memory leaks. It took 6+ Gb RAM while decompiling a small .so file – VMaleev Mar 3 at 17:06
  • Agree. it did hang my machine having 8 gb ram. – Parth Jani Jun 15 at 6:52
  • Indeed! It looks that it works better with a small base code. – Adrian Paul Jul 7 at 9:43
  • 2
    Why not give the author a chance and notify him/her of the issues? Software defects are not god-given, so they can be fixed. But users need to report them so this can happen. – 0xC0000022L Aug 10 at 20:24

You can also reverse-engineer APK files directly on an android device.

  1. Java part: Show Java
  2. .so files: My disassembler.

Android-Disassembler

Disassemble .so (NDK, JNI) files on Android. Capstone-based disassembler application on android

Features

  • Shows details of elf files.
  • Disassembles the entire code sections.
  • Has various export options of the disassembly. (Compilable txt file, analytic text files, json, and reloadable database)
  • Highlights branch instructions.
  • Has Instant analysis mode.
  • Supports projects.
  • Supports launching from file browsers.

Usuage

  1. Choose an elf file to analyze.
  2. Go to details tab.
  3. Press Show details button to see details.
  4. Press Save to file button to save it.
  5. Go to disassembly tab.
  6. Press disassemble button.
  7. Choose instant mode or persist mode.
  8. To export the disassembly, press Export button and choose the option.

Analysis mode

  • Instant mode Fast and lightweight, but buggy.
  • Persist mode A bit lags, but OK

Export mode

  • Classic Pretty!
  • Simple Can be directly pasted as code!
  • Json It can be loaded again to analyze again(though reloading is not implemented yet - Sorry:( )
  • Database Loading is slow though..
  • Project raw file Fast and reloadable.

enter image description here

Build

Use Android studio.

Open Source

This app used - Capstone - Storage-Chooser - Colorpickerview - Java-binutils - PECOFF4J.

What's new

  • Changed to Android Studio structure.
  • Supports various disasm export options.
  • Supports open from file browsers.
  • Supports x86 shared libraries.
  • Doesn't require your email accounts when sending error reports
  • Easier bug report
  • Shows symbols(nm -a)

Related link(SO thread)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.