92

I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation.

When I extract everything from APK, I get some Smali files (I tried JD-GUI, but the strings contained random names. Probably obfuscated using ProGuard.), some resource files, and a ".so" files in the /lib directory.

  • How do I analyze the ".so" file? I know that SO files are kind of DLLs of the Linux world, but what are the tools that can be used to analyze SO files? Any links to videos would be very helpful.
  • Also, how would I get around if there were a JAR file instead of an SO file in the APK?

I know this largely constitutes learning by myself, but I really don't know what to look or where to look. Some examples would be really helpful. Thanks!

Improve this question
0

9 Answers 9

Reset to default
105

The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfuscation, it just means someone wrote parts of the app in C.

In some cases, there is existing C code and it's just easier for the programmer to build a JNI interface to call the library from Java; in other cases, the programmer wants the speed advantage that compiled C has over Java. And of course, if I want to hide how some part of my application works, writing that in C and compiling it to a .so makes it much harder to reverse.

If you want to reverse an Android .so, these are the options you have:

  • Buy the commercial version of IDA Pro. The demo versions will not do, as they can't disassemble ARM code. This is expensive, but by far the best tool to work with unknown object code.
  • If the app includes versions of the .so for different hardware, and if it has a library for Android on x86, you can use the free IDA 5.1 version to disassemble it.
  • If you have access to a Linux system, get a gcc toolchain for ARM that includes objdump, and use objdump --disassemble to get a huge text file containing disassembled code. Then, have fun with that text file. There might be gcc toolchains for ARM targets that run on Windows as well, but I never tried.
  • You could also upload the .so file to http://onlinedisassembler.com/ to get a disassembled file, if you don't want to install a gcc toolchain.

Beware, though, in all of these cases, you need a thorough understanding of the ARM processor architecture, assembler language, JNI conventions, and compiler ABI to make any sense of the disassembly. Prepare for many long nights if you're inexperienced.

Improve this answer
7
  • Android has x86 version so I think the OP can grab the same .so file from x86 image and decompile it
    – phuclv
    Jun 19, 2014 at 4:14
  • 4
    Unfortunately onlinedisassembler.com has limitation. Maximum upload size is 256KB.
    – Dr.jacky
    Jun 22, 2015 at 11:04
  • Bokken supports ARM too, right?
    – dcow
    Jan 8, 2016 at 0:52
  • ~"Then, have fun with that text file." What do you mean? What is the best way to inspect this text file sensibly.
    – IgorGanapolsky
    Nov 1, 2016 at 15:32
  • 3
    In fact, the demo version of IDA does support ARM (freeware doesn't).
    – Igor Skochinsky ♦
    Nov 2, 2016 at 9:25
26

Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ARM binaries).

It works very well for sketching you the rough workings of the shared object.

A plugin for select IDA versions exists, but the main limitation is that it doesn't support 64-bit code.

Improve this answer
3
  • it's not really good. Hexrays decompiler for the win.
    – Krypton
    Jan 7, 2016 at 7:53
  • 2
    @Krypton Why is it ~"not really good"?
    – IgorGanapolsky
    Nov 1, 2016 at 15:37
  • 1
    Hexrays decompiler works with IDA Pro. And IDA is the best reversing tool out there. This combo means much more than just a decompiler.
    – Krypton
    Nov 2, 2016 at 3:36
14

You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with network protocols. Check out the Frida instrumentation toolkit for an open source cross-platform solution (Android, iOS, Windows, Mac and Linux). There's a tutorial showing how to build an interactive instrumentation tool in a few minutes, which injects code into the “Yo” app on iOS and plots network connections using Google Maps.

Improve this answer
2
  • Frida would disassemble .so files?
    – IgorGanapolsky
    May 11, 2016 at 22:11
  • Frida intercepts calls to native libraries so you can have a look at what goes in and what comes out.
    – Sam
    Jan 1, 2019 at 23:42
12

Use android-ndk, https://developer.android.com/ndk/downloads/index.html.

You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and get a .so library out of it, I will do :

./android-ndk-r15b/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-objdump -T "SAMPLE.so | less

To get an objdump.

Improve this answer
6

You can also reverse-engineer APK files directly on an android device.

  1. Java part: Show Java
  2. .so files: Android disassembler.

(Disclaimer: I 'm the developer)

Version 1.4.2 release.

Android-Disassembler

Disassemble ANY files including android shared libraries (aka .so files) (NDK, JNI), windows PE files(EXE, DLLs, SYSs, etc..), linux executables, object files, ANY files you want like pictures, audios, etc(for fun) entirely on Android. Capstone-based disassembler application on android.

Features

  • Shows details of elf files.
  • Shows symbol table(functions or objects' ,... names) of elf files.
  • Disassembles the code sections.
  • Has various export options of the disassembly. (Reloadable raw file, compilable txt file, analytic text files, json, and reloadable database)
  • Supports projects.
  • Supports directly launching from file browsers.
  • Supports many ABIs(arm,x86,x64,MIPS,PowerPC,...)
  • Jump to address by symbols' names, or a hex address.
  • Syntax colorizing.
  • Support PE and other bin formats.
  • Sort symbols if needed.
  • No need to press Disassemble button!
  • Colorize PUSH/POP instructions.
  • Colorize ARM arch instructions better.
  • Added Follow Jump menu for jump instructions.(With BackStack)
  • Can override auto parse setup

What's new

  • You can copy an instruction to the clipboard.
  • It now parses IAT, EAT of PE headers.
  • Fixed bugs.

Materials about assemblies

Open Source

This app used - Capstone - Storage-Chooser - Colorpickerview - Java-binutils - PECOFF4J.

Thanks

https://reverseengineering.stackexchange.com/a/20124/23870

XRefs

https://reverseengineering.stackexchange.com/a/18203/23870

Related link(RE thread)

Improve this answer
2
  • 3
    Why would I want to do this on an Android device?
    – Sam
    Jan 1, 2019 at 23:50
  • @Sam hmm, why not? You can even develop apps on android! (I do) :) (One possible advantage, it doesn't require copying files to PC)
    – KYHSGeekCode
    Jan 2, 2019 at 1:50
4

You can also try the Snowman tool: https://derevenets.com/.

NB: the original author appears to have "pulled" it. Several forks exist, e.g. this one not connected to original) or these.

Snowman is a native code to C/C++ decompiler

It supports ARM, x86, and x86-64 architectures as specified on their website.

Improve this answer
2
  • 6
    Why not give the author a chance and notify him/her of the issues? Software defects are not god-given, so they can be fixed. But users need to report them so this can happen.
    – 0xC0000022L ♦
    Aug 10, 2018 at 20:24
  • I think this commit (probably a PR) prompted the author to scrap his repo?! Last good commit is 6fed71ccb650ebd1db1141676e1af8166835819e.
    – 0xC0000022L ♦
    Oct 10 at 12:00
2

You can try Ghidra.

Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.

Improve this answer
2
  • How to open .so file in Ghidra?
    – IgorGanapolsky
    May 10, 2022 at 18:06
  • drag and drop ..
    – sjas
    Feb 16 at 22:08
1

There is already an answer by the creator of frida, but I just wanted to add that, specifically, we can use the convenience tool frida-trace with a .so file, e.g.

frida-trace -Ui 'nameOfYourLib.so!*' -p <PID>

to dynamically see what's getting called (entry and exit moments) in that .so file during runtime as you run the app normally (it will filter out to trace only functions within nameOfYourLib.so). This could, for example, be used in conjunction with a static disassembler to find interesting functions to explore deeper.

Improve this answer
0

According to this blog post, GikDbg seems like an Ollydbg mod to debug native Android libraries.

Unfortunatly, the website of GikDbg doesn't exist anymore.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.