Questions tagged [android]
Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.
23
questions
6
votes
2
answers
11k
views
Offset calculation for branch instruction in ARM
As the title says, how to calculate offsets for branch instructions?
For example i have following assembly code,
0x60ECE B loc_60EE6
;
;
;
0x60EE6 LDR.W R2, #0x123
Hex code for location ...
- 165
92
votes
9
answers
304k
views
How do I reverse-engineer .so files found in Android APKs?
I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation.
When I extract everything from APK, I get some Smali files (I ...
- 1,195
16
votes
3
answers
9k
views
Dynamic java instrumentation?
This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation.
So, in the same fashion as strace which allows you to see syscalls made by a process, or ftrace to see ...
- 163
15
votes
1
answer
11k
views
Bypassing certificate pinning in android
I've spent the past 4 months trying to bypass certificate pinning in the Facebook android application so I can understand how it works, but I'm having trouble doing so.
I have tried using android ...
- 151
5
votes
2
answers
1k
views
What is stored in typeinfo (GNU C++, Android NDK, ARM)
IDA annotates some items as: typeinfo for _classname_.
What is that typeinfo, is it the same as type_info?
What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
5
votes
1
answer
935
views
Replacing small length instruction with larger length instruction
Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code.
I am using IDA Pro for analyzing native ...
- 165
4
votes
5
answers
22k
views
print [B byte array in frida js script
I'm learning frida and trying to hook a function that looks like:
`.method public final fn()[B`
It returns a byte array. Here's my code:
Java.perform(function () {
var test = Java.use("com...");...
- 197
2
votes
1
answer
19k
views
Decrypting Lua Files
I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.
...
- 31
0
votes
1
answer
118
views
Malware application in Android
Is there some website that give us the possibility to download malware APK in order to study it? I’m interested to study the abuse of android.permission.RECORD_AUDIO in Android 8.
- 37
-1
votes
1
answer
159
views
what do these assembly code doing?
I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this
public static String v = sUQWWyTBEs().toString().substring(32,...
- 309
-2
votes
1
answer
11k
views
How to edit .asec file? [closed]
How to edit .asec or compare two .asec files witch are stored by app at location mnt/.android_souce/app name.asec.
This file get updated whenever data connection is on / while using app to upload and ...
- 43
24
votes
6
answers
36k
views
How do I analyze a .apk file and understand its working?
I am an Android app developer, and recently I encountered a problem with in-app purchase. I discovered that in some apps, in-app purchases can be done for free using this application.
I know this app ...
- 349
16
votes
7
answers
59k
views
What are the tools use for reverse engineering android apk?
Currently, I only know about apktool.
But is there any tools that helps in checking the code, editing it and compiling it back to apk?
- 269
14
votes
8
answers
41k
views
Repackaging APK file using baksmali and smali
I am a student interested in Android Security. I was trying to modify a APK file using baksmali and smali. However, I am not able to run the repackaged app in my mobile. When I click on the icon it ...
- 303
7
votes
1
answer
2k
views
Why two virtual destructors?
The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as:
_ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
7
votes
1
answer
2k
views
How does API call work on Android (NDK)?
In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely.
...
- 341
5
votes
1
answer
3k
views
Reverse engineering Android vendor system apps
I'm trying to reverse engineer certain Samsung system apps in the Galaxy S6 firmware system image, such as KnoxAttestationAgent.apk. I'm a noob when it comes to reverse engineering, and so far my ...
- 359
5
votes
0
answers
646
views
Reverse engineering an hydrometer's Bluetooth communication
This is a very specific question.
I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
- 135
3
votes
1
answer
2k
views
Sniffing serial Bluetooth traffic on Android
Related to UE Megaboom serial protocol: I am trying to get some insights on the serial protocol spoken by the UE Megaboom, which I suspect is how the app controls the advanced features of the speaker.
...
- 171
3
votes
0
answers
49
views
How do I make a text field editable when the app is designed to autofill OTP SMS?
Hello fellow rev engineers,
I'm running an app in an emulator and the problem is that for registration it must autofill the OTP sent by SMS, the text field isn't editable/clickable and I can't advance ...
- 31
2
votes
1
answer
4k
views
Set breakpoint on shared library
I am a noob to the reversing world. I have a Android Java application which uses a shared library via JNI and I would like to set a breakpoint in the shared library. The shared library is stripped ...
- 179
2
votes
1
answer
736
views
Reversing video protocol for chinese drone so i can view the stream outside of the app
I am trying to view the video stream of the vento protocol air drone on my computer. The final goal is to get the video stream into python or c++ for opencv; however, if i can just view it in a ...
2
votes
1
answer
1k
views
LLDB debugging on android?
I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
- 164