Questions tagged [android]
Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.
122
questions with no upvoted or accepted answers
14
votes
1
answer
4k
views
Howto clone Android RSA SecurID Software Token
At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
5
votes
0
answers
7k
views
Unpack, modify and rebuild an Android App Bundles (.aab) file
I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file.
Basically, I am looking for an apktool for .aab
- 175
5
votes
0
answers
646
views
Reverse engineering an hydrometer's Bluetooth communication
This is a very specific question.
I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
- 135
4
votes
0
answers
218
views
How to trace with Frida some specific functions in ARM ending with BX LR
I'am trying to trace down with Frida v16.0.11 (frida-trace) all calls to exported functions from "libssl.so" (Android, 32bit). But turns out that Frida is unable to hook some functions. One ...
- 41
4
votes
0
answers
55
views
How to edite a compiled Reactive Native file "main.bundle"
I bought I vacuum robot from Dreame and needed to replace the Lidar sensor myself as in my country (Brazil) don't have technical assistance, but now it is not working properly because it says that don'...
- 41
4
votes
1
answer
2k
views
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
- 309
4
votes
0
answers
837
views
Understand a function within Hermes byte code
The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode.
I was able to disassemble the binary file ...
4
votes
0
answers
927
views
Android APK debugging: modify value of smali register
I am debugging an apk app that I do not have the sources for. I want to debug it on a smali level, not decompiled.
I used to do this with apktool, but looking at their website, smali-debugging is ...
- 463
3
votes
0
answers
131
views
What is the best emulator/environment for android debugging?
I know the question smells like I want a ready solution but I have been trying many things and after a lot of headaches, still I can't do what I want.
There are fast emulators but they don't provide ...
- 51
3
votes
0
answers
207
views
How do i set these tricky boolean values to true in Smali-Dalvik?
These would allow me to make the input text field clickable and editable but the thing is how to do this.
Instance field
.field private g:Z
1 -
invoke-virtual {p1, p2, v0}, Landroid/content/res/...
- 31
3
votes
0
answers
49
views
How do I make a text field editable when the app is designed to autofill OTP SMS?
Hello fellow rev engineers,
I'm running an app in an emulator and the problem is that for registration it must autofill the OTP sent by SMS, the text field isn't editable/clickable and I can't advance ...
- 31
3
votes
0
answers
328
views
Flashed "compatible" firmware onto two generic Allwinner A50 tablets
I'm already at least 3 days on this and can't find a way out. I'm still unsure if it fits here, but here we go!
I have 3 A50 Allwinner tablets (HOW HT-705XT) that I wanted to root. Since the only way ...
- 51
3
votes
0
answers
160
views
How do I log a string in smali without its obfuscated function?
I'm reversing engineering an app and after analyzing with man-in-the-middle, I find that it obfuscates its messages to the server so it looks like a gibberish.
String stc = ("msg=" + ...
3
votes
0
answers
418
views
How to decompile an APK written in Golang?
I recently started trying to learn basic reverse engineering and Golang. Decompiling Android apps written in C++ and Java/Kotlin seems easy as there are tons of documents and tools that enable you to ...
- 31
3
votes
0
answers
255
views
Next steps for android native library RE (JNI_OnLoad, root check)
I'm trying to RE an Android app that detects root on a system.
Using frida to backtrace 'access' calls I found out that the root check happens natively:
access(/system/xbin/su, 0x0)
Interceptor ...
- 31
3
votes
0
answers
494
views
Intercept android app DNS lookup with Frida
I have been attempting to intercept when an app performs a DNS lookup using Frida. I assumed that ultimately a DNS lookup will end up in a libc call to gethostbyname or getaddrinfo but this does not ...
- 255
3
votes
1
answer
286
views
Compress Xamarin assemblies after decompression
I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies.
Is there anyway I can compress them again into assemblies.blob file or at least ...
- 31
3
votes
0
answers
1k
views
Frida class constructor hook not called while there do exist instances of the class
I have an (obfuscated) app with a certain class from which I would like to hook the constructor. The class has only 1 constructor defined and so I hooked the class as follows:
var Aclass = Java.use('...
- 61
2
votes
0
answers
64
views
Need help extracting AP_Pack .obb files
I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb.
Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
- 21
2
votes
0
answers
53
views
Difference between __openat and openat (Android)
While reverse engineering an Android process, I wanted to explore the openat function. I noticed that there is a symbol "openat" and another symbol "__openat". What is the ...
- 193
2
votes
0
answers
246
views
How to encode file lua and resource files
I am trying to decrypt luas files it use cocos2dx but its encrypted maybe aes encryption.
With frida i can extract most lua files but not all.
And with ida64 i cant find the key.
- 53
2
votes
0
answers
83
views
Android game reverse http request body
I'm trying to reverse request that are made to an android game to learn more about how it works.
I was able to find endpoints requests that are made with frida and mitmproxy but now I'm stuck because ...
2
votes
0
answers
33
views
How to re-create media file from android sender output stream
I would like to perform dynamic analysis on some android apps to check if these apps sending metadata with media files or not.
Ideas like the picture below:
Step 1: I prepared an image with metadata (...
- 121
2
votes
0
answers
358
views
Cannot load libvulkan.so on Linux chroot running on Android while normal Android apps can load it
Environment
First I will give a quick summary of my environment
Device: Samsung Galaxy M20 (m20lte)
SoC: Exynos 7904 (with Mali-G71 GPU)
OS: Android 10 (Stock ROM with root using Magisk)
Kernel: 4.4....
- 249
2
votes
0
answers
139
views
How can I detect which Android native function that is hooked by Mobile Substrate: MSHookFunction?
I want to detect hook behavior of MSHookFunction on Android. This is Mobile Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/...
- 121
2
votes
0
answers
222
views
ghidra assigns local variable to register
im reversing a android native library and im trying to understand how a token is generated the toke n is passed to a callback java method and i traced where the method is getting called from
this is ...
- 71
2
votes
0
answers
72
views
Reverse engineering of Process manager apk
Is there someone helps me to understand how to build the server of this apk https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/ ? I tried to disassemble the apk but it is ...
- 37
2
votes
0
answers
165
views
SSL Pinning React Native
I'm trying to remove SSL pinning with Android device.
I've tried different techniques like hooking the app with Objection, re-pinning with Frida, using the SSLUnpinning app from the Xposed repo, etc. ...
moskino11
2
votes
0
answers
782
views
frida cant cast string array to java.lang.object
i have a java method i am trying to call manually
public static native Object a(int i, int i2, long j, String str, Object obj);
the last parameter is a string list casted to java.lang.object the way ...
- 71
2
votes
0
answers
14
views
Need help injecting SSID into Momentum app checking for device wifi
Hello so I'm trying to add a device onto my Genymotion emulated device
but to add it the app needs to detect the AP. this is the logcat of just the apps logs
If anyone can help let me know im trying ...
2
votes
0
answers
297
views
Where can I find the encryption algorithm for this POST request in an Android APP?
I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
- 29
2
votes
0
answers
104
views
How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?
I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth.
I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
- 21
2
votes
0
answers
107
views
Cant hook into native lib with script?
im doing some practice stuff about hooking android native lib. I wrote this script:
function processJniOnLoad(libraryName) {
const funcSym = "...
- 67
2
votes
0
answers
443
views
reversing a grpc call
im reversing a android app and i managed to intercept a grpc request and decode it using protoc but i cant seem to make sense of any of the data, i know its compressed using gzip because of the ...
- 71
2
votes
1
answer
357
views
$$Lambda$(number) when decompiled Java bytecode
Why when I decompile a Java bytecode (which further was decompiled from .dex), I get $$Lambda$(number), in Java files, and it's not possible to build project with these java codes as it's insufficient ...
- 21
2
votes
0
answers
2k
views
Hooking an interface method with Frida in an Android application
I'm trying to understand what an android application is sending over the network and as such am trying to hook into it with Frida, specifically a method called storeKeys .
I was able to perform the ...
- 141
2
votes
0
answers
98
views
Trying to replicate encryption of an android app
I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
- 309
2
votes
0
answers
566
views
What is the header 'X-Goog-Spatula'?
I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
- 21
2
votes
0
answers
3k
views
Using Frida for early and late instrumentation
I am trying to hook functions with Frida where one .so file (x.so) is loaded early and another .so file (z.so) is loaded slightly later, after some processing is done by the application.
This is what ...
- 193
2
votes
0
answers
307
views
Google Maps, Android serialisation format
I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example:
I'm saying serialised, as from the ...
- 133
2
votes
0
answers
931
views
Unable to attach java sources to APK being debugged in Android Studio -- Option not displayed
This article (https://developer.android.com/studio/debug/apk-debugger) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it ...
- 35
2
votes
0
answers
400
views
Android APK is somehow verifying package signatures without calling PackageManager.signatures
I'm reverse engineering a very popular Android app.
They perform some type of signature verification on the APK, however they do it without:
Calling PackageManager.signatures
Calling PackageInfo....
- 21
2
votes
0
answers
232
views
Joysmade USB/WiFi microscope
Short intro: I am building an electronics workbench, and I needed a microscope. This Joysmade USB/WiFi microscope was $45, and it would work with exception to the below issues.
My "dumb" TV was set ...
- 21
2
votes
0
answers
1k
views
frida hook jni not work
I want to trace Android Telegram app(open-source) to learn its protocol.
From the source code these two functions AES_set_encrypt_key and AES_ctr128_encrypt are used to do the encryption, and I can ...
- 197
2
votes
0
answers
85
views
How to update reversed code of an updated application?
A few months ago I started to reverse engineer an Android app, and i have pretty much progress in it, but it's updated weekly. How should i go about updating the reversed code?
I searched for ways ...
- 21
2
votes
0
answers
929
views
crash using ida 6.8 debugging on android 5.0
I need to debug .so of my.apk, I'm working on a phone with android 5.0, using ida 6.8's android_server. It seems ok for attaching ida to the process, but when clicking something on the apk there is ...
- 197
2
votes
0
answers
299
views
Why can I not read .so file public functions compiled in C?
I can read the public functions (name and full signature) of some .so files that associated with Android APK, whereas others only show the function name.
For example, running this command only ...
- 21
2
votes
0
answers
2k
views
Remotely debugging Android native ARM library running in Bluestacks
I want to debug a native library loaded by JNI on Android. I have set up the debugging environment to debug native code running on Bluestacks.
I got gdbserver installed on rooted Bluestacks, running ...
- 121
2
votes
0
answers
3k
views
Debug Android Native Code without source
Id like to debug (to log function calls) native ARM Android Code in a shared library. So far I got no source and tried to disassemble it with IDA, but its hard to track all the calls down to a ...
- 121
2
votes
1
answer
2k
views
How to read dnSpy code from assembly_csharp.dll
So I have managed to retrieve the assembly_csharp.dll using the il2cpp tool from an android apk, however my issue is that when I go to read the dll using dnSpy I have all the correct looking function ...
- 21