Skip to main content

Questions tagged [android]

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

Filter by
Sorted by
Tagged with
93 votes
9 answers
317k views

How do I reverse-engineer .so files found in Android APKs?

I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation. When I extract everything from APK, I get some Smali files (I ...
Pervy Sage's user avatar
  • 1,205
31 votes
6 answers
13k views

Decompiling Android application

The Android java code is compiled into Dalvik byte code, which is quite readable. I wonder, is it possible in theory and in practice to write a decompilation software for Dalvik byte code?
Mellowcandle's user avatar
  • 4,825
25 votes
6 answers
37k views

How do I analyze a .apk file and understand its working?

I am an Android app developer, and recently I encountered a problem with in-app purchase. I discovered that in some apps, in-app purchases can be done for free using this application. I know this app ...
Tirath's user avatar
  • 359
23 votes
1 answer
12k views

Analyzing encrypted Android apps (.asec)?

I've been trying to reverse engineer a paid android app that writes out some binary data so that I can export that data into other programs (it's a run/walk timer app, if anyone's curious, and I'm ...
Brendan Dolan-Gavitt's user avatar
17 votes
7 answers
59k views

What are the tools use for reverse engineering android apk?

Currently, I only know about apktool. But is there any tools that helps in checking the code, editing it and compiling it back to apk?
Daniel Mana's user avatar
16 votes
3 answers
9k views

Dynamic java instrumentation?

This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation. So, in the same fashion as strace which allows you to see syscalls made by a process, or ftrace to see ...
JavaSec's user avatar
  • 163
16 votes
1 answer
27k views

Debugging third party android APKs

What are some ways to debug third party android apps (apps you don't have the source code to)? I would like to step through the APK instruction by instruction, and possibly set breakpoints on certain ...
gsgx's user avatar
  • 400
15 votes
1 answer
11k views

Bypassing certificate pinning in android

I've spent the past 4 months trying to bypass certificate pinning in the Facebook android application so I can understand how it works, but I'm having trouble doing so. I have tried using android ...
John Avery's user avatar
14 votes
8 answers
41k views

Repackaging APK file using baksmali and smali

I am a student interested in Android Security. I was trying to modify a APK file using baksmali and smali. However, I am not able to run the repackaged app in my mobile. When I click on the icon it ...
aMa's user avatar
  • 303
14 votes
1 answer
4k views

Howto clone Android RSA SecurID Software Token

At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
Christopher Dreher's user avatar
11 votes
1 answer
4k views

Generating Snapchat Snaptags ("QR" Codes)

For those that haven't seen, Snapchat now has a special type of image based code that allows you to quickly add friends by pointing the camera at the screen, similar to a QR code, called "Snaptags". ...
Tyrone's user avatar
  • 111
10 votes
2 answers
1k views

Android bytecode verifier

One of the things that makes Java bytecode (.class) so easy to reverse engineer is that the JVM's verifier ensures that bytecode can always be disassembled via linear sweep. Instructions have to be ...
Antimony's user avatar
  • 2,012
10 votes
5 answers
5k views

Lifting up binaries of any arch into an intermediate language for static analysis

Background As the title is self-explanatory, I would like to translate binaries of any architecture (e.g. x86, ARM, ARM Thumb) to an intermediate language in order to apply arch-independent static ...
frogatto's user avatar
  • 205
10 votes
3 answers
18k views

Reverse engineer Android native code

I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
msk's user avatar
  • 109
10 votes
2 answers
3k views

Fixing the checksum of a modified Android ELF

I've hex-edited a string in an Android ELF binary. Now, it won't run, and gives the error message CANNOT LINK EXECUTABLE, presumably due to a bad checksum. Does anybody have a tool to fix the ...
user1636717's user avatar
9 votes
2 answers
7k views

How difficult is to decompile C++ file?

I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp. I am also going to create an iOS app which will use the same AES key. Is ...
Daniel Foo's user avatar
9 votes
3 answers
1k views

Is there a name for this kind of "obfuscation" for the machine code from C++?

I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
Y M's user avatar
  • 118
8 votes
1 answer
2k views

Why two virtual destructors?

The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as: _ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
18446744073709551615's user avatar
7 votes
1 answer
2k views

Inserting resources.properties file into an APK - language compatibility

I'm reverse engineering an android application. It's been a while since I've poked with this but I"m having an issue editing the APK to deal with some language areas. The original app is from a ...
Fewmitz's user avatar
  • 1,022
7 votes
1 answer
2k views

How does API call work on Android (NDK)?

In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely. ...
Hyeonseo Yang's user avatar
7 votes
2 answers
2k views

Trace system calls, including stack (and java stack if possible), on android?

I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption. The app in question consists ...
Guntram Blohm's user avatar
7 votes
2 answers
1k views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
Frenchy Fry's user avatar
6 votes
2 answers
589 views

Disassemble ELF - PC is set to 0?

I tried to disassemble a ELF file which is a shared object file executed on armv7a (Android). I saw a strange block. It seems that the PC, program counter register, is set to 0. Did I miss something ...
IvanaGyro's user avatar
  • 195
6 votes
2 answers
11k views

Offset calculation for branch instruction in ARM

As the title says, how to calculate offsets for branch instructions? For example i have following assembly code, 0x60ECE B loc_60EE6 ; ; ; 0x60EE6 LDR.W R2, #0x123 Hex code for location ...
user2578525's user avatar
6 votes
2 answers
2k views

How do Android reverse engineering tools extract packages/ package hierarchy present in Android apps?

I have been involved in disassembling Android apps using baksmali and dexpler. Whenever I disassemble an app, I find the packages and package hierarchy (that would have been available in development ...
Annamalai N's user avatar
6 votes
3 answers
12k views

Use Android Shared library (.so) files in Linux

I decompiled an APK file,and that program have native codes in a .so file. I want to use that .so file in Linux in order to use inline functions. These codes have functions to connect to a server and ...
IrajTaghlidi's user avatar
6 votes
2 answers
4k views

How to break on an Android JNI function with IDA Pro Debugger

I have an android application that uses a shared library which I would like to step through with a debugger. I've had success using IDA 6.3 to debug executables with the android_server debug server ...
amccormack's user avatar
  • 1,326
6 votes
1 answer
643 views

Dalvik Byte code instrumentation framwork for dynamic data dependency analysis

I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
P basak's user avatar
  • 161
6 votes
2 answers
3k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
csharpnewbie's user avatar
5 votes
1 answer
2k views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface. My ...
SinOfficial's user avatar
5 votes
2 answers
11k views

Mapping Android resource IDs to resource string

I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to ...
user1118764's user avatar
5 votes
1 answer
1k views

Replacing small length instruction with larger length instruction

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code. I am using IDA Pro for analyzing native ...
user2578525's user avatar
5 votes
1 answer
1k views

Can a debug-apk be reverse engineered to make it a release-apk?

I am making a system in which the users can create Android applications. I want them to give an option to download a debug apk so that they can try it out first. After that, they have to pay for it to ...
user avatar
5 votes
2 answers
703 views

ARM - Is calling function from external static library possible?

Basically i'm debugging a closed source binary on Android and i want to execute some of my code in between which is large enough not to fit in codecave. So is it possible to compile library with my ...
user2578525's user avatar
5 votes
2 answers
1k views

What is stored in typeinfo (GNU C++, Android NDK, ARM)

IDA annotates some items as: typeinfo for _classname_. What is that typeinfo, is it the same as type_info? What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
18446744073709551615's user avatar
5 votes
1 answer
860 views

Reverse engineering android native packer

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder ├───app_dexprotector │ 823517D25836B88F1C499C02370A047E.dat │ ...
Amin's user avatar
  • 71
5 votes
1 answer
3k views

Reverse engineering Android vendor system apps

I'm trying to reverse engineer certain Samsung system apps in the Galaxy S6 firmware system image, such as KnoxAttestationAgent.apk. I'm a noob when it comes to reverse engineering, and so far my ...
user1118764's user avatar
5 votes
4 answers
217 views

What information may supply the uninitialized data to security team?

When I was reversing some well known Android chat applications (I can not disclose which specific ones, but all of them where owned by companies with 1 billion+ capital and have hundreds of millions ...
Vitalii's user avatar
  • 395
5 votes
0 answers
8k views

Unpack, modify and rebuild an Android App Bundles (.aab) file

I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file. Basically, I am looking for an apktool for .aab
Simone Aonzo's user avatar
5 votes
0 answers
650 views

Reverse engineering an hydrometer's Bluetooth communication

This is a very specific question. I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
Rui Lima's user avatar
  • 135
4 votes
5 answers
24k views

print [B byte array in frida js script

I'm learning frida and trying to hook a function that looks like: `.method public final fn()[B` It returns a byte array. Here's my code: Java.perform(function () { var test = Java.use("com...");...
aj3423's user avatar
  • 209
4 votes
2 answers
2k views

How to encode file

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the lua file. Its from an android I decompiled the APK and found that all the lua files are encrypted.
Neit's user avatar
  • 41
4 votes
1 answer
2k views

How Do I get proficient at Reverse engineering?

Please bear with me as I explain this situation. Maybe 10 days ago I took up the challenge of reverse engineering an Android app. Learning from scratch, I installed ADB, Apktool, Android Studio, ...
43.52.4D.'s user avatar
  • 195
4 votes
3 answers
19k views

Decompile ARM native binary - IDA Pro detects file as Shared Object

I am trying to decompile a Android ARM native binary using Hex-Rays IDA Pro. IDA detects the possible formats as ELF for ARM (Shared object) Binary file If I choose ELF for ARM (Shared object), ...
Joyce Babu's user avatar
4 votes
1 answer
4k views

Extract a secret from an Android apk or .so file

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
Exadra37's user avatar
  • 141
4 votes
1 answer
121 views

What does a C++ identifier ending in $_## mean?

In trying to understand a .so from an Android game made with Cocos2d-x, I've come across identifiers like the following (after demangling): SceneActionMap::updateTalkMode(float)::$_37 SceneActionMap::...
Squ's user avatar
  • 73
4 votes
1 answer
4k views

Disable ASLR on android 4.0.3

I would like that a shared library is always loaded at the same address on Android 4.0.3. I can't seem to disable the ASLR using: echo 0 > /proc/sys/kernel/randomize_va_space Running cat /proc/...
Hinko Kocevar's user avatar
4 votes
1 answer
5k views

Android application fuzzing

How to do fuzzing in Android applications? Do we have any fuzzer specific to the android? Actually, I am looking for an easy way to do fuzzing while performing penetration testing of android ...
Mukesh's user avatar
  • 121
4 votes
2 answers
1k views

Dalvik dex file version 036

I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem. But ...
Ilia Barahovsky's user avatar
4 votes
2 answers
3k views

Can I find usages of this string in my .so file? ARM

My apologies if this question is very basic. I have found this string in my Android application Binary that was built using the flutter framework. This is a 32 bit ARM library. I found the location of ...
Ebay89's user avatar
  • 141

1
2 3 4 5
9