Questions tagged [android]

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

Filter by
Sorted by
Tagged with
1
vote
1answer
52 views

hooking libhoudini on x86 emulator

I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved! I'm using a x86 emulator to run arm ...
0
votes
0answers
23 views

Decode lua scripts for cocos2d based game / frida, android

I'm trying to decrypt LUA scripts from cocos2dx game (for wiki). In most cases, it's XXTEA based, but not in this case. The game itself: https://apkpure.com/might-magic-era-of-chaos/com.ubisoft.might....
6
votes
2answers
1k views

Trace system calls, including stack (and java stack if possible), on android?

I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption. The app in question consists ...
-1
votes
0answers
20 views

LM language model parsing

Does any of you know how to read/parse the .lm file containing the dictionary of the Swiftkey app in Android?
0
votes
1answer
133 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
5
votes
1answer
2k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
0
votes
0answers
47 views

capture traffic of an android app

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
0
votes
1answer
48 views

Can't CVE-2019-2215 on Android: “Unable to handle kernel paging request at virtual address”

I'm playing with Android and I'm trying to gain r/w access to the whole memory using CVE-2019-2215. Long story short, you UAF a binder_thread object and you can read from/write to kernel space. The ...
1
vote
1answer
70 views

DEX file referenced type is not defined in file

I am analyzing a dex file and to ease with reverse engineering, I converted it a jar so it could be decompiled. In the file android/support/v17/leanback/media/MediaControllerGlue.class, the following ...
0
votes
1answer
358 views

IDA taking forever to run autoanalysis on remote Android app?

I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp....
2
votes
1answer
3k views

Decompiling 64bit ARMv8 Android .so library

I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
5
votes
3answers
6k views

Use Android Shared library (.so) files in Linux

I decompiled an APK file,and that program have native codes in a .so file. I want to use that .so file in Linux in order to use inline functions. These codes have functions to connect to a server and ...
4
votes
1answer
814 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
1
vote
1answer
81 views

Proper way of implementing DexGuard RASP device checks

I recently came across an app that is protected with DexGuard. DexGuard claims to offer Runtime Application Self Protection (RASP), which comprises of app obfuscation and various runtime tampering ...
0
votes
0answers
30 views

How to get pointer's address?

I've tried to reverse engineering Clash Royale. First strange thing is that I can't find libg.so in maps. cat /proc/<pid>/maps | grep libg.so As I understand split_config.arm64_v8a.apk contains ...
0
votes
1answer
47 views

Call of a suspicious method cannot be found

i have a strange apk which I took a closer look at, among others with jadx-gui. It is a gaming app that requires an unusual amount of permissions according to the manifest file. I installed and played ...
1
vote
0answers
39 views

Frida not able to trace sub_XXXXX which must have been called

I have the following pseudocode generated by IDA Pro decompiler: __int64 *__usercall sub_155B5@<X0>(__int64 *a1@<X0>, unsigned int a2@<W1>, char **a3@<X8>) { ... result = ...
0
votes
0answers
21 views

change apk versionName not working

I am reverse engineering an apk. after decompiling apk file when i try to change versionName from AndroidManifest.xml 3.4 to 5.7, it working well, but when i try to change 3.4 to 5.7.1 or 3.4.1.2 apk ...
1
vote
2answers
70 views

Load Library Android

I Work as cybersecurity consultant and now i'am in mission to reverse engineering of mobile app. I always reverse it using Jadx and dex2jar ... the problem that after reverse them i found some native ...
2
votes
1answer
80 views

Getting android app from device for reversing - what if there are multiple apks?

For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the ...
1
vote
0answers
63 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
-3
votes
1answer
113 views

How to reverse engineer apks? [closed]

is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
0
votes
1answer
42 views

how to replace the result from a json request into a variable [closed]

I would like to return in v0 the following answer "FR" instead of the country retrieved from Json .method public getCountryCode()Ljava/lang/String; .registers 2 .line 11 iget-object v0, p0, ...
1
vote
1answer
123 views

How to figure out which button I'm pressing

I'm working on an app, that I'm trying to get to work on a android device that has additional buttons. The device is called a BH95, from BATL. It has 4 side buttons(1 volume up, 1 power button, 2 ...
3
votes
1answer
342 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
2
votes
1answer
59 views

how to decompile or unite multipart dex class in an android apk file?

Some Android Apks contain multiple classes.dex files which are numbered like this: classes1.dex, classes2.dex ... and when i try to decompile them it would result into multiple source codes. Is there ...
1
vote
1answer
59 views

Calling a method of a Java object passed as argument to hooked function in Frida

I am trying to obtain the SecretKey passed to the decryptAesCipherText function. I hooked the function in Frida to try to print out the arguments when the method is called but since SecretKey is an ...
1
vote
1answer
46 views

IDA Pro: How to change segment register value

For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
12
votes
7answers
44k views

What are the tools use for reverse engineering android apk?

Currently, I only know about apktool. But is there any tools that helps in checking the code, editing it and compiling it back to apk?
-1
votes
1answer
81 views

App from playstore runs but the same apk crashes on sideload install

On my nougat device, I have downloaded an app from the playstore, which is running great. I then extract the apk from the installed app, and uninstall it and again successfully, with package installer....
3
votes
3answers
8k views

print [B byte array in frida js script

I'm learning frida and trying to hook a function that looks like: `.method public final fn()[B` It returns a byte array. Here's my code: Java.perform(function () { var test = Java.use("com...");...
0
votes
1answer
269 views

LOG Urls that APK requests using smali

I have an APK that uses pinning. I am having an unbelievable time trying to remove the SSL pinning so i figure it might be easier to modify the smali files and recompile to log the LoadURL events. ...
-1
votes
2answers
652 views

Proxy debugging tool doesn't capture traffic from some online games

I'm analyzing Android games with Fiddler 2 to see how the game collects data. There is a problem, both Fiddler 2 and Charles Proxy doesn't capture any traffic from some online games. All i got are ads ...
3
votes
1answer
74 views

Modifying (adding new logic) decompiled apk to log different kind of data causing problems (crash/bluetooth connection)

I have separately decompiled apk to smali/dalvik and to java classes. As apk is not obfuscated java code is pretty good to read and I can pretty easily see corresponding smali code. So far I was able ...
0
votes
1answer
78 views

Android packageInfo signature

Are there anyways I can learn what packageInfo.signatures[0] is so I can use it to apply the same algorithm in Python. To further explain: private static SecretKeySpec a(Context context) { ...
1
vote
1answer
32 views

methods that have zero usage in jadx?

so i've been reversing this ai assistant app to figure out what kind of forensic data it leaves on local file system. during static analysis with jadx-gui i found some interesting methods that take ...
0
votes
1answer
71 views

Read bytearray from retval on onLeave event

I'm trying to get the return value of a android native function call using Frida but with no success: Interceptor.attach(Module.getExportByName('lib.so', 'Token'), { onEnter: function(args) { ...
-2
votes
1answer
141 views

Change androidmanifest.xml file within apk

I am able to unpack an android apk file with apktool, but when I am repacking the apk file using apktool, it just crashes with errors, and ibotpeaches seems not patching those errors for years. Now ...
1
vote
1answer
30 views

Android dynamic UI state inspection/profiling tool

I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector. Is ...
1
vote
1answer
60 views

Charles TLS Proxy for Android device with root access

I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am ...
2
votes
1answer
105 views

Invalid file path error while trying to rebuild with apktool and aapt2

I am facing an error while try to repack an apk with apkool. below is the error trace. W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'. W: error: invalid file ...
1
vote
0answers
54 views

Trying to replicate encryption of an android app

I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
11
votes
1answer
4k views

Generating Snapchat Snaptags (“QR” Codes)

For those that haven't seen, Snapchat now has a special type of image based code that allows you to quickly add friends by pointing the camera at the screen, similar to a QR code, called "Snaptags". ...
3
votes
2answers
3k views

android unity intercept w/ Frida

I'm trying to extract symbols from an Android Unity game to detect something related to the game which I can intercept and replace variables. The following code will enumerate symbols from libmain.so,...
2
votes
1answer
7k views

Decrypting Lua Files

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted. ...
18
votes
6answers
27k views

How do I analyze a .apk file and understand its working?

I am an Android app developer, and recently I encountered a problem with in-app purchase. I discovered that in some apps, in-app purchases can be done for free using this application. I know this app ...
0
votes
2answers
4k views

How to dump Android shared library from memory?

I have encrypted Android so library that decrypts itself on load. I want to get its unencrypted code. For me it looks good idea to dump that library from memory when application started. I used /proc/...
0
votes
0answers
16 views

compile gdb with python 3 for gef-ida-interact

I'm trying to use GEF's IDA-interact which has issues with python2. I'm using android-ndk-r20b/prebuilt/linux-x86_64/bin/gdb - v7.11 using Python engine 2.7 How do I compile gdb with python 3.x ? I ...
1
vote
0answers
152 views

Endoscope Camera YPC99 - how to stream on linux

I'm trying to stream video from endoscope camera YPC99 on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports RTSP protocol on port 7070 (...
3
votes
1answer
160 views

How can I retrieve the encryption key in this code?

can anyone explain the following code? is it possible to retrieve the encryption key? I think the code was heavily obfuscated in addition to obfuscation, I can recognize it is using algorithms like ...

1
2 3 4 5 6