Questions tagged [android]

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

Filter by
Sorted by
Tagged with
6 votes
2 answers
10k views

Offset calculation for branch instruction in ARM

As the title says, how to calculate offsets for branch instructions? For example i have following assembly code, 0x60ECE B loc_60EE6 ; ; ; 0x60EE6 LDR.W R2, #0x123 Hex code for location ...
87 votes
9 answers
276k views

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
  • 1,145
16 votes
3 answers
9k views

Dynamic java instrumentation?

This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation. So, in the same fashion as strace which allows you to see syscalls made by a process, or ftrace to see ...
  • 163
15 votes
1 answer
11k views

Bypassing certificate pinning in android

I've spent the past 4 months trying to bypass certificate pinning in the Facebook android application so I can understand how it works, but I'm having trouble doing so. I have tried using android ...
5 votes
2 answers
1k views

What is stored in typeinfo (GNU C++, Android NDK, ARM)

IDA annotates some items as: typeinfo for _classname_. What is that typeinfo, is it the same as type_info? What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
5 votes
1 answer
824 views

Replacing small length instruction with larger length instruction

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code. I am using IDA Pro for analyzing native ...
4 votes
4 answers
18k views

print [B byte array in frida js script

I'm learning frida and trying to hook a function that looks like: `.method public final fn()[B` It returns a byte array. Here's my code: Java.perform(function () { var test = Java.use("com...");...
  • 197
2 votes
1 answer
17k views

Decrypting Lua Files

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted. ...
  • 31
0 votes
1 answer
93 views

Malware application in Android

Is there some website that give us the possibility to download malware APK in order to study it? I’m interested to study the abuse of android.permission.RECORD_AUDIO in Android 8.
  • 27
-1 votes
1 answer
123 views

what do these assembly code doing?

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...
  • 189
-3 votes
1 answer
11k views

How to edit .asec file? [closed]

How to edit .asec or compare two .asec files witch are stored by app at location mnt/.android_souce/app name.asec. This file get updated whenever data connection is on / while using app to upload and ...
  • 33
23 votes
6 answers
34k views

How do I analyze a .apk file and understand its working?

I am an Android app developer, and recently I encountered a problem with in-app purchase. I discovered that in some apps, in-app purchases can be done for free using this application. I know this app ...
  • 339
15 votes
7 answers
57k views

What are the tools use for reverse engineering android apk?

Currently, I only know about apktool. But is there any tools that helps in checking the code, editing it and compiling it back to apk?
13 votes
8 answers
39k views

Repackaging APK file using baksmali and smali

I am a student interested in Android Security. I was trying to modify a APK file using baksmali and smali. However, I am not able to run the repackaged app in my mobile. When I click on the icon it ...
  • 293
7 votes
1 answer
2k views

Why two virtual destructors?

The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as: _ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
7 votes
1 answer
1k views

How does API call work on Android (NDK)?

In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely. ...
5 votes
1 answer
3k views

Reverse engineering Android vendor system apps

I'm trying to reverse engineer certain Samsung system apps in the Galaxy S6 firmware system image, such as KnoxAttestationAgent.apk. I'm a noob when it comes to reverse engineering, and so far my ...
5 votes
0 answers
633 views

Reverse engineering an hydrometer's Bluetooth communication

This is a very specific question. I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
  • 135
3 votes
1 answer
2k views

Sniffing serial Bluetooth traffic on Android

Related to UE Megaboom serial protocol: I am trying to get some insights on the serial protocol spoken by the UE Megaboom, which I suspect is how the app controls the advanced features of the speaker. ...
2 votes
1 answer
610 views

Reversing video protocol for chinese drone so i can view the stream outside of the app

I am trying to view the video stream of the vento protocol air drone on my computer. The final goal is to get the video stream into python or c++ for opencv; however, if i can just view it in a ...
2 votes
1 answer
322 views

LLDB debugging on android?

I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
  • 154
2 votes
1 answer
4k views

Set breakpoint on shared library

I am a noob to the reversing world. I have a Android Java application which uses a shared library via JNI and I would like to set a breakpoint in the shared library. The shared library is stripped ...
  • 179
0 votes
1 answer
95 views

How do I gain access to files that an Android app stores in its persistent internal storage directory?

I was playing a game that had hidden achievements and wanted to find the conditions necessary to unlock these achievements. To do this, I've tried to get the source code of the game, to find the ...