Questions tagged [android]

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

Filter by
Sorted by
Tagged with
0
votes
0answers
4 views

Is it possible to work around SQLcipher by modifying libsqlcipher.so?

I was trying to extract data from an Android app which uses SQLcipher. SQLcipher is an extension of SQLite that encrypts database files with 256-bit AES. Within the APK, the library lies in lib/...
0
votes
0answers
15 views

Any ways to combine Android APK with Expansion pack file?

I want to have only one APK that contains all files and resources without having to download expansion pack every time. Is there any way to combine Android APK with Expansion pack file? My expansion ...
0
votes
0answers
31 views

Decode lua scripts for cocos2d based game / frida, android

I'm trying to decrypt LUA scripts from cocos2dx game (for wiki). In most cases, it's XXTEA based, but not in this case. The game itself: https://apkpure.com/might-magic-era-of-chaos/com.ubisoft.might....
-1
votes
0answers
21 views

LM language model parsing

Does any of you know how to read/parse the .lm file containing the dictionary of the Swiftkey app in Android?
0
votes
0answers
48 views

capture traffic of an android app

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
0
votes
1answer
52 views

Can't CVE-2019-2215 on Android: “Unable to handle kernel paging request at virtual address”

I'm playing with Android and I'm trying to gain r/w access to the whole memory using CVE-2019-2215. Long story short, you UAF a binder_thread object and you can read from/write to kernel space. The ...
0
votes
0answers
31 views

How to get pointer's address?

I've tried to reverse engineering Clash Royale. First strange thing is that I can't find libg.so in maps. cat /proc/<pid>/maps | grep libg.so As I understand split_config.arm64_v8a.apk contains ...
1
vote
0answers
40 views

Frida not able to trace sub_XXXXX which must have been called

I have the following pseudocode generated by IDA Pro decompiler: __int64 *__usercall sub_155B5@<X0>(__int64 *a1@<X0>, unsigned int a2@<W1>, char **a3@<X8>) { ... result = ...
0
votes
0answers
21 views

change apk versionName not working

I am reverse engineering an apk. after decompiling apk file when i try to change versionName from AndroidManifest.xml 3.4 to 5.7, it working well, but when i try to change 3.4 to 5.7.1 or 3.4.1.2 apk ...
1
vote
1answer
56 views

hooking libhoudini on x86 emulator

I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved! I'm using a x86 emulator to run arm ...
1
vote
0answers
68 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
2
votes
1answer
80 views

Getting android app from device for reversing - what if there are multiple apks?

For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the ...
0
votes
1answer
47 views

Call of a suspicious method cannot be found

i have a strange apk which I took a closer look at, among others with jadx-gui. It is a gaming app that requires an unusual amount of permissions according to the manifest file. I installed and played ...
-3
votes
1answer
114 views

How to reverse engineer apks? [closed]

is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
1
vote
1answer
63 views

Calling a method of a Java object passed as argument to hooked function in Frida

I am trying to obtain the SecretKey passed to the decryptAesCipherText function. I hooked the function in Frida to try to print out the arguments when the method is called but since SecretKey is an ...
3
votes
1answer
75 views

Modifying (adding new logic) decompiled apk to log different kind of data causing problems (crash/bluetooth connection)

I have separately decompiled apk to smali/dalvik and to java classes. As apk is not obfuscated java code is pretty good to read and I can pretty easily see corresponding smali code. So far I was able ...
2
votes
1answer
61 views

how to decompile or unite multipart dex class in an android apk file?

Some Android Apks contain multiple classes.dex files which are numbered like this: classes1.dex, classes2.dex ... and when i try to decompile them it would result into multiple source codes. Is there ...
1
vote
1answer
51 views

IDA Pro: How to change segment register value

For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
1
vote
1answer
32 views

methods that have zero usage in jadx?

so i've been reversing this ai assistant app to figure out what kind of forensic data it leaves on local file system. during static analysis with jadx-gui i found some interesting methods that take ...
0
votes
1answer
79 views

Android packageInfo signature

Are there anyways I can learn what packageInfo.signatures[0] is so I can use it to apply the same algorithm in Python. To further explain: private static SecretKeySpec a(Context context) { ...
-1
votes
1answer
84 views

App from playstore runs but the same apk crashes on sideload install

On my nougat device, I have downloaded an app from the playstore, which is running great. I then extract the apk from the installed app, and uninstall it and again successfully, with package installer....
0
votes
1answer
76 views

Read bytearray from retval on onLeave event

I'm trying to get the return value of a android native function call using Frida but with no success: Interceptor.attach(Module.getExportByName('lib.so', 'Token'), { onEnter: function(args) { ...
0
votes
1answer
42 views

how to replace the result from a json request into a variable [closed]

I would like to return in v0 the following answer "FR" instead of the country retrieved from Json .method public getCountryCode()Ljava/lang/String; .registers 2 .line 11 iget-object v0, p0, ...
-2
votes
1answer
155 views

Change androidmanifest.xml file within apk

I am able to unpack an android apk file with apktool, but when I am repacking the apk file using apktool, it just crashes with errors, and ibotpeaches seems not patching those errors for years. Now ...
1
vote
1answer
60 views

Charles TLS Proxy for Android device with root access

I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am ...
1
vote
0answers
55 views

Trying to replicate encryption of an android app

I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
2
votes
1answer
112 views

Invalid file path error while trying to rebuild with apktool and aapt2

I am facing an error while try to repack an apk with apkool. below is the error trace. W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'. W: error: invalid file ...
0
votes
0answers
16 views

compile gdb with python 3 for gef-ida-interact

I'm trying to use GEF's IDA-interact which has issues with python2. I'm using android-ndk-r20b/prebuilt/linux-x86_64/bin/gdb - v7.11 using Python engine 2.7 How do I compile gdb with python 3.x ? I ...
1
vote
0answers
161 views

Endoscope Camera YPC99 - how to stream on linux

I'm trying to stream video from endoscope camera YPC99 on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports RTSP protocol on port 7070 (...
3
votes
1answer
161 views

How can I retrieve the encryption key in this code?

can anyone explain the following code? is it possible to retrieve the encryption key? I think the code was heavily obfuscated in addition to obfuscation, I can recognize it is using algorithms like ...
1
vote
1answer
126 views

Unable to intercept traffic of an android app even after patching ssl pinning

Recently, I was trying to test an app developed on Rhomobile, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but ...
0
votes
0answers
58 views

What is the approach to find apps(Android) to reverse engineer?

How does one "choose" an app to do reverse engineering/analysis on (say finding bugs or malicious behavior) About me: I'm a beginner at Android App RE, have used various tools to solve some CTF apps ...
0
votes
0answers
165 views

Frida finding out a decryption/decode algorithm

It's been a few days I'm working on an application to find out about an encryption it is using on a few strings received from API, but no success so far. These are the strings: ...
0
votes
0answers
27 views

can't see java file but debugger shows it is present and can access using reflection

I am debugging an android application to find out the implementation of something. I am using a debugger in Android studio from which I came to know that there is a java file that is responsible but ...
-1
votes
1answer
35 views

How do I know which class/file in apk is being used for what purpose?

I am new to this sort of stuff. I just found hardcoded public and private keys in an android app. I just can't figure out what it is being used for. Any advice on that?
1
vote
1answer
86 views

Proper way of implementing DexGuard RASP device checks

I recently came across an app that is protected with DexGuard. DexGuard claims to offer Runtime Application Self Protection (RASP), which comprises of app obfuscation and various runtime tampering ...
2
votes
1answer
45 views

What code gets executed in an ELF binary when Java loadLibrary() is called

I’ve been working on reverse engineering this android x86 ELF binary. According to my research when loadLibrary() is called the function JNI_onLoad is supposed to be executed however this binary doesn’...
1
vote
0answers
59 views

JEB Decompiler - Signature recognition engine

I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
0
votes
0answers
157 views

Connect and extract live raw data from bluetooth devices

I recently bought a bunch of bluetooth devices which includes fitness bands, thermometers, room temp. But I've seen that most of them don't appear in the mobile's discoverable list but connects ...
1
vote
0answers
174 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
0
votes
0answers
34 views

How to bypass encrypted disk Android pin lock?

I have a forgotten pass code of my android device which is encrypted and ask password before boot time. How can I recover the pass or my data...
1
vote
1answer
30 views

Android dynamic UI state inspection/profiling tool

I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector. Is ...
1
vote
0answers
100 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
0
votes
0answers
107 views

Using IDA pro 7.2 and android server breakpoints problem

i have been trying to use IDA to make a breakpoints on a 4 byte memory address to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support ...
0
votes
0answers
30 views

How to change the manufacturer property in the Android emulator?

I already asked this question on StackOverflow, but it is not getting attention; maybe here is a better place I am running the Android emulator that comes with the Android Studio software. I created ...
1
vote
1answer
477 views

Adding my own logging function in Smali

I am trying to logcat the parameters of a function in smali with my own function. I made a new Android studio project and wrote the function then used APKtool to retrieve the Smali file. This is my ...
1
vote
0answers
469 views

Using Frida for early and late instrumentation

I am trying to hook functions with Frida where one .so file (x.so) is loaded early and another .so file (z.so) is loaded slightly later, after some processing is done by the application. This is what ...
1
vote
2answers
70 views

Load Library Android

I Work as cybersecurity consultant and now i'am in mission to reverse engineering of mobile app. I always reverse it using Jadx and dex2jar ... the problem that after reverse them i found some native ...
0
votes
1answer
268 views

How to reverse engineering a proguarded .apk? [closed]

Lets say you have android1.apk file coded with proguard enable. I want to reverse engineer it in such a way that it shows the original methods names instead letters of alphabets, example bellow ...
0
votes
0answers
35 views

When debugging SMALI what are the unexplorable byte[]s loaded into registers?

I'm trying to debug an android application that takes a base 64 string, decodes it to bytes then returns an object with the bytes in one of the object's fields. When using smalidea with android ...

1
2 3 4 5 6