Questions tagged [android]

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

Filter by
Sorted by
Tagged with
2 votes
0 answers
69 views

How to decompile an APK written in Golang?

I recently started trying to learn basic reverse engineering and Golang. Decompiling Android apps written in C++ and Java/Kotlin seems easy as there are tons of documents and tools that enable you to ...
  • 21
2 votes
0 answers
36 views

Next steps for android native library RE (JNI_OnLoad, root check)

I'm trying to RE an Android app that detects root on a system. Using frida to backtrace 'access' calls I found out that the root check happens natively: access(/system/xbin/su, 0x0) Interceptor ...
  • 21
1 vote
0 answers
35 views

Reverse engineering of Process manager apk

Is there someone helps me to understand how to build the server of this apk https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/ ? I tried to disassemble the apk but it is ...
  • 27
0 votes
0 answers
35 views

Malware apk in Android [duplicate]

Is there some website where i'm able to find malware apk filtering by permission (for instance: RECORD_AUDIO)? I'm looking for website similar to pithus
  • 27
1 vote
0 answers
55 views

Decompiling and Recompiling APK leads to crash using Apktool

Decompiling and recompiling an apk causes it to crash. My goal is simply to insert a method into smali code that prints a stacktrace, but even decompiling and recompiling with no changes causes the ...
  • 111
1 vote
0 answers
114 views

frida cant cast string array to java.lang.object

i have a java method i am trying to call manually public static native Object a(int i, int i2, long j, String str, Object obj); the last parameter is a string list casted to java.lang.object the way ...
1 vote
0 answers
12 views

Need help injecting SSID into Momentum app checking for device wifi

Hello so I'm trying to add a device onto my Genymotion emulated device but to add it the app needs to detect the AP. this is the logcat of just the apps logs If anyone can help let me know im trying ...
1 vote
0 answers
54 views

SSL Pinning React Native

I'm trying to remove SSL pinning with Android device. I've tried different techniques like hooking the app with Objection, re-pinning with Frida, using the SSLUnpinning app from the Xposed repo, etc. ...
user avatar
0 votes
0 answers
148 views

frida calling method raises error pointer expected

i have a java method i am trying to call manually public static native Object a(int i, int i2, long j, String str, Object obj); whenever i try to call it and pass the needed arguments it raises a ...
0 votes
0 answers
39 views

Where can I find the hashing algorithm in source code?

When I submit login credentials in an Android Application it POSTs an encrypted string to an API endpoint. For example, if I enter the following email & pass : "abc@abbc.com:abc" it ...
  • 1
0 votes
1 answer
93 views

Malware application in Android

Is there some website that give us the possibility to download malware APK in order to study it? I’m interested to study the abuse of android.permission.RECORD_AUDIO in Android 8.
  • 27
0 votes
0 answers
23 views

What skills are need to find ways of take root of Phones?

I am very interested in about take root of Android phones and I'm noob of reverse engineering. I have some of old Android devices that already unused. Some Android devices provide easier path to root ...
1 vote
1 answer
76 views

How to set a breakpoint in android's openssl library in running android application?

I'm debugging an obfuscated android application. I use Android Studio's debugger. I attach it remotely to my physical device via adb. I can set a breakpoint in the app smali code, but when I try to ...
  • 13
0 votes
1 answer
228 views

ghidra returning wrong function address

I am reverse engineering a android app shared library (.so file) and I am trying to use frida to hook a non exported native function I am using this hook const ghidraImageBase = 0x00100000; const ...
2 votes
1 answer
732 views

Decrypting Lua files encrypt from apk game

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the lua file. Its from an android game I decompiled the APK and found that all the lua files are encrypted. ...
  • 21
0 votes
0 answers
29 views

Is there any Android application that can manipulate the http response?

Is there any android app to manipulate http response body without vpn? for example: from "0|{random_string}|Wrong" Becomes "1|{random_string}|True" Thanks in advance
0 votes
1 answer
81 views

Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header

I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum. file output: libTheArmKing.so: ELF ...
0 votes
0 answers
16 views

IDA debug function spawned by pthread_once

I am using IDA to debug android, some libs use pthread_once/pthread_create function to call a function. How do I use/set up IDA to debug the function passed to pthread_once ?
0 votes
1 answer
314 views

frida returning wrong overload of android method

im trying to hook the C6494a method has 2 parameters the ge6 object and a activity object whenever i try to hook this method with a hook overload that contains both ge6 and the activity object frida ...
2 votes
0 answers
190 views

Intercept android app DNS lookup with Frida

I have been attempting to intercept when an app performs a DNS lookup using Frida. I assumed that ultimately a DNS lookup will end up in a libc call to gethostbyname or getaddrinfo but this does not ...
0 votes
0 answers
70 views

Inject script into Dex-Protected app

I've seen scripts like : https://github.com/hluwa/frida-dexdump https://github.com/apkunpacker/DexDumper that can extract the Dex files but what I want is to inject into running app and identified ...
  • 257
1 vote
0 answers
103 views

Where can I find the encryption algorithm for this POST request in an Android APP?

I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
  • 19
2 votes
0 answers
398 views

Understand a function within Hermes byte code

The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode. I was able to disassemble the binary file ...
1 vote
0 answers
88 views

Compress Xamarin assemblies after decompression

I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies. Is there anyway I can compress them again into assemblies.blob file or at least ...
1 vote
1 answer
37 views

Gdb hardware watchpoint error on android

After failing to find a solution to this I have started using Gdb and have encountered another error. Gdbfails to set hardware watchpoint when I'm remote debugging a rooted arm7-a target. It supports ...
  • 154
2 votes
1 answer
322 views

LLDB debugging on android?

I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
  • 154
1 vote
1 answer
351 views

Modify, unpack, and rebuild an Android App Bundles (.aab) file

My developer has not provided me the source code backup for my listed app in Google Play (his PC was stolen and all codes are gone with it). I logged on to my Play Store developer's account and found ...
0 votes
0 answers
138 views

How can i inject xamarin smali code into another apk?

I tried to make a simple foreground service android application using xamarin... then decompile and inject it into another apk...but it always crashes. here is adb logcat : 05-31 23:57:34.158 7680 ...
0 votes
0 answers
168 views

Trace java calls from a native library using frida

Im trying to trace method calls from a native library using frida I've tried jnitrace but it won't print anything Do you have any suggestion?
0 votes
0 answers
78 views

Encrypted properties files in asset folder of android application

I'm trying to reverse engineer an Android application. The goal is to obtain a secret from the apk. After decompiling the application, I found some interesting files in the assets directory. The files ...
1 vote
1 answer
501 views

Where can I find the encryption algorithm in source code?

When I submit a Customer Reference ID in an Android Application it POSTs an encrypted string to an API endpoint. For example, if I enter the following CR ID : "SR-54585482" it POSTs the ...
0 votes
0 answers
70 views

Linux-based head unit: getting access to displays without any display server?

Overview I have a 2016 Infiniti Q50, which was equipped with an infotainment system called Infiniti InTouch. It consists of two displays (upper and lower), and I have spent the past few weeks reverse ...
2 votes
0 answers
593 views

Frida class constructor hook not called while there do exist instances of the class

I have an (obfuscated) app with a certain class from which I would like to hook the constructor. The class has only 1 constructor defined and so I hooked the class as follows: var Aclass = Java.use('...
  • 31
1 vote
1 answer
78 views

No main activity when static analysis

Though mainifest.xml, I know main activity is: com.trust.rookie.MainActivity. But when I load the file in jadx, I can't see that class. Why? And how the program can run?
0 votes
2 answers
105 views

Capturing ADB commands sent by a Windows program to a phone

I would like to see, what ADB commands a Windows program is sending to my Android phone, to see how it operates it's functions.
  • 9
1 vote
0 answers
224 views

Bypassing certificate transparency with Frida

As part of some school research I'm experimenting with Frida to see what can be done to bypass SSLpinning. As I was hooking some methods of an application that throw SSLPeerUnverifiedException I ...
  • 31
1 vote
1 answer
80 views

ARM/THUMB assembly mismatch between binaries causes crash

I am trying to play around with an app for Android and every time I try to call a function (lua_gettop() from the Lua 5.1 library) from the app's address space, it hits me with ILL_ILLOPC. I made sure ...
  • 11
0 votes
0 answers
131 views

How to gain access to obfuscated files stored within an app's OBB file?

So, for the last few days, I've been working on this problem. I've been trying to gain access to an Android app's code, and have managed to narrow it down (probably) to the app's .OBB file. I can open ...
0 votes
1 answer
95 views

How do I gain access to files that an Android app stores in its persistent internal storage directory?

I was playing a game that had hidden achievements and wanted to find the conditions necessary to unlock these achievements. To do this, I've tried to get the source code of the game, to find the ...
0 votes
0 answers
28 views

<"..." is not a valid class name"> when trying to debug an android app using jdb

I am trying to reverse engineer an android app for education purpose, but I ran into an annoying problem: the android app is obfuscated and some classnames start with digits. So when I tried putting a ...
0 votes
0 answers
157 views

Injecting class into the JNIEnv in android jni

void *handle = dlopen("/data/local/tmp/libnative-lib.so", RTLD_LAZY); if (!handle) { printf("\nFailed to load library\n"); } void *offset = dlsym(handle, "...
1 vote
0 answers
57 views

How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?

I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth. I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
2 votes
1 answer
704 views

Debug shared library in Android application

There is an Android application that has a shared library (.so) file in split_config.arm64_v8a.apk that I want to debug . When I look at /proc/PID/maps I don't see that library (I do see the ...
  • 23
0 votes
1 answer
357 views

android index.android.bundle file

I downloaded an app from Raccoon. I got these files: com.company.name-3423.apk config.ar-3423.apk config.armeabi_v7a-3423.apk config.en-3423.apk config.iw-3423.apk config.ru-3423.apk config.xhdpi-3423....
1 vote
0 answers
86 views

Video Packets via UDP - How to decode or identify video format?

I'm working with a cheap wireless video transmitter and receiver system that uses an Android App to receive the video over WiFi. We want to be able to identify where the stream is coming from to be ...
1 vote
0 answers
91 views

Bypassing unsupported android TV box!

I have an android TV box called Proximus decoder v4, anyway the android TV box is not supported anymore by the company. When I turn it on I get an update checking, you can't even cancel it, and then I ...
0 votes
0 answers
48 views

How to reverse android native libraries? Best resources? [duplicate]

I want to improve myself in Android penetration testing. For this task i need to learn reversing the native libraries of an APK file to detect vulnerabilities. What is the best way and resources for ...
0 votes
2 answers
77 views

why does dalvik remove invocations during optimisation?

This is original smali code of a classes.dex method before installation .method public static createAutoMatchCriteria(IIJ)Landroid/os/Bundle; .registers 6 new-instance v0, Landroid/os/Bundle; ...
  • 154
0 votes
1 answer
211 views

What does this function do?

I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
  • 1
2 votes
1 answer
195 views

Debugging Native Lib using IDA Pro Fails to Load Registers and other Information

Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
  • 121

1
2 3 4 5
8