Questions tagged [android]

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

90 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
12
votes
1answer
4k views

Howto clone Android RSA SecurID Software Token

At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
6
votes
1answer
2k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
5
votes
0answers
604 views

Reverse engineering an hydrometer's Bluetooth communication

This is a very specific question. I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
4
votes
1answer
856 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
3
votes
0answers
1k views

Unpack, modify and rebuild an Android App Bundles (.aab) file

I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file. Basically, I am looking for an apktool for .aab
3
votes
0answers
611 views

Android APK debugging: modify value of smali register

I am debugging an apk app that I do not have the sources for. I want to debug it on a smali level, not decompiled. I used to do this with apktool, but looking at their website, smali-debugging is ...
2
votes
0answers
77 views

Can I find usages of this string in my .so file? ARM

My apologies if this question is very basic. I have found this string in my Android application Binary that was built using the flutter framework. This is a 32 bit ARM library. I found the location of ...
2
votes
0answers
38 views

Cant hook into native lib with script?

im doing some practice stuff about hooking android native lib. I wrote this script: function processJniOnLoad(libraryName) { const funcSym = "...
2
votes
0answers
72 views

reversing a grpc call

im reversing a android app and i managed to intercept a grpc request and decode it using protoc but i cant seem to make sense of any of the data, i know its compressed using gzip because of the ...
2
votes
0answers
456 views

Hooking an interface method with Frida in an Android application

I'm trying to understand what an android application is sending over the network and as such am trying to hook into it with Frida, specifically a method called storeKeys . I was able to perform the ...
2
votes
0answers
129 views

Google Maps, Android serialisation format

I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example: I'm saying serialised, as from the ...
2
votes
0answers
288 views

Android APK is somehow verifying package signatures without calling PackageManager.signatures

I'm reverse engineering a very popular Android app. They perform some type of signature verification on the APK, however they do it without: Calling PackageManager.signatures Calling PackageInfo....
2
votes
0answers
140 views

Joysmade USB/WiFi microscope

Short intro: I am building an electronics workbench, and I needed a microscope. This Joysmade USB/WiFi microscope was $45, and it would work with exception to the below issues. My "dumb" TV was set ...
2
votes
0answers
891 views

frida hook jni not work

I want to trace Android Telegram app(open-source) to learn its protocol. From the source code these two functions AES_set_encrypt_key and AES_ctr128_encrypt are used to do the encryption, and I can ...
2
votes
0answers
79 views

How to update reversed code of an updated application?

A few months ago I started to reverse engineer an Android app, and i have pretty much progress in it, but it's updated weekly. How should i go about updating the reversed code? I searched for ways ...
2
votes
0answers
798 views

crash using ida 6.8 debugging on android 5.0

I need to debug .so of my.apk, I'm working on a phone with android 5.0, using ida 6.8's android_server. It seems ok for attaching ida to the process, but when clicking something on the apk there is ...
2
votes
0answers
281 views

Why can I not read .so file public functions compiled in C?

I can read the public functions (name and full signature) of some .so files that associated with Android APK, whereas others only show the function name. For example, running this command only ...
2
votes
0answers
2k views

Remotely debugging Android native ARM library running in Bluestacks

I want to debug a native library loaded by JNI on Android. I have set up the debugging environment to debug native code running on Bluestacks. I got gdbserver installed on rooted Bluestacks, running ...
1
vote
0answers
23 views

Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point

Here's the problem: I set a breakpoint in IDA debugger the program stop at the breakpoint deactivated the breakpoint IDA keep receiving SIGTRAP or SIGSEGV ( program stop at breakpoint as expected ) :...
1
vote
0answers
25 views

How do I get adb to work on a Rockchip RK3288 based android device running Lollipop 5.1.1?

Lollipop 5.1.1 based device. OLD ES File Manager installed. (Yes, the exploitable one). I can copy to/from the device. I tried Kingo Root, Root Genius, Towel root, etc. None of those work. "...
1
vote
0answers
26 views

How to repack the monobundleapp

I recently had to make a version of a survivalcraft 2 mod that allowed circuits to run faster I found this script by stack overflow to unpack a mono bundle app I already modified the .dll, but I need ...
1
vote
1answer
157 views

How to read dnSpy code from assembly_csharp.dll

So I have managed to retrieve the assembly_csharp.dll using the il2cpp tool from an android apk, however my issue is that when I go to read the dll using dnSpy I have all the correct looking function ...
1
vote
0answers
50 views

Protection of Financial Apps against repackaging

I have tried repackaging few financial apps and when I tried running their repackaged version, I found out that either it is getting crashed at the launcher activity, or at the later point it is ...
1
vote
0answers
144 views

Is it possible to work around SQLcipher by modifying libsqlcipher.so?

I was trying to extract data from an Android app which uses SQLcipher. SQLcipher is an extension of SQLite that encrypts database files with 256-bit AES. Within the APK, the library lies in lib/...
1
vote
0answers
90 views

Frida not able to trace sub_XXXXX which must have been called

I have the following pseudocode generated by IDA Pro decompiler: __int64 *__usercall sub_155B5@<X0>(__int64 *a1@<X0>, unsigned int a2@<W1>, char **a3@<X8>) { ... result = ...
1
vote
0answers
323 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
1
vote
0answers
61 views

Trying to replicate encryption of an android app

I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
1
vote
1answer
221 views

Proper way of implementing DexGuard RASP device checks

I recently came across an app that is protected with DexGuard. DexGuard claims to offer Runtime Application Self Protection (RASP), which comprises of app obfuscation and various runtime tampering ...
1
vote
0answers
91 views

JEB Decompiler - Signature recognition engine

I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
1
vote
0answers
286 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
1
vote
0answers
297 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
1
vote
0answers
1k views

Using Frida for early and late instrumentation

I am trying to hook functions with Frida where one .so file (x.so) is loaded early and another .so file (z.so) is loaded slightly later, after some processing is done by the application. This is what ...
1
vote
0answers
127 views

Strange behaviour debugging Android ARM binary with gdbserver

I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
1
vote
0answers
98 views

How to find implementation of native method in the library .so (Android)

I need to make reverse engineering of one android app. In this app I found class with name Im2MessageNative, this class contains a lot of native methods. For example: static native long ...
1
vote
0answers
1k views

Obfuscated Config Files: EHI Files for HTTP Injector

So I have an ehi file, which is a configuration file for an Android App called HTTP Injector. Of course when I try to see it as a simple text, I just get random characters. What tool could I use to ...
1
vote
0answers
153 views

Reverse Engineering Android ROMS to detect malicious code

I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm ...
1
vote
0answers
583 views

Unable to attach java sources to APK being debugged in Android Studio — Option not displayed

This article (https://developer.android.com/studio/debug/apk-debugger) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it ...
1
vote
0answers
129 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
1
vote
0answers
865 views

decompiled android application with only one class [DexProtector]

I'm trying to reverse engineering an android app and it's mostly for an experiment but I have a problem that I can't find a solution or even what is the problem. I decompiled an app with JADX-gui and ...
1
vote
0answers
177 views

Detect compression algorithm in .NPK archive

I'am trying to unpack Android game archive file (.NPK). The game is "Nvidia Glowball demo" (it has been pre-installed on my android tablet) Archive structure seems to be simple, but I can't ...
1
vote
0answers
90 views

How to patch JNI library to call functions on Linux

According to this post it is possible to run functions inside a shared library so long as they do not have a dependency on the JVM It works by patching the .dynamic ELF section to remove ...
1
vote
0answers
168 views

Common practices for 'hiding' a class within an Android application?

I've recently gotten into Android reverse engineering, and I've been messing around with some apps lately for education/research purposes to see how some things are done with private (mobile) APIs. ...
1
vote
0answers
94 views

Reversing Android BLE Application not showing in logcat

I'm new to reversing and I would like to reverse a BLE Android Application. (jbsmartbulb) I have seen in the package com.actions.ibluz.b this call : public void onCharacteristicWrite(final ...
1
vote
0answers
72 views

Missing Map from Java Native Method to C Code

When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
1
vote
0answers
94 views

Is there any way to get value from bytecode under JDWP without access to source?

When I debug android app through jdwp using jdb, it seems I can't get anything from the bytecode level. I know normally it's fine as long as we have the source line info and use a decompiler, but the ...
1
vote
0answers
2k views

Attaching to Dalvik static function using Frida in order to disable emulator detection

I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get ...
1
vote
0answers
285 views

Android debug server protocol version mismatch

I am trying to debug an arm64 binary in /data/local/tmp of my Android phone. I pushed the /dbgsrv/android_server64 to /data/local/tmp and then adb to the phone: $ chmod 777 ./android_server64 $ ./...
1
vote
0answers
294 views

Accessing .rodata/.rel.data.ro

Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is ...
1
vote
0answers
182 views

Tools to support Android native code hacking?

I am learning android reverse engineering, and want to know tools to hack native code. gdb to remotely debug the code, but I find it can not ever hit a breakpoint. arminject is a choice, it works on ...
1
vote
0answers
530 views

Android shared Library (.so)

I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I'...