Questions tagged [android]

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

76 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
12
votes
1answer
3k views

Howto clone Android RSA SecurID Software Token

At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
5
votes
0answers
595 views

Reverse engineering an hydrometer's Bluetooth communication

This is a very specific question. I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
5
votes
1answer
2k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
4
votes
1answer
814 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
3
votes
0answers
447 views

Android APK debugging: modify value of smali register

I am debugging an apk app that I do not have the sources for. I want to debug it on a smali level, not decompiled. I used to do this with apktool, but looking at their website, smali-debugging is ...
3
votes
0answers
300 views

Reverse engineering android native packer

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder ├───app_dexprotector │ 823517D25836B88F1C499C02370A047E.dat │ ...
2
votes
0answers
230 views

Android APK is somehow verifying package signatures without calling PackageManager.signatures

I'm reverse engineering a very popular Android app. They perform some type of signature verification on the APK, however they do it without: Calling PackageManager.signatures Calling PackageInfo....
2
votes
0answers
114 views

Joysmade USB/WiFi microscope

Short intro: I am building an electronics workbench, and I needed a microscope. This Joysmade USB/WiFi microscope was $45, and it would work with exception to the below issues. My "dumb" TV was set ...
2
votes
0answers
730 views

frida hook jni not work

I want to trace Android Telegram app(open-source) to learn its protocol. From the source code these two functions AES_set_encrypt_key and AES_ctr128_encrypt are used to do the encryption, and I can ...
2
votes
0answers
76 views

How to update reversed code of an updated application?

A few months ago I started to reverse engineer an Android app, and i have pretty much progress in it, but it's updated weekly. How should i go about updating the reversed code? I searched for ways ...
2
votes
0answers
730 views

crash using ida 6.8 debugging on android 5.0

I need to debug .so of my.apk, I'm working on a phone with android 5.0, using ida 6.8's android_server. It seems ok for attaching ida to the process, but when clicking something on the apk there is ...
2
votes
0answers
274 views

Why can I not read .so file public functions compiled in C?

I can read the public functions (name and full signature) of some .so files that associated with Android APK, whereas others only show the function name. For example, running this command only ...
2
votes
0answers
2k views

Remotely debugging Android native ARM library running in Bluestacks

I want to debug a native library loaded by JNI on Android. I have set up the debugging environment to debug native code running on Bluestacks. I got gdbserver installed on rooted Bluestacks, running ...
1
vote
0answers
39 views

Frida not able to trace sub_XXXXX which must have been called

I have the following pseudocode generated by IDA Pro decompiler: __int64 *__usercall sub_155B5@<X0>(__int64 *a1@<X0>, unsigned int a2@<W1>, char **a3@<X8>) { ... result = ...
1
vote
1answer
52 views

hooking libhoudini on x86 emulator

I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved! I'm using a x86 emulator to run arm ...
1
vote
0answers
63 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
1
vote
1answer
46 views

IDA Pro: How to change segment register value

For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
1
vote
0answers
54 views

Trying to replicate encryption of an android app

I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
1
vote
0answers
152 views

Endoscope Camera YPC99 - how to stream on linux

I'm trying to stream video from endoscope camera YPC99 on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports RTSP protocol on port 7070 (...
1
vote
1answer
81 views

Proper way of implementing DexGuard RASP device checks

I recently came across an app that is protected with DexGuard. DexGuard claims to offer Runtime Application Self Protection (RASP), which comprises of app obfuscation and various runtime tampering ...
1
vote
0answers
59 views

JEB Decompiler - Signature recognition engine

I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
1
vote
0answers
174 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
1
vote
0answers
100 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
1
vote
0answers
451 views

Using Frida for early and late instrumentation

I am trying to hook functions with Frida where one .so file (x.so) is loaded early and another .so file (z.so) is loaded slightly later, after some processing is done by the application. This is what ...
1
vote
2answers
70 views

Load Library Android

I Work as cybersecurity consultant and now i'am in mission to reverse engineering of mobile app. I always reverse it using Jadx and dex2jar ... the problem that after reverse them i found some native ...
1
vote
0answers
66 views

Strange behaviour debugging Android ARM binary with gdbserver

I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
1
vote
0answers
81 views

Google Maps, Android serialisation format

I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example: I'm saying serialised, as from the ...
1
vote
0answers
68 views

How to find implementation of native method in the library .so (Android)

I need to make reverse engineering of one android app. In this app I found class with name Im2MessageNative, this class contains a lot of native methods. For example: static native long ...
1
vote
1answer
70 views

DEX file referenced type is not defined in file

I am analyzing a dex file and to ease with reverse engineering, I converted it a jar so it could be decompiled. In the file android/support/v17/leanback/media/MediaControllerGlue.class, the following ...
1
vote
0answers
1k views

Obfuscated Config Files: EHI Files for HTTP Injector

So I have an ehi file, which is a configuration file for an Android App called HTTP Injector. Of course when I try to see it as a simple text, I just get random characters. What tool could I use to ...
1
vote
0answers
112 views

Reverse Engineering Android ROMS to detect malicious code

I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm ...
1
vote
0answers
389 views

Unable to attach java sources to APK being debugged in Android Studio — Option not displayed

This article (https://developer.android.com/studio/debug/apk-debugger) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it ...
1
vote
0answers
107 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
1
vote
0answers
680 views

decompiled android application with only one class [DexProtector]

I'm trying to reverse engineering an android app and it's mostly for an experiment but I have a problem that I can't find a solution or even what is the problem. I decompiled an app with JADX-gui and ...
1
vote
0answers
158 views

Detect compression algorithm in .NPK archive

I'am trying to unpack Android game archive file (.NPK). The game is "Nvidia Glowball demo" (it has been pre-installed on my android tablet) Archive structure seems to be simple, but I can't ...
1
vote
0answers
79 views

How to patch JNI library to call functions on Linux

According to this post it is possible to run functions inside a shared library so long as they do not have a dependency on the JVM It works by patching the .dynamic ELF section to remove ...
1
vote
0answers
119 views

Common practices for 'hiding' a class within an Android application?

I've recently gotten into Android reverse engineering, and I've been messing around with some apps lately for education/research purposes to see how some things are done with private (mobile) APIs. ...
1
vote
0answers
87 views

Reversing Android BLE Application not showing in logcat

I'm new to reversing and I would like to reverse a BLE Android Application. (jbsmartbulb) I have seen in the package com.actions.ibluz.b this call : public void onCharacteristicWrite(final ...
1
vote
0answers
67 views

Missing Map from Java Native Method to C Code

When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
1
vote
0answers
85 views

Is there any way to get value from bytecode under JDWP without access to source?

When I debug android app through jdwp using jdb, it seems I can't get anything from the bytecode level. I know normally it's fine as long as we have the source line info and use a decompiler, but the ...
1
vote
0answers
1k views

Attaching to Dalvik static function using Frida in order to disable emulator detection

I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get ...
1
vote
0answers
247 views

Android debug server protocol version mismatch

I am trying to debug an arm64 binary in /data/local/tmp of my Android phone. I pushed the /dbgsrv/android_server64 to /data/local/tmp and then adb to the phone: $ chmod 777 ./android_server64 $ ./...
1
vote
0answers
272 views

Accessing .rodata/.rel.data.ro

Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is ...
1
vote
0answers
179 views

Tools to support Android native code hacking?

I am learning android reverse engineering, and want to know tools to hack native code. gdb to remotely debug the code, but I find it can not ever hit a breakpoint. arminject is a choice, it works on ...
1
vote
0answers
521 views

Android shared Library (.so)

I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I'...
1
vote
0answers
604 views

recompiling android app - native method not found

Been trying at this for over a week, and I'm able to modify the needed sections, however I'm running into a major issue while trying to recompile the APK that is making the whole task atrocious. So I'...
1
vote
0answers
444 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
1
vote
0answers
3k views

Debug Android Native Code without source

Id like to debug (to log function calls) native ARM Android Code in a shared library. So far I got no source and tried to disassemble it with IDA, but its hard to track all the calls down to a ...
1
vote
0answers
74 views

Creating shared object library to switch out loaded methods

Is it possible to create a dynamic library libXXX.so with android ndk that has a function that switches out methods in loaded classes in the dvm and call it from any apk ? There are functions within ...
1
vote
0answers
2k views

How to change the export function name of android so file (ELF format)

Here are my .so files: libJlcVideoEncoder.so java_so_change.exe Below are export functions inside .so files: Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcInit ...