Questions tagged [android]
Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.
111
questions with no upvoted or accepted answers
14
votes
1
answer
4k
views
Howto clone Android RSA SecurID Software Token
At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
7
votes
2
answers
1k
views
Attach Shared Object to android process with IDA
I am:
working with an Android game,
using an Android Emulator,
and trying to attach an android .so library to a process.
I have the whole IDA server set up, I can attach to processes when a classes....
- 71
5
votes
0
answers
6k
views
Unpack, modify and rebuild an Android App Bundles (.aab) file
I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file.
Basically, I am looking for an apktool for .aab
- 175
5
votes
0
answers
636
views
Reverse engineering an hydrometer's Bluetooth communication
This is a very specific question.
I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
- 135
3
votes
0
answers
807
views
Android APK debugging: modify value of smali register
I am debugging an apk app that I do not have the sources for. I want to debug it on a smali level, not decompiled.
I used to do this with apktool, but looking at their website, smali-debugging is ...
- 423
2
votes
0
answers
57
views
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
- 219
2
votes
0
answers
50
views
Android game reverse http request body
I'm trying to reverse request that are made to an android game to learn more about how it works.
I was able to find endpoints requests that are made with frida and mitmproxy but now I'm stuck because ...
2
votes
0
answers
29
views
How to re-create media file from android sender output stream
I would like to perform dynamic analysis on some android apps to check if these apps sending metadata with media files or not.
Ideas like the picture below:
Step 1: I prepared an image with metadata (...
2
votes
0
answers
54
views
Flashed "compatible" firmware onto two generic Allwinner A50 tablets
I'm already at least 3 days on this and can't find a way out. I'm still unsure if it fits here, but here we go!
I have 3 A50 Allwinner tablets (HOW HT-705XT) that I wanted to root. Since the only way ...
- 41
2
votes
0
answers
48
views
How do I log a string in smali without its obfuscated function?
I'm reversing engineering an app and after analyzing with man-in-the-middle, I find that it obfuscates its messages to the server so it looks like a gibberish.
String stc = ("msg=" + ...
2
votes
0
answers
61
views
How can I detect which Android native function that is hooked by Mobile Substrate: MSHookFunction?
I want to detect hook behavior of MSHookFunction on Android. This is Mobile Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/...
- 121
2
votes
0
answers
175
views
How to decompile an APK written in Golang?
I recently started trying to learn basic reverse engineering and Golang. Decompiling Android apps written in C++ and Java/Kotlin seems easy as there are tons of documents and tools that enable you to ...
- 21
2
votes
0
answers
88
views
Next steps for android native library RE (JNI_OnLoad, root check)
I'm trying to RE an Android app that detects root on a system.
Using frida to backtrace 'access' calls I found out that the root check happens natively:
access(/system/xbin/su, 0x0)
Interceptor ...
- 21
2
votes
0
answers
295
views
Intercept android app DNS lookup with Frida
I have been attempting to intercept when an app performs a DNS lookup using Frida. I assumed that ultimately a DNS lookup will end up in a libc call to gethostbyname or getaddrinfo but this does not ...
- 245
2
votes
0
answers
580
views
Understand a function within Hermes byte code
The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode.
I was able to disassemble the binary file ...
2
votes
0
answers
767
views
Frida class constructor hook not called while there do exist instances of the class
I have an (obfuscated) app with a certain class from which I would like to hook the constructor. The class has only 1 constructor defined and so I hooked the class as follows:
var Aclass = Java.use('...
- 51
2
votes
0
answers
77
views
Cant hook into native lib with script?
im doing some practice stuff about hooking android native lib. I wrote this script:
function processJniOnLoad(libraryName) {
const funcSym = "...
- 57
2
votes
0
answers
324
views
reversing a grpc call
im reversing a android app and i managed to intercept a grpc request and decode it using protoc but i cant seem to make sense of any of the data, i know its compressed using gzip because of the ...
- 41
2
votes
1
answer
240
views
$$Lambda$(number) when decompiled Java bytecode
Why when I decompile a Java bytecode (which further was decompiled from .dex), I get $$Lambda$(number), in Java files, and it's not possible to build project with these java codes as it's insufficient ...
- 21
2
votes
0
answers
2k
views
Hooking an interface method with Frida in an Android application
I'm trying to understand what an android application is sending over the network and as such am trying to hook into it with Frida, specifically a method called storeKeys .
I was able to perform the ...
- 141
2
votes
0
answers
85
views
Trying to replicate encryption of an android app
I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
- 219
2
votes
0
answers
470
views
What is the header 'X-Goog-Spatula'?
I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
- 21
2
votes
0
answers
3k
views
Using Frida for early and late instrumentation
I am trying to hook functions with Frida where one .so file (x.so) is loaded early and another .so file (z.so) is loaded slightly later, after some processing is done by the application.
This is what ...
- 163
2
votes
0
answers
238
views
Google Maps, Android serialisation format
I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example:
I'm saying serialised, as from the ...
- 121
2
votes
0
answers
830
views
Unable to attach java sources to APK being debugged in Android Studio -- Option not displayed
This article (https://developer.android.com/studio/debug/apk-debugger) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it ...
- 35
2
votes
0
answers
372
views
Android APK is somehow verifying package signatures without calling PackageManager.signatures
I'm reverse engineering a very popular Android app.
They perform some type of signature verification on the APK, however they do it without:
Calling PackageManager.signatures
Calling PackageInfo....
- 21
2
votes
0
answers
198
views
Joysmade USB/WiFi microscope
Short intro: I am building an electronics workbench, and I needed a microscope. This Joysmade USB/WiFi microscope was $45, and it would work with exception to the below issues.
My "dumb" TV was set ...
- 21
2
votes
0
answers
1k
views
frida hook jni not work
I want to trace Android Telegram app(open-source) to learn its protocol.
From the source code these two functions AES_set_encrypt_key and AES_ctr128_encrypt are used to do the encryption, and I can ...
- 197
2
votes
0
answers
84
views
How to update reversed code of an updated application?
A few months ago I started to reverse engineer an Android app, and i have pretty much progress in it, but it's updated weekly. How should i go about updating the reversed code?
I searched for ways ...
- 21
2
votes
0
answers
890
views
crash using ida 6.8 debugging on android 5.0
I need to debug .so of my.apk, I'm working on a phone with android 5.0, using ida 6.8's android_server. It seems ok for attaching ida to the process, but when clicking something on the apk there is ...
- 197
2
votes
0
answers
293
views
Why can I not read .so file public functions compiled in C?
I can read the public functions (name and full signature) of some .so files that associated with Android APK, whereas others only show the function name.
For example, running this command only ...
- 21
2
votes
0
answers
2k
views
Remotely debugging Android native ARM library running in Bluestacks
I want to debug a native library loaded by JNI on Android. I have set up the debugging environment to debug native code running on Bluestacks.
I got gdbserver installed on rooted Bluestacks, running ...
- 121
2
votes
0
answers
3k
views
Debug Android Native Code without source
Id like to debug (to log function calls) native ARM Android Code in a shared library. So far I got no source and tried to disassemble it with IDA, but its hard to track all the calls down to a ...
- 121
2
votes
1
answer
1k
views
How to read dnSpy code from assembly_csharp.dll
So I have managed to retrieve the assembly_csharp.dll using the il2cpp tool from an android apk, however my issue is that when I go to read the dll using dnSpy I have all the correct looking function ...
- 21
1
vote
0
answers
42
views
Android Hermes. Replace text to russian text (Cyrillic)
I am doing a translation for one application with hbctool (disassembling and assembling), and when replacing the text, the Russian text becomes look like "random symbols".
I do not fully ...
- 11
1
vote
0
answers
43
views
Cannot load libvulkan.so on Linux chroot running on Android while normal Android apps can load it
Environment
First I will give a quick summary of my environment
Device: Samsung Galaxy M20 (m20lte)
SoC: Exynos 7904 (with Mali-G71 GPU)
OS: Android 10 (Stock ROM with root using Magisk)
Kernel: 4.4....
- 219
1
vote
0
answers
57
views
deobfuscate Dexgaurd obfuscated code
I was reversing an apk. the code detects whether the apk is running on a rooted device or not. if it is rooted or an emulator it will stop and close out. so this is the snippet code which I think it ...
- 219
1
vote
0
answers
82
views
ghidra assigns local variable to register
im reversing a android native library and im trying to understand how a token is generated the toke n is passed to a callback java method and i traced where the method is getting called from
this is ...
- 41
1
vote
1
answer
160
views
HELP Decrypting Lua files
i'm trying to mod a game named : DDTank Mobile, which is on both Android & IOS.
This game runs on cocos2d engine, the thing is the lua files are encrypted.
I read somewhere to look for 'sign' at ...
1
vote
0
answers
92
views
reverse engineering an APK file to find HTTP requests in the source code
I've extracted an apk(react native) with dex2jar and jar to java through jd-qui and also with apktool, and I can view the source code but there is no clue where are the HTTP requests in the source ...
- 11
1
vote
0
answers
48
views
Reverse engineering of Process manager apk
Is there someone helps me to understand how to build the server of this apk https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/ ? I tried to disassemble the apk but it is ...
- 27
1
vote
0
answers
137
views
SSL Pinning React Native
I'm trying to remove SSL pinning with Android device.
I've tried different techniques like hooking the app with Objection, re-pinning with Frida, using the SSLUnpinning app from the Xposed repo, etc. ...
moskino11
1
vote
0
answers
375
views
frida cant cast string array to java.lang.object
i have a java method i am trying to call manually
public static native Object a(int i, int i2, long j, String str, Object obj);
the last parameter is a string list casted to java.lang.object the way ...
- 41
1
vote
0
answers
12
views
Need help injecting SSID into Momentum app checking for device wifi
Hello so I'm trying to add a device onto my Genymotion emulated device
but to add it the app needs to detect the AP. this is the logcat of just the apps logs
If anyone can help let me know im trying ...
1
vote
0
answers
165
views
Where can I find the encryption algorithm for this POST request in an Android APP?
I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
- 19
1
vote
0
answers
128
views
Compress Xamarin assemblies after decompression
I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies.
Is there anyway I can compress them again into assemblies.blob file or at least ...
- 11
1
vote
0
answers
84
views
How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?
I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth.
I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
- 11
1
vote
0
answers
96
views
Video Packets via UDP - How to decode or identify video format?
I'm working with a cheap wireless video transmitter and receiver system that uses an Android App to receive the video over WiFi.
We want to be able to identify where the stream is coming from to be ...
- 11
1
vote
0
answers
133
views
Bypassing unsupported android TV box!
I have an android TV box called Proximus decoder v4, anyway the android TV box is not supported anymore by the company. When I turn it on I get an update checking, you can't even cancel it, and then I ...
1
vote
0
answers
186
views
Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point
Here's the problem:
I set a breakpoint in IDA debugger
the program stop at the breakpoint
deactivated the breakpoint
IDA keep receiving SIGTRAP or SIGSEGV
( program stop at breakpoint as expected ) :...
- 131
Hot Network Questions
- Who are the top 10 youngest players to reach a FIDE standard rating of 2200?
- Is it a Frog List?
- Unique number from digits 0123456789 with simple property
- Is light only emitted by atoms? i.e are they the only source of light in the universe?
- How to quickly generate rectangles in place of text
- Can bombs gain weapon runes?
- Two polynomials which are "completely" coprime
- Has the ICC ever tried to arrest any Western or pro-Western politician?
- Development pattern for interactive in-game tutorials
- Doesn't Windows Sandbox require Hyper-V to run? How is it working with Hyper-V not enabeld?
- How am I supposed to parse the "...she might have passed over more..." line in "Emma"?
- How did Ptolemy know that days were unequal lengths?
- Why are there no single logic gates in through-hole packages?
- Is it possible to write a character that remains mysterious until the very end without sacrificing character development?
- Would 1 Peter Be The Oldest Letter In The New Testament?
- How do you fix the wrong-case-sensitivity dictionary setting bug-pattern?
- Can underage people who commit a crime while underaged but are later charged with the same crime after turning 18 be tried as an adult?
- Could a supernova powered starship work/survive?
- How many TCP retransmissions Internet traffic is considered normal for a basic home setup?
- HoldForm not working with Map
- Why is there sand or salt in this electrical circuit?
- What do these tire markings mean?
- Can you use 'amok' without 'run'? How?
- How should Directors deal with an overbearing branch Manager?