Questions tagged [android]
Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.
389
questions
92
votes
9
answers
303k
views
How do I reverse-engineer .so files found in Android APKs?
I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation.
When I extract everything from APK, I get some Smali files (I ...
- 1,195
30
votes
6
answers
13k
views
Decompiling Android application
The Android java code is compiled into Dalvik byte code, which is quite readable. I wonder, is it possible in theory and in practice to write a decompilation software for Dalvik byte code?
- 4,785
24
votes
6
answers
36k
views
How do I analyze a .apk file and understand its working?
I am an Android app developer, and recently I encountered a problem with in-app purchase. I discovered that in some apps, in-app purchases can be done for free using this application.
I know this app ...
- 349
23
votes
1
answer
12k
views
Analyzing encrypted Android apps (.asec)?
I've been trying to reverse engineer a paid android app that writes out some binary data so that I can export that data into other programs (it's a run/walk timer app, if anyone's curious, and I'm ...
- 2,868
16
votes
7
answers
59k
views
What are the tools use for reverse engineering android apk?
Currently, I only know about apktool.
But is there any tools that helps in checking the code, editing it and compiling it back to apk?
- 269
16
votes
3
answers
9k
views
Dynamic java instrumentation?
This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation.
So, in the same fashion as strace which allows you to see syscalls made by a process, or ftrace to see ...
- 163
16
votes
1
answer
27k
views
Debugging third party android APKs
What are some ways to debug third party android apps (apps you don't have the source code to)? I would like to step through the APK instruction by instruction, and possibly set breakpoints on certain ...
- 400
15
votes
1
answer
11k
views
Bypassing certificate pinning in android
I've spent the past 4 months trying to bypass certificate pinning in the Facebook android application so I can understand how it works, but I'm having trouble doing so.
I have tried using android ...
- 151
14
votes
8
answers
41k
views
Repackaging APK file using baksmali and smali
I am a student interested in Android Security. I was trying to modify a APK file using baksmali and smali. However, I am not able to run the repackaged app in my mobile. When I click on the icon it ...
- 303
14
votes
1
answer
4k
views
Howto clone Android RSA SecurID Software Token
At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
11
votes
1
answer
4k
views
Generating Snapchat Snaptags ("QR" Codes)
For those that haven't seen, Snapchat now has a special type of image based code that allows you to quickly add friends by pointing the camera at the screen, similar to a QR code, called "Snaptags". ...
- 111
10
votes
2
answers
1k
views
Android bytecode verifier
One of the things that makes Java bytecode (.class) so easy to reverse engineer is that the JVM's verifier ensures that bytecode can always be disassembled via linear sweep. Instructions have to be ...
- 2,002
10
votes
5
answers
5k
views
Lifting up binaries of any arch into an intermediate language for static analysis
Background
As the title is self-explanatory, I would like to translate binaries of any architecture (e.g. x86, ARM, ARM Thumb) to an intermediate language in order to apply arch-independent static ...
- 205
10
votes
3
answers
18k
views
Reverse engineer Android native code
I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
- 109
10
votes
2
answers
3k
views
Fixing the checksum of a modified Android ELF
I've hex-edited a string in an Android ELF binary.
Now, it won't run, and gives the error message CANNOT LINK EXECUTABLE, presumably due to a bad checksum.
Does anybody have a tool to fix the ...
- 181
9
votes
2
answers
7k
views
How difficult is to decompile C++ file?
I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp.
I am also going to create an iOS app which will use the same AES key. Is ...
- 91
9
votes
3
answers
1k
views
Is there a name for this kind of "obfuscation" for the machine code from C++?
I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
- 118
7
votes
1
answer
2k
views
Why two virtual destructors?
The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as:
_ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
7
votes
1
answer
2k
views
Inserting resources.properties file into an APK - language compatibility
I'm reverse engineering an android application. It's been a while since I've poked with this but I"m having an issue editing the APK to deal with some language areas.
The original app is from a ...
- 1,022
7
votes
1
answer
2k
views
How does API call work on Android (NDK)?
In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely.
...
- 341
7
votes
2
answers
1k
views
Attach Shared Object to android process with IDA
I am:
working with an Android game,
using an Android Emulator,
and trying to attach an android .so library to a process.
I have the whole IDA server set up, I can attach to processes when a classes....
- 71
6
votes
2
answers
542
views
Disassemble ELF - PC is set to 0?
I tried to disassemble a ELF file which is a shared object file executed on armv7a (Android). I saw a strange block. It seems that the PC, program counter register, is set to 0. Did I miss something ...
- 195
6
votes
2
answers
11k
views
Offset calculation for branch instruction in ARM
As the title says, how to calculate offsets for branch instructions?
For example i have following assembly code,
0x60ECE B loc_60EE6
;
;
;
0x60EE6 LDR.W R2, #0x123
Hex code for location ...
- 165
6
votes
2
answers
2k
views
How do Android reverse engineering tools extract packages/ package hierarchy present in Android apps?
I have been involved in disassembling Android apps using baksmali and dexpler. Whenever I disassemble an app, I find the packages and package hierarchy (that would have been available in development ...
- 201
6
votes
3
answers
11k
views
Use Android Shared library (.so) files in Linux
I decompiled an APK file,and that program have native codes in a .so file.
I want to use that .so file in Linux in order to use inline functions.
These codes have functions to connect to a server and ...
- 61
6
votes
2
answers
4k
views
How to break on an Android JNI function with IDA Pro Debugger
I have an android application that uses a shared library which I would like to step through with a debugger. I've had success using IDA 6.3 to debug executables with the android_server debug server ...
- 1,326
6
votes
1
answer
642
views
Dalvik Byte code instrumentation framwork for dynamic data dependency analysis
I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
- 161
6
votes
2
answers
2k
views
Trace system calls, including stack (and java stack if possible), on android?
I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption.
The app in question consists ...
- 12.9k
6
votes
2
answers
2k
views
IDA Pro 6.4 android_server processattach failed
I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
- 61
5
votes
1
answer
2k
views
Find function in a stripped dynamic ELF library
Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface.
My ...
- 153
5
votes
2
answers
10k
views
Mapping Android resource IDs to resource string
I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to ...
- 359
5
votes
1
answer
934
views
Replacing small length instruction with larger length instruction
Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code.
I am using IDA Pro for analyzing native ...
- 165
5
votes
1
answer
1k
views
Can a debug-apk be reverse engineered to make it a release-apk?
I am making a system in which the users can create Android applications. I want them to give an option to download a debug apk so that they can try it out first. After that, they have to pay for it to ...
user187
5
votes
2
answers
692
views
ARM - Is calling function from external static library possible?
Basically i'm debugging a closed source binary on Android and i want to execute some of my code in between which is large enough not to fit in codecave. So is it possible to compile library with my ...
- 165
5
votes
2
answers
1k
views
What is stored in typeinfo (GNU C++, Android NDK, ARM)
IDA annotates some items as: typeinfo for _classname_.
What is that typeinfo, is it the same as type_info?
What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
5
votes
1
answer
747
views
Reverse engineering android native packer
im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder
├───app_dexprotector
│ 823517D25836B88F1C499C02370A047E.dat
│ ...
- 71
5
votes
1
answer
3k
views
Reverse engineering Android vendor system apps
I'm trying to reverse engineer certain Samsung system apps in the Galaxy S6 firmware system image, such as KnoxAttestationAgent.apk. I'm a noob when it comes to reverse engineering, and so far my ...
- 359
5
votes
4
answers
212
views
What information may supply the uninitialized data to security team?
When I was reversing some well known Android chat applications (I can not disclose which specific ones, but all of them where owned by companies with 1 billion+ capital and have hundreds of millions ...
- 395
5
votes
0
answers
7k
views
Unpack, modify and rebuild an Android App Bundles (.aab) file
I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file.
Basically, I am looking for an apktool for .aab
- 175
5
votes
0
answers
645
views
Reverse engineering an hydrometer's Bluetooth communication
This is a very specific question.
I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
- 135
4
votes
4
answers
22k
views
print [B byte array in frida js script
I'm learning frida and trying to hook a function that looks like:
`.method public final fn()[B`
It returns a byte array. Here's my code:
Java.perform(function () {
var test = Java.use("com...");...
- 197
4
votes
2
answers
1k
views
How to encode file
I am trying to decrypt a lua file which has been encrypting using a key. Some background to the lua file. Its from an android I decompiled the APK and found that all the lua files are encrypted.
- 41
4
votes
1
answer
2k
views
How Do I get proficient at Reverse engineering?
Please bear with me as I explain this situation.
Maybe 10 days ago I took up the challenge of reverse engineering an Android app. Learning from scratch, I installed ADB, Apktool, Android Studio, ...
- 195
4
votes
3
answers
18k
views
Decompile ARM native binary - IDA Pro detects file as Shared Object
I am trying to decompile a Android ARM native binary using Hex-Rays IDA Pro. IDA detects the possible formats as
ELF for ARM (Shared object)
Binary file
If I choose ELF for ARM (Shared object), ...
- 141
4
votes
1
answer
3k
views
Extract a secret from an Android apk or .so file
Context
As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
- 141
4
votes
1
answer
120
views
What does a C++ identifier ending in $_## mean?
In trying to understand a .so from an Android game made with Cocos2d-x, I've come across identifiers like the following (after demangling):
SceneActionMap::updateTalkMode(float)::$_37
SceneActionMap::...
- 73
4
votes
1
answer
3k
views
Disable ASLR on android 4.0.3
I would like that a shared library is always loaded at the same address on Android 4.0.3.
I can't seem to disable the ASLR using:
echo 0 > /proc/sys/kernel/randomize_va_space
Running
cat /proc/...
4
votes
1
answer
5k
views
Android application fuzzing
How to do fuzzing in Android applications? Do we have any fuzzer specific to the android?
Actually, I am looking for an easy way to do fuzzing while performing penetration testing of android ...
- 121
4
votes
2
answers
1k
views
Dalvik dex file version 036
I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem.
But ...
- 141
4
votes
2
answers
2k
views
Flashing firmware on an embedded device
Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge)
I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing ...
- 41