Questions tagged [android]

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

Filter by
Sorted by
Tagged with
0
votes
0answers
94 views

Android - capture screen with the lowest latency via android native code

I'm trying to catch small fragment of screen during working some Android app which I'm currently reversing. I've tried screencap with various calls but minimum latency which I was able to achieve was ...
0
votes
1answer
60 views

Understanding how a WiFi camera app goes from packet data to video stream

I have a WiFi webcam that I'm trying to get to stream to my computer. I'm able to get the camera to send data to my computer, but I don't know how to decode it. The data consists of 11 1450 byte ...
0
votes
0answers
65 views

Reverse an encryption algorithem in APK .so file

I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have ...
1
vote
0answers
170 views

Is it possible to work around SQLcipher by modifying libsqlcipher.so?

I was trying to extract data from an Android app which uses SQLcipher. SQLcipher is an extension of SQLite that encrypts database files with 256-bit AES. Within the APK, the library lies in lib/...
0
votes
1answer
55 views

Any ways to combine Android APK with Expansion pack file?

I want to have only one APK that contains all files and resources without having to download expansion pack every time. Is there any way to combine Android APK with Expansion pack file? My expansion ...
1
vote
1answer
501 views

Decode lua scripts for cocos2d based game / frida, android

I'm trying to decrypt LUA scripts from cocos2dx game (for wiki). In most cases, it's XXTEA based, but not in this case. The game itself: https://apkpure.com/might-magic-era-of-chaos/com.ubisoft.might....
0
votes
0answers
93 views

capture traffic of an android app

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
0
votes
1answer
133 views

Can't CVE-2019-2215 on Android: "Unable to handle kernel paging request at virtual address"

I'm playing with Android and I'm trying to gain r/w access to the whole memory using CVE-2019-2215. Long story short, you UAF a binder_thread object and you can read from/write to kernel space. The ...
1
vote
0answers
102 views

Frida not able to trace sub_XXXXX which must have been called

I have the following pseudocode generated by IDA Pro decompiler: __int64 *__usercall sub_155B5@<X0>(__int64 *a1@<X0>, unsigned int a2@<W1>, char **a3@<X8>) { ... result = ...
2
votes
1answer
354 views

hooking libhoudini on x86 emulator

I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved! I'm using a x86 emulator to run arm ...
1
vote
0answers
374 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
2
votes
1answer
160 views

Getting android app from device for reversing - what if there are multiple apks?

For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the ...
0
votes
1answer
50 views

Call of a suspicious method cannot be found

i have a strange apk which I took a closer look at, among others with jadx-gui. It is a gaming app that requires an unusual amount of permissions according to the manifest file. I installed and played ...
-2
votes
1answer
166 views

How to reverse engineer apks? [closed]

is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
1
vote
1answer
304 views

Calling a method of a Java object passed as argument to hooked function in Frida

I am trying to obtain the SecretKey passed to the decryptAesCipherText function. I hooked the function in Frida to try to print out the arguments when the method is called but since SecretKey is an ...
3
votes
1answer
206 views

Modifying (adding new logic) decompiled apk to log different kind of data causing problems (crash/bluetooth connection)

I have separately decompiled apk to smali/dalvik and to java classes. As apk is not obfuscated java code is pretty good to read and I can pretty easily see corresponding smali code. So far I was able ...
2
votes
1answer
470 views

how to decompile or unite multipart dex class in an android apk file?

Some Android Apks contain multiple classes.dex files which are numbered like this: classes1.dex, classes2.dex ... and when i try to decompile them it would result into multiple source codes. Is there ...
2
votes
1answer
302 views

IDA Pro: How to change segment register value

For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
1
vote
1answer
66 views

methods that have zero usage in jadx?

so i've been reversing this ai assistant app to figure out what kind of forensic data it leaves on local file system. during static analysis with jadx-gui i found some interesting methods that take ...
0
votes
1answer
323 views

Android packageInfo signature

Are there anyways I can learn what packageInfo.signatures[0] is so I can use it to apply the same algorithm in Python. To further explain: private static SecretKeySpec a(Context context) { ...
-1
votes
1answer
96 views

App from playstore runs but the same apk crashes on sideload install

On my nougat device, I have downloaded an app from the playstore, which is running great. I then extract the apk from the installed app, and uninstall it and again successfully, with package installer....
0
votes
1answer
419 views

Read bytearray from retval on onLeave event

I'm trying to get the return value of a android native function call using Frida but with no success: Interceptor.attach(Module.getExportByName('lib.so', 'Token'), { onEnter: function(args) { ...
0
votes
1answer
44 views

how to replace the result from a json request into a variable [closed]

I would like to return in v0 the following answer "FR" instead of the country retrieved from Json .method public getCountryCode()Ljava/lang/String; .registers 2 .line 11 iget-object v0, p0, ...
-2
votes
1answer
2k views

Change androidmanifest.xml file within apk

I am able to unpack an android apk file with apktool, but when I am repacking the apk file using apktool, it just crashes with errors, and ibotpeaches seems not patching those errors for years. Now ...
1
vote
1answer
212 views

Charles TLS Proxy for Android device with root access

I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am ...
1
vote
0answers
62 views

Trying to replicate encryption of an android app

I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
2
votes
1answer
214 views

Invalid file path error while trying to rebuild with apktool and aapt2

I am facing an error while try to repack an apk with apkool. below is the error trace. W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'. W: error: invalid file ...
2
votes
4answers
1k views

Endoscope Camera YPC99 - how to stream on linux

I'm trying to stream video from endoscope camera YPC99 on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports RTSP protocol on port 7070 (...
3
votes
1answer
233 views

How can I retrieve the encryption key in this code?

can anyone explain the following code? is it possible to retrieve the encryption key? I think the code was heavily obfuscated in addition to obfuscation, I can recognize it is using algorithms like ...
1
vote
1answer
355 views

Unable to intercept traffic of an android app even after patching ssl pinning

Recently, I was trying to test an app developed on Rhomobile, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but ...
-1
votes
1answer
36 views

How do I know which class/file in apk is being used for what purpose?

I am new to this sort of stuff. I just found hardcoded public and private keys in an android app. I just can't figure out what it is being used for. Any advice on that?
2
votes
1answer
254 views

Proper way of implementing DexGuard RASP device checks

I recently came across an app that is protected with DexGuard. DexGuard claims to offer Runtime Application Self Protection (RASP), which comprises of app obfuscation and various runtime tampering ...
2
votes
1answer
63 views

What code gets executed in an ELF binary when Java loadLibrary() is called

I’ve been working on reverse engineering this android x86 ELF binary. According to my research when loadLibrary() is called the function JNI_onLoad is supposed to be executed however this binary doesn’...
1
vote
0answers
98 views

JEB Decompiler - Signature recognition engine

I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
1
vote
0answers
321 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
1
vote
1answer
64 views

Android dynamic UI state inspection/profiling tool

I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector. Is ...
1
vote
0answers
332 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
0
votes
0answers
286 views

Using IDA pro 7.2 and android server breakpoints problem

i have been trying to use IDA to make a breakpoints on a 4 byte memory address to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support ...
0
votes
0answers
74 views

How to change the manufacturer property in the Android emulator?

I already asked this question on StackOverflow, but it is not getting attention; maybe here is a better place I am running the Android emulator that comes with the Android Studio software. I created ...
1
vote
1answer
1k views

Adding my own logging function in Smali

I am trying to logcat the parameters of a function in smali with my own function. I made a new Android studio project and wrote the function then used APKtool to retrieve the Smali file. This is my ...
1
vote
0answers
2k views

Using Frida for early and late instrumentation

I am trying to hook functions with Frida where one .so file (x.so) is loaded early and another .so file (z.so) is loaded slightly later, after some processing is done by the application. This is what ...
0
votes
2answers
111 views

Load Library Android

I Work as cybersecurity consultant and now i'am in mission to reverse engineering of mobile app. I always reverse it using Jadx and dex2jar ... the problem that after reverse them i found some native ...
0
votes
1answer
716 views

How to reverse engineering a proguarded .apk? [closed]

Lets say you have android1.apk file coded with proguard enable. I want to reverse engineer it in such a way that it shows the original methods names instead letters of alphabets, example bellow ...
0
votes
1answer
371 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
1
vote
1answer
283 views

How to use x64-86 elf file from an apk file in a linux machine?

I'm building a jar file that use jni to load an x86-64 elf extracted from Android apk file. But when I run my app, it throw this exception: Caused by: java.lang.UnsatisfiedLinkError: /lib/x86_64-...
1
vote
0answers
139 views

Strange behaviour debugging Android ARM binary with gdbserver

I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
2
votes
0answers
139 views

Google Maps, Android serialisation format

I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example: I'm saying serialised, as from the ...
0
votes
1answer
508 views

LOG Urls that APK requests using smali

I have an APK that uses pinning. I am having an unbelievable time trying to remove the SSL pinning so i figure it might be easier to modify the smali files and recompile to log the LoadURL events. ...
1
vote
1answer
165 views

How to figure out which button I'm pressing

I'm working on an app, that I'm trying to get to work on a android device that has additional buttons. The device is called a BH95, from BATL. It has 4 side buttons(1 volume up, 1 power button, 2 ...
3
votes
1answer
124 views

What binary value does Thread and Process ID Register contains in Android ARM?

I have following instructions in Android shared library: MRC p15, 0, R3,c13,c0, 3 LDR R3, [R3,#4] MOV R0, #0 STR R0, [R3,#0xC] According to ARM documentation: Reading or writing the Thread and ...

1
2
3 4 5
7