Questions tagged [android]
Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.
390
questions
0
votes
1
answer
118
views
Malware application in Android
Is there some website that give us the possibility to download malware APK in order to study it? I’m interested to study the abuse of android.permission.RECORD_AUDIO in Android 8.
- 37
1
vote
0
answers
28
views
What skills are need to find ways of take root of Phones?
I am very interested in about take root of Android phones and I'm noob of reverse engineering.
I have some of old Android devices that already unused. Some Android devices provide easier path to root ...
- 141
1
vote
1
answer
167
views
How to set a breakpoint in android's openssl library in running android application?
I'm debugging an obfuscated android application. I use Android Studio's debugger. I attach it remotely to my physical device via adb. I can set a breakpoint in the app smali code, but when I try to ...
- 113
0
votes
1
answer
1k
views
ghidra returning wrong function address
I am reverse engineering a android app shared library (.so file) and I am trying to use frida to hook a non exported native function
I am using this hook
const ghidraImageBase = 0x00100000;
const ...
- 71
4
votes
2
answers
1k
views
How to encode file
I am trying to decrypt a lua file which has been encrypting using a key. Some background to the lua file. Its from an android I decompiled the APK and found that all the lua files are encrypted.
- 41
1
vote
0
answers
55
views
Is there any Android application that can manipulate the http response?
Is there any android app to manipulate http response body without vpn?
for example:
from
"0|{random_string}|Wrong"
Becomes
"1|{random_string}|True"
Thanks in advance
- 11
0
votes
1
answer
287
views
Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header
I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum.
file output:
libTheArmKing.so: ELF ...
- 249
1
vote
0
answers
32
views
IDA debug function spawned by pthread_once
I am using IDA to debug android, some libs use pthread_once/pthread_create function to call a function. How do I use/set up IDA to debug the function passed to pthread_once ?
- 59
0
votes
1
answer
1k
views
frida returning wrong overload of android method
im trying to hook the C6494a method has 2 parameters the ge6 object and a activity object whenever i try to hook this method with a hook overload that contains both ge6 and the activity object frida ...
- 71
3
votes
0
answers
491
views
Intercept android app DNS lookup with Frida
I have been attempting to intercept when an app performs a DNS lookup using Frida. I assumed that ultimately a DNS lookup will end up in a libc call to gethostbyname or getaddrinfo but this does not ...
- 255
1
vote
0
answers
220
views
Inject script into Dex-Protected app
I've seen scripts like :
https://github.com/hluwa/frida-dexdump
https://github.com/apkunpacker/DexDumper
that can extract the Dex files but what I want is to inject into running app and identified ...
- 277
2
votes
0
answers
297
views
Where can I find the encryption algorithm for this POST request in an Android APP?
I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
- 29
4
votes
0
answers
832
views
Understand a function within Hermes byte code
The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode.
I was able to disassemble the binary file ...
3
votes
1
answer
281
views
Compress Xamarin assemblies after decompression
I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies.
Is there anyway I can compress them again into assemblies.blob file or at least ...
- 31
1
vote
1
answer
141
views
Gdb hardware watchpoint error on android
After failing to find a solution to this I have started using Gdb and have encountered another error.
Gdbfails to set hardware watchpoint when I'm remote debugging a rooted arm7-a target. It supports ...
- 164
2
votes
1
answer
1k
views
LLDB debugging on android?
I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
- 164
1
vote
1
answer
1k
views
Modify, unpack, and rebuild an Android App Bundles (.aab) file
My developer has not provided me the source code backup for my listed app in Google Play (his PC was stolen and all codes are gone with it). I logged on to my Play Store developer's account and found ...
- 13
0
votes
0
answers
209
views
How can i inject xamarin smali code into another apk?
I tried to make a simple foreground service android application using xamarin... then decompile and inject it into another apk...but it always crashes.
here is adb logcat :
05-31 23:57:34.158 7680 ...
- 11
1
vote
1
answer
1k
views
Where can I find the encryption algorithm in source code?
When I submit a Customer Reference ID in an Android Application it POSTs an encrypted string to an API endpoint.
For example, if I enter the following CR ID :
"SR-54585482"
it POSTs the ...
- 13
3
votes
0
answers
1k
views
Frida class constructor hook not called while there do exist instances of the class
I have an (obfuscated) app with a certain class from which I would like to hook the constructor. The class has only 1 constructor defined and so I hooked the class as follows:
var Aclass = Java.use('...
- 61
1
vote
1
answer
219
views
No main activity when static analysis
Though mainifest.xml, I know main activity is: com.trust.rookie.MainActivity. But when I load the file in jadx, I can't see that class. Why? And how the program can run?
- 67
2
votes
2
answers
337
views
Capturing ADB commands sent by a Windows program to a phone
I would like to see, what ADB commands a Windows program is sending to my Android phone, to see how its functions operate.
- 29
3
votes
1
answer
451
views
Bypassing certificate transparency with Frida
As part of some school research I'm experimenting with Frida to see what can be done to bypass SSLpinning.
As I was hooking some methods of an application that throw SSLPeerUnverifiedException I ...
- 61
1
vote
1
answer
134
views
ARM/THUMB assembly mismatch between binaries causes crash
I am trying to play around with an app for Android and every time I try to call a function (lua_gettop() from the Lua 5.1 library) from the app's address space, it hits me with ILL_ILLOPC.
I made sure ...
- 11
0
votes
1
answer
294
views
How do I gain access to files that an Android app stores in its persistent internal storage directory?
I was playing a game that had hidden achievements and wanted to find the conditions necessary to unlock these achievements. To do this, I've tried to get the source code of the game, to find the ...
- 1
2
votes
0
answers
103
views
How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?
I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth.
I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
- 21
2
votes
1
answer
2k
views
Debug shared library in Android application
There is an Android application that has a shared library (.so) file in split_config.arm64_v8a.apk that I want to debug .
When I look at /proc/PID/maps I don't see that library (I do see the ...
- 23
0
votes
1
answer
845
views
android index.android.bundle file
I downloaded an app from Raccoon.
I got these files:
com.company.name-3423.apk
config.ar-3423.apk
config.armeabi_v7a-3423.apk
config.en-3423.apk
config.iw-3423.apk
config.ru-3423.apk
config.xhdpi-3423....
- 101
1
vote
0
answers
133
views
Video Packets via UDP - How to decode or identify video format?
I'm working with a cheap wireless video transmitter and receiver system that uses an Android App to receive the video over WiFi.
We want to be able to identify where the stream is coming from to be ...
- 11
1
vote
0
answers
225
views
Bypassing unsupported android TV box!
I have an android TV box called Proximus decoder v4, anyway the android TV box is not supported anymore by the company. When I turn it on I get an update checking, you can't even cancel it, and then I ...
0
votes
0
answers
58
views
How to reverse android native libraries? Best resources? [duplicate]
I want to improve myself in Android penetration testing. For this task i need to learn reversing the native libraries of an APK file to detect vulnerabilities. What is the best way and resources for ...
- 1
0
votes
2
answers
83
views
why does dalvik remove invocations during optimisation?
This is original smali code of a classes.dex method before installation
.method public static createAutoMatchCriteria(IIJ)Landroid/os/Bundle;
.registers 6
new-instance v0, Landroid/os/Bundle;
...
- 164
0
votes
1
answer
383
views
What does this function do?
I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
- 1
2
votes
1
answer
450
views
Debugging Native Lib using IDA Pro Fails to Load Registers and other Information
Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
- 121
0
votes
0
answers
275
views
Modify framework.dex which is in boot.oat?
I pulled down boot.oat from an API22 Android phone. It's Android 5.1 Lollipop which brought the change from Dalvik to ART and is a bit mistified.
As far as I understand, modifying boot.oat is not easy,...
- 101
1
vote
0
answers
283
views
Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point
Here's the problem:
I set a breakpoint in IDA debugger
the program stop at the breakpoint
deactivated the breakpoint
IDA keep receiving SIGTRAP or SIGSEGV
( program stop at breakpoint as expected ) :...
- 131
3
votes
1
answer
2k
views
Can I find usages of this string in my .so file? ARM
My apologies if this question is very basic. I have found this string in my Android application Binary that was built using the flutter framework. This is a 32 bit ARM library. I found the location of ...
- 131
1
vote
2
answers
614
views
Why IDA debugger on android doesn't show all threads?
My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file.
Here's what I've done:
download a x86_64 system image android emulator from android studio
install that .apk ...
- 131
1
vote
1
answer
455
views
How do I get adb to work on a Rockchip RK3288 based android device running Lollipop 5.1.1?
Lollipop 5.1.1 based device. OLD ES File Manager installed. (Yes, the exploitable one). I can copy to/from the device. I tried Kingo Root, Root Genius, Towel root, etc. None of those work. "...
- 56
0
votes
0
answers
210
views
Checksum verification of an apk does not the same as my java program
I'm from the sysadmin side of the IT and have not much experience in programing.
I have an app that lets me screen share Android apps on my car's display.
Sadly there is a whitelist baked into the app,...
1
vote
0
answers
119
views
Is this native code possible for further static analysis?
I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function ...
- 309
-1
votes
1
answer
158
views
what do these assembly code doing?
I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this
public static String v = sUQWWyTBEs().toString().substring(32,...
- 309
2
votes
0
answers
107
views
Cant hook into native lib with script?
im doing some practice stuff about hooking android native lib. I wrote this script:
function processJniOnLoad(libraryName) {
const funcSym = "...
- 67
1
vote
1
answer
1k
views
Remote debugging android native lib(.so) No connection could be made because the target machine actively refused it. when connecting to
I have a running IDA debug-server on my virtual android device(check attachments).
The problem is: when I try hit Attach procces it gives me an error(check title).
Here is some kinda params that I'm ...
1
vote
1
answer
105
views
How to repack the monobundleapp
I recently had to make a version of a survivalcraft 2 mod that allowed circuits to run faster
I found this script by stack overflow to unpack a mono bundle app
I already modified the .dll, but I need ...
1
vote
1
answer
158
views
analyze how data is read in android usb device
I've a huawei envizion 360, which doesn't provide any API for other application. But I want to read raw data from this device, to an android or to a raspberry-pi for debugging and development purpose. ...
- 111
2
votes
0
answers
440
views
reversing a grpc call
im reversing a android app and i managed to intercept a grpc request and decode it using protoc but i cant seem to make sense of any of the data, i know its compressed using gzip because of the ...
- 71
2
votes
1
answer
2k
views
How to extract the kernel assembly code from a zImage?
here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to ...
- 31
0
votes
0
answers
5k
views
How to decompile a unity apk to a project?
I have tried to decompile a variety of APK's built with unity, but the tools i have used (uTinyRipper, iLSpy, some others) give me some files which give me errors and incomplete code/assets. I see ...
- 13
0
votes
0
answers
78
views
SSL pinning deep problem
I'm working on one Android app for potential malware analysis and I am trying to MITM it. I found out that the verify function never executes (X509 class) when i hook onto my proxy but rather that app ...
- 11