Questions tagged [android]
Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.
370
questions
0
votes
0
answers
168
views
Android - capture screen with the lowest latency via android native code
I'm trying to catch small fragment of screen during working some Android app which I'm currently reversing. I've tried screencap with various calls but minimum latency which I was able to achieve was ...
- 111
0
votes
1
answer
145
views
Understanding how a WiFi camera app goes from packet data to video stream
I have a WiFi webcam that I'm trying to get to stream to my computer. I'm able to get the camera to send data to my computer, but I don't know how to decode it. The data consists of 11 1450 byte ...
- 11
0
votes
0
answers
117
views
Reverse an encryption algorithem in APK .so file
I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have ...
- 117
1
vote
0
answers
245
views
Is it possible to work around SQLcipher by modifying libsqlcipher.so?
I was trying to extract data from an Android app which uses SQLcipher. SQLcipher is an extension of SQLite that encrypts database files with 256-bit AES.
Within the APK, the library lies in lib/...
- 11
2
votes
1
answer
127
views
Any ways to combine Android APK with Expansion pack file?
I want to have only one APK that contains all files and resources without having to download expansion pack every time.
Is there any way to combine Android APK with Expansion pack file?
My expansion ...
- 619
2
votes
2
answers
1k
views
Decode lua scripts for cocos2d based game / frida, android
I'm trying to decrypt LUA scripts from cocos2dx game (for wiki).
In most cases, it's XXTEA based, but not in this case.
The game itself:
https://apkpure.com/might-magic-era-of-chaos/com.ubisoft.might....
- 51
0
votes
0
answers
194
views
capture traffic of an android app
I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
- 219
0
votes
1
answer
219
views
Can't CVE-2019-2215 on Android: "Unable to handle kernel paging request at virtual address"
I'm playing with Android and I'm trying to gain r/w access to the whole memory using CVE-2019-2215. Long story short, you UAF a binder_thread object and you can read from/write to kernel space.
The ...
- 11
1
vote
0
answers
253
views
Frida not able to trace sub_XXXXX which must have been called
I have the following pseudocode generated by IDA Pro decompiler:
__int64 *__usercall sub_155B5@<X0>(__int64 *a1@<X0>, unsigned int a2@<W1>, char **a3@<X8>)
{
...
result = ...
- 111
2
votes
1
answer
615
views
hooking libhoudini on x86 emulator
I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved!
I'm using a x86 emulator to run arm ...
- 73
1
vote
0
answers
800
views
Instruction trace using frida in android emulator
i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
- 73
2
votes
1
answer
285
views
Getting android app from device for reversing - what if there are multiple apks?
For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the ...
- 444
0
votes
1
answer
58
views
Call of a suspicious method cannot be found
i have a strange apk which I took a closer look at, among others with jadx-gui. It is a gaming app that requires an unusual amount of permissions according to the manifest file. I installed and played ...
- 21
-2
votes
1
answer
217
views
How to reverse engineer apks? [closed]
is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
- 219
1
vote
1
answer
737
views
Calling a method of a Java object passed as argument to hooked function in Frida
I am trying to obtain the SecretKey passed to the decryptAesCipherText function. I hooked the function in Frida to try to print out the arguments when the method is called but since SecretKey is an ...
- 11
3
votes
1
answer
446
views
Modifying (adding new logic) decompiled apk to log different kind of data causing problems (crash/bluetooth connection)
I have separately decompiled apk to smali/dalvik and to java classes. As apk is not obfuscated java code is pretty good to read and I can pretty easily see corresponding smali code.
So far I was able ...
- 33
3
votes
1
answer
1k
views
how to decompile or unite multipart dex class in an android apk file?
Some Android Apks contain multiple classes.dex files which are numbered like this: classes1.dex, classes2.dex ... and when i try to decompile them it would result into multiple source codes. Is there ...
- 131
2
votes
1
answer
773
views
IDA Pro: How to change segment register value
For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
- 21
1
vote
1
answer
179
views
methods that have zero usage in jadx?
so i've been reversing this ai assistant app to figure out what kind of forensic data it leaves on local file system. during static analysis with jadx-gui i found some interesting methods that take ...
- 11
0
votes
1
answer
534
views
Android packageInfo signature
Are there anyways I can learn what packageInfo.signatures[0] is so I can use it to apply the same algorithm in Python.
To further explain:
private static SecretKeySpec a(Context context) {
...
-1
votes
1
answer
140
views
App from playstore runs but the same apk crashes on sideload install
On my nougat device, I have downloaded an app from the playstore, which is running great. I then extract the apk from the installed app, and uninstall it and again successfully, with package installer....
0
votes
1
answer
1k
views
Read bytearray from retval on onLeave event
I'm trying to get the return value of a android native function call using Frida but with no success:
Interceptor.attach(Module.getExportByName('lib.so', 'Token'), {
onEnter: function(args) {
...
- 101
0
votes
1
answer
44
views
how to replace the result from a json request into a variable [closed]
I would like to return in v0 the following answer "FR" instead of the country retrieved from Json
.method public getCountryCode()Ljava/lang/String;
.registers 2
.line 11
iget-object v0, p0, ...
-2
votes
1
answer
3k
views
Change androidmanifest.xml file within apk
I am able to unpack an android apk file with apktool, but when I am repacking the apk file using apktool, it just crashes with errors, and ibotpeaches seems not patching those errors for years. Now ...
- 219
1
vote
1
answer
354
views
Charles TLS Proxy for Android device with root access
I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am ...
- 161
2
votes
0
answers
85
views
Trying to replicate encryption of an android app
I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
- 219
2
votes
1
answer
402
views
Invalid file path error while trying to rebuild with apktool and aapt2
I am facing an error while try to repack an apk with apkool. below is the error trace.
W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'.
W: error: invalid file ...
- 219
2
votes
4
answers
3k
views
Endoscope Camera YPC99 - how to stream on linux
I'm trying to stream video from endoscope camera YPC99 on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports RTSP protocol on port 7070 (...
- 121
3
votes
1
answer
408
views
How can I retrieve the encryption key in this code?
can anyone explain the following code? is it possible to retrieve the encryption key?
I think the code was heavily obfuscated in addition to obfuscation, I can recognize it is using algorithms like ...
- 219
1
vote
1
answer
597
views
Unable to intercept traffic of an android app even after patching ssl pinning
Recently, I was trying to test an app developed on Rhomobile, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but ...
- 219
-1
votes
1
answer
64
views
How do I know which class/file in apk is being used for what purpose?
I am new to this sort of stuff. I just found hardcoded public and private keys in an android app. I just can't figure out what it is being used for. Any advice on that?
3
votes
1
answer
585
views
Proper way of implementing DexGuard RASP device checks
I recently came across an app that is protected with DexGuard. DexGuard claims to offer Runtime Application Self Protection (RASP), which comprises of app obfuscation and various runtime tampering ...
- 359
2
votes
1
answer
116
views
What code gets executed in an ELF binary when Java loadLibrary() is called
I’ve been working on reverse engineering this android x86 ELF binary. According to my research when loadLibrary() is called the function JNI_onLoad is supposed to be executed however this binary doesn’...
- 21
1
vote
0
answers
150
views
JEB Decompiler - Signature recognition engine
I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
- 257
2
votes
0
answers
470
views
What is the header 'X-Goog-Spatula'?
I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
- 21
1
vote
1
answer
100
views
Android dynamic UI state inspection/profiling tool
I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector.
Is ...
- 121
1
vote
0
answers
611
views
Some obstacles in reversing a JNI Native library
I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer
...
- 11
0
votes
0
answers
407
views
Using IDA pro 7.2 and android server breakpoints problem
i have been trying to use IDA to make a breakpoints on a 4 byte memory address
to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support ...
- 1
0
votes
0
answers
207
views
How to change the manufacturer property in the Android emulator?
I already asked this question on StackOverflow, but it is not getting attention; maybe here is a better place
I am running the Android emulator that comes with the Android Studio software. I created ...
1
vote
1
answer
2k
views
Adding my own logging function in Smali
I am trying to logcat the parameters of a function in smali with my own function. I made a new Android studio project and wrote the function then used APKtool to retrieve the Smali file.
This is my ...
- 11
2
votes
0
answers
3k
views
Using Frida for early and late instrumentation
I am trying to hook functions with Frida where one .so file (x.so) is loaded early and another .so file (z.so) is loaded slightly later, after some processing is done by the application.
This is what ...
- 163
1
vote
2
answers
207
views
Load Library Android
I work as cybersecurity consultant, and now I am on mission to reverse engineering of mobile app.
I always reverse it using Jadx and dex2jar... the problem that after reverse them I found some native ...
1
vote
1
answer
1k
views
How to reverse engineering a proguarded .apk? [closed]
Lets say you have android1.apk file coded with proguard enable.
I want to reverse engineer it in such a way that it shows the original methods names instead letters of alphabets, example bellow
...
0
votes
1
answer
1k
views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
2
votes
1
answer
410
views
How to use x64-86 elf file from an apk file in a linux machine?
I'm building a jar file that use jni to load an x86-64 elf extracted from Android apk file. But when I run my app, it throw this exception:
Caused by: java.lang.UnsatisfiedLinkError: /lib/x86_64-...
- 121
1
vote
0
answers
221
views
Strange behaviour debugging Android ARM binary with gdbserver
I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
- 133
2
votes
0
answers
238
views
Google Maps, Android serialisation format
I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example:
I'm saying serialised, as from the ...
- 121
0
votes
1
answer
867
views
LOG Urls that APK requests using smali
I have an APK that uses pinning. I am having an unbelievable time trying to remove the SSL pinning so i figure it might be easier to modify the smali files and recompile to log the LoadURL events.
...
- 1
1
vote
1
answer
219
views
How to figure out which button I'm pressing
I'm working on an app, that I'm trying to get to work on a android device that has additional buttons.
The device is called a BH95, from BATL. It has 4 side buttons(1 volume up, 1 power button, 2 ...
- 121
3
votes
1
answer
163
views
What binary value does Thread and Process ID Register contains in Android ARM?
I have following instructions in Android shared library:
MRC p15, 0, R3,c13,c0, 3
LDR R3, [R3,#4]
MOV R0, #0
STR R0, [R3,#0xC]
According to ARM documentation:
Reading or writing the Thread and ...
- 375
Hot Network Questions
- How did my CO detector know it had reached EOL?
- Did Sweden experience lower all-cause mortality during the pandemic?
- Could a supernova powered starship work/survive?
- I found a security vulnerability in our code. How do I present it in our sprint review?
- Is it a Frog List?
- Should the y-axis on a survival plot go from 0 to 100 even if the lines are all above 0.9?
- Spokes damaged by chain – should they be replaced?
- How am I supposed to parse the "...she might have passed over more..." line in "Emma"?
- Word for "separating a group of similar-but-not-the-same things into categories"?
- Is there a term that describes reducing a person's identity to certain characteristics?
- Lego 88012 hub socket type
- How to give exercises when students can use ChatGPT
- Why are there no single logic gates in through-hole packages?
- Do the Ohio sheriffs suing Afroman have any legal standing in their claim of "invasion of privacy and misappropriation of their likenesses" lawsuit?
- What does "unsearchable" mean in "the unsearchable riches of Christ". Ephesians 3:8?
- Why is the US under Biden so strongly supporting Ukraine in the war?
- Is a company liable if someone leaves their bank logged in on a company pc?
- Binary adder implemented in Rust
- What are the consequences of using 1 meter in place of 5 feet?
- expressing as a polynomial
- Alternate to if:false in LWC
- How to open a PDF file with "Master PDF Editor" application from terminal?
- Does the idiom "step on a rake" mean making the same mistake twice?
- Doesn't Windows Sandbox require Hyper-V to run? How is it working with Hyper-V not enabeld?