Questions tagged [android]

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

Filter by
Sorted by
Tagged with
1
vote
2answers
2k views

Opening non-standard PNG files extracted from Android app - missing signature and IHDR chunk

I am unable to open PNG files extracted from a certain Android app. I can't open them with the stock Android Gallery app. I can't open them in image browsers after downloading them on my computer. ...
2
votes
1answer
416 views

Dolphin Emulator Android port modifications

I am modifying the Dolphin Emulator Alpha for android, but I'm having some trouble with a string in it's smali code. The value I am having trouble with is dolphin-emu, it is the name of the folder ...
1
vote
1answer
403 views

How do I decompress a .astc file with an additional .ccz extension? How do I view .lta files?

This is crossposted from reg. stack overflow. I was referred here. This will have more updates, however. First, full disclosure: I'm very new to coding and very new to file dissecting, but its ...
1
vote
0answers
258 views

Android debug server protocol version mismatch

I am trying to debug an arm64 binary in /data/local/tmp of my Android phone. I pushed the /dbgsrv/android_server64 to /data/local/tmp and then adb to the phone: $ chmod 777 ./android_server64 $ ./...
1
vote
1answer
105 views

Android Intercepts for log the Funtion Calls to javax

Im reversing an apk that uses a native library .so to make calls to some Java methods thru reflexion I know by analysing the app that exist the followings calls: import javax.crypto.Mac; import ...
1
vote
1answer
2k views

How to combine 2 dex files into a single dex file for more complete disassembly by IDA Pro

Most apk files, when disassembled, produces 2 dex files instead of one. However since IDA Pro only allows the loading of one dex file at a time,it may result in missing information as a result of the ...
0
votes
1answer
63 views

Need help understanding “garbage” data in https request

I managed to overcome certificate pinning in an android application and I am now able to view all the HTTPS request in plain text. However, I came across this request that I still do not understand: ...
3
votes
1answer
1k views

How to detect JNI calls from smali code?

In Android, JNI calls could be used to load native code from other sources. From the link http://bobao.360.cn/learning/detail/3765.html, the following sample code shows how a smali code would look ...
1
vote
2answers
10k views

Sniffing https traffic of an android app

I want to do a challenge: automise some tasks that I do in a game so I can get the max of points. To do that, I need to know the url called and the parameters that are used in the Game. After setting ...
2
votes
3answers
2k views

Can apk files have protection against being debugged?

As part of a bug bounty program, I am trying to reverse engineer the bumble android mobile application via dynamic analysis. I find that if I use apktool to disassemble the apk and reassemble it again ...
0
votes
3answers
2k views

Is it possible to call function in dynamic link library(.so) generated by Android JNI project?

I unzipped an apk file and got one libxx.so file. I find that there are some "exported"(but I guess the "fun" function is not exported by the original programer) functions in this ...
1
vote
1answer
712 views

Reverse engineer the update-binary file in Android recovery update packages

I am trying to understand how to disassemble or at least get a readable copy of the update-binary file located in /META-INF/com/google/android/. It is a modified version for a smartwatch, which ...
1
vote
2answers
445 views

Smali vs Decompilation for malware detection in apk files

When it comes to reversing apk files, I understand that are mainly 2 approaches. The first involves using a decompilation engine which will try to produce java files which are more readable but can be ...
8
votes
2answers
1k views

Is there a name for this kind of “obfuscation” for the machine code from C++?

I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
1
vote
0answers
285 views

Accessing .rodata/.rel.data.ro

Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is ...
0
votes
1answer
130 views

Is it possible to Reverse Engineer digitially signed android game & then repack it

I am a noob in this field. I have reverse engineered an Android game to hack it but I can only install the game if it was not digitally signed. If the game is digitally signed, I am unable to install ...
2
votes
1answer
3k views

How do I Log a String Referenced within a Method - Smali

I have been trying to reverse engineer an Android application and was wondering how I would go about logging a certain string. Here is the method I am trying to log the String from: .method private ...
1
vote
0answers
182 views

Tools to support Android native code hacking?

I am learning android reverse engineering, and want to know tools to hack native code. gdb to remotely debug the code, but I find it can not ever hit a breakpoint. arminject is a choice, it works on ...
2
votes
0answers
168 views

Need help intercepting android application network traffic [closed]

On my OWN rooted phone, I have had xposed installed, justtrustme unpinning application, and tcpdump in an attempt to capture the traffic of specific applications that are on the phone. The specific ...
1
vote
1answer
4k views

Anti-tampering techniques in Android APK's

I'm reverse engineering an Android app, and it has some kind of anti-tamper protection. The problem is that I can't find it anywhere in the smali files. Even if I just re-sign the official APK that I ...
2
votes
1answer
1k views

How to find Xref to strings in proprietary binaries?

When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro. The image has ...
0
votes
2answers
648 views

How can I debug android native library with ida demo?

I am trying to debug android native library using ida demo version everything otherthing is working except some one I can't find android_server file for keeping on android device and can't see the ...
1
vote
2answers
677 views

Reverse engineer encrypted text file if I have both pre and post encryption files [closed]

As per the title, I have an encrypted text file that is generated by an Android app. I then have to send that off to the people whom made the app for them to decode it and send it back. Not ideal as ...
1
vote
1answer
704 views

Android Native Library - How to match java references to sub_XXX function (static way)

I'm currently learning how native functions are implemented among the ELF SO files contained inside an APK. I'm using IDA. Native calls are always achieved in this way. // First load the library ...
4
votes
2answers
806 views

Dalvik dex file version 036

I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem. But ...
0
votes
2answers
907 views

Android App's hardcoded local keystore password r3versing

Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password. I've decompiled it with JEB2 and obviously within ...
1
vote
2answers
3k views

Renaming entitites in obfuscated java bytecode

I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard. I'm just trying to reverse a few things it does. The classes, methods and variables ...
1
vote
1answer
2k views

Saving .so file with IDA

I edited a ".so" file (which extracted from an APK) with IDA Pro, and now I am trying to save it with the same format. But it seems that I cannot find it. Could you please explain to me step by step ...
-2
votes
1answer
1k views

How to sniff HTTPS traffic of Android apps that ignore the system proxy setting?

I saw a very similar question about this on macOS just 20hrs ago but I'm always needing to do this on Android and I keep forgetting the name of the app. So this is just for reference.
2
votes
1answer
4k views

Decompiling 64bit ARMv8 Android .so library

I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
1
vote
2answers
2k views

How to figure out which library a native JNI function is calling?

I'm trying to perform static analysis on Android framework code, and I'm coming across some Java methods that are calling JNI functions. How do I figure out which native libraries these functions ...
4
votes
2answers
1k views

Flashing firmware on an embedded device

Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge) I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing ...
1
vote
2answers
2k views

IDA Dalvik Debugger doesn't work with official Android emulator

I try to use IDA to debug application with official Android ARM emulator. I set up debugger, installed APK and run application, it starts, writes "waiting for debugger", and debugger writes that "...
0
votes
3answers
4k views

How to dump Android shared library from memory?

I have encrypted Android so library that decrypts itself on load. I want to get its unencrypted code. For me it looks good idea to dump that library from memory when application started. I used /proc/...
0
votes
1answer
163 views

why 'ni' goes into function in Android gdb debugging?

I'm debugging android JNI with gdb without source code. I use ni command to step over arm asm instructions. I suppose ni is step over, but it still goes into function like BL xxxx, and I have to use ...
0
votes
1answer
122 views

What do the unusually named packages and files usually mean?

When decompiling an apk with apktool, the classes.dex file is decompiled into folders smali_classes#, and sorted their respective packages. I recognize some of the files, as they are mentioned in ...
1
vote
1answer
1k views

gdb shows wrong instruction

I'm debugging android jni with gdb. There's a jni function A(), I need to set breakpoint there and step through. I calculated the address with module_base+offset, which is 0x99B62C7A, then I tried to ...
2
votes
1answer
594 views

Call Android method without running whole Android-App

I want to ask if somebody is aware of tools/projects which are similar to the Appcall feature of IDA Pro[1] for Android Apps? I'm looking for the possibility to run certain methods detected in the ...
4
votes
1answer
831 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
3
votes
1answer
169 views

How to find image base of an arbitrary boot-loader image?

I have picked up a rooted Acer phone and dd-ed the LK partition to analyze it in IDA. The goal is to pinpoint the routine processing fastboot commands. Stripping first 512 bytes produces apparently ...
2
votes
1answer
6k views

Frida manipulating arguments - Android

I've attempting to learn how to use Frida to instrument android app, just for person interest. So far I've managed to get my environment set up with a physical android tablet and I can successfully ...
3
votes
1answer
431 views

Android: How many ways for getting GPS location

I'm using XPosed for faking gps location. I have faked and tested successfully these two apis: FusedLocationApi from GoogleApiClient LocationManager including two methods: requestLocationUpdates and ...
2
votes
0answers
759 views

crash using ida 6.8 debugging on android 5.0

I need to debug .so of my.apk, I'm working on a phone with android 5.0, using ida 6.8's android_server. It seems ok for attaching ida to the process, but when clicking something on the apk there is ...
-1
votes
1answer
521 views

Reverse Engineering an APP With Frida [closed]

I am trying to reverse engineer an app but I am having problems unlike the previous apps that I reverse engineered..... When Untouched the app let's you login perfectly but when I reverse engineer it ...
2
votes
2answers
3k views

Sniffing traffic of Outlook android app

I have been trying to get the traffic of the Outlook email app for Android to show up in my Fiddler for months with no success. Although some traffic from the app does show in Fiddler, but not all. ...
1
vote
1answer
1k views

Reverse engineering camera blobs in Android [closed]

So I heard that bacon (OnePlus One) got the camera working on custom ROMs by reverse engineering the camera blobs. I tried reading online, but I didn't have a proper link for this matter. So the ...
1
vote
1answer
202 views

Certain classes do not show up in JDB while they are present in source code

I'm debugging a closed-source Android app with jdb. In the output produced by the apktool, I see class com.myapp.j.d.d, as well as a/b/c/e, but at run-time, I see only com.myapp.j.d.e. Why is that ...
1
vote
3answers
2k views

Capture traffic of android app on unknown port

I am using ProxyDroid to proxy everything to Charles Proxy. But by default Charles proxy (or any other similar programs like Fiddler, mitmproxy, etc..) only capture traffic on common ports such as 80, ...
0
votes
1answer
112 views

How does some application get through the block when mobile data plan is exceeded [closed]

I have a mobile data plan of 2 GBs. When I exceed it, I always get redirected to the network operator's website when I trying to load an URL. For some reason Telegram(Android app only, Desktop app ...
0
votes
1answer
1k views

Reversed APK crashes after install

I'm trying to reverse an apk, overload some function and rebuild/sign it. I should have done everything in the correct way; the only thing I edited is a function that check if the device is rooted. ...