Questions tagged [android]

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

Filter by
Sorted by
Tagged with
2
votes
1answer
3k views

How do I Log a String Referenced within a Method - Smali

I have been trying to reverse engineer an Android application and was wondering how I would go about logging a certain string. Here is the method I am trying to log the String from: .method private ...
1
vote
0answers
184 views

Tools to support Android native code hacking?

I am learning android reverse engineering, and want to know tools to hack native code. gdb to remotely debug the code, but I find it can not ever hit a breakpoint. arminject is a choice, it works on ...
2
votes
0answers
169 views

Need help intercepting android application network traffic [closed]

On my OWN rooted phone, I have had xposed installed, justtrustme unpinning application, and tcpdump in an attempt to capture the traffic of specific applications that are on the phone. The specific ...
1
vote
1answer
4k views

Anti-tampering techniques in Android APK's

I'm reverse engineering an Android app, and it has some kind of anti-tamper protection. The problem is that I can't find it anywhere in the smali files. Even if I just re-sign the official APK that I ...
2
votes
1answer
1k views

How to find Xref to strings in proprietary binaries?

When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro. The image has ...
0
votes
2answers
680 views

How can I debug android native library with ida demo?

I am trying to debug android native library using ida demo version everything otherthing is working except some one I can't find android_server file for keeping on android device and can't see the ...
1
vote
2answers
827 views

Reverse engineer encrypted text file if I have both pre and post encryption files [closed]

As per the title, I have an encrypted text file that is generated by an Android app. I then have to send that off to the people whom made the app for them to decode it and send it back. Not ideal as ...
1
vote
1answer
739 views

Android Native Library - How to match java references to sub_XXX function (static way)

I'm currently learning how native functions are implemented among the ELF SO files contained inside an APK. I'm using IDA. Native calls are always achieved in this way. // First load the library ...
4
votes
2answers
874 views

Dalvik dex file version 036

I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem. But ...
0
votes
2answers
1k views

Android App's hardcoded local keystore password r3versing

Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password. I've decompiled it with JEB2 and obviously within ...
1
vote
2answers
3k views

Renaming entitites in obfuscated java bytecode

I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard. I'm just trying to reverse a few things it does. The classes, methods and variables ...
1
vote
1answer
3k views

Saving .so file with IDA

I edited a ".so" file (which extracted from an APK) with IDA Pro, and now I am trying to save it with the same format. But it seems that I cannot find it. Could you please explain to me step by step ...
-2
votes
1answer
1k views

How to sniff HTTPS traffic of Android apps that ignore the system proxy setting?

I saw a very similar question about this on macOS just 20hrs ago but I'm always needing to do this on Android and I keep forgetting the name of the app. So this is just for reference.
3
votes
1answer
5k views

Decompiling 64bit ARMv8 Android .so library

I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
1
vote
2answers
2k views

How to figure out which library a native JNI function is calling?

I'm trying to perform static analysis on Android framework code, and I'm coming across some Java methods that are calling JNI functions. How do I figure out which native libraries these functions ...
4
votes
2answers
2k views

Flashing firmware on an embedded device

Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge) I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing ...
1
vote
2answers
2k views

IDA Dalvik Debugger doesn't work with official Android emulator

I try to use IDA to debug application with official Android ARM emulator. I set up debugger, installed APK and run application, it starts, writes "waiting for debugger", and debugger writes that "...
0
votes
3answers
5k views

How to dump Android shared library from memory?

I have encrypted Android so library that decrypts itself on load. I want to get its unencrypted code. For me it looks good idea to dump that library from memory when application started. I used /proc/...
0
votes
1answer
199 views

why 'ni' goes into function in Android gdb debugging?

I'm debugging android JNI with gdb without source code. I use ni command to step over arm asm instructions. I suppose ni is step over, but it still goes into function like BL xxxx, and I have to use ...
0
votes
1answer
137 views

What do the unusually named packages and files usually mean?

When decompiling an apk with apktool, the classes.dex file is decompiled into folders smali_classes#, and sorted their respective packages. I recognize some of the files, as they are mentioned in ...
1
vote
1answer
1k views

gdb shows wrong instruction

I'm debugging android jni with gdb. There's a jni function A(), I need to set breakpoint there and step through. I calculated the address with module_base+offset, which is 0x99B62C7A, then I tried to ...
2
votes
1answer
648 views

Call Android method without running whole Android-App

I want to ask if somebody is aware of tools/projects which are similar to the Appcall feature of IDA Pro[1] for Android Apps? I'm looking for the possibility to run certain methods detected in the ...
5
votes
2answers
901 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
3
votes
1answer
173 views

How to find image base of an arbitrary boot-loader image?

I have picked up a rooted Acer phone and dd-ed the LK partition to analyze it in IDA. The goal is to pinpoint the routine processing fastboot commands. Stripping first 512 bytes produces apparently ...
2
votes
1answer
7k views

Frida manipulating arguments - Android

I've attempting to learn how to use Frida to instrument android app, just for person interest. So far I've managed to get my environment set up with a physical android tablet and I can successfully ...
3
votes
1answer
442 views

Android: How many ways for getting GPS location

I'm using XPosed for faking gps location. I have faked and tested successfully these two apis: FusedLocationApi from GoogleApiClient LocationManager including two methods: requestLocationUpdates and ...
2
votes
0answers
818 views

crash using ida 6.8 debugging on android 5.0

I need to debug .so of my.apk, I'm working on a phone with android 5.0, using ida 6.8's android_server. It seems ok for attaching ida to the process, but when clicking something on the apk there is ...
-1
votes
1answer
527 views

Reverse Engineering an APP With Frida [closed]

I am trying to reverse engineer an app but I am having problems unlike the previous apps that I reverse engineered..... When Untouched the app let's you login perfectly but when I reverse engineer it ...
2
votes
2answers
3k views

Sniffing traffic of Outlook android app

I have been trying to get the traffic of the Outlook email app for Android to show up in my Fiddler for months with no success. Although some traffic from the app does show in Fiddler, but not all. ...
1
vote
1answer
1k views

Reverse engineering camera blobs in Android [closed]

So I heard that bacon (OnePlus One) got the camera working on custom ROMs by reverse engineering the camera blobs. I tried reading online, but I didn't have a proper link for this matter. So the ...
1
vote
1answer
213 views

Certain classes do not show up in JDB while they are present in source code

I'm debugging a closed-source Android app with jdb. In the output produced by the apktool, I see class com.myapp.j.d.d, as well as a/b/c/e, but at run-time, I see only com.myapp.j.d.e. Why is that ...
0
votes
3answers
2k views

Capture traffic of android app on unknown port

I am using ProxyDroid to proxy everything to Charles Proxy. But by default Charles proxy (or any other similar programs like Fiddler, mitmproxy, etc..) only capture traffic on common ports such as 80, ...
0
votes
1answer
113 views

How does some application get through the block when mobile data plan is exceeded [closed]

I have a mobile data plan of 2 GBs. When I exceed it, I always get redirected to the network operator's website when I trying to load an URL. For some reason Telegram(Android app only, Desktop app ...
0
votes
1answer
1k views

Reversed APK crashes after install

I'm trying to reverse an apk, overload some function and rebuild/sign it. I should have done everything in the correct way; the only thing I edited is a function that check if the device is rooted. ...
2
votes
1answer
520 views

Debug android shared library interactivly

I have been trying to reverse engineer .so file in android application.I used objdump from android ndk to look at the assembly of the file.I do not have a problem with assembly but analyzing the file ...
2
votes
1answer
2k views

reversing apk - getting native code in classes.dex

I've start reversing some android application. I have a little experience in this subject, but i got stuck on a little matter. The app i'm trying to reverse uses JNI (java native interface), meaning ...
1
vote
1answer
1k views

Has anyone tried ptrace_attaching android unity apps for anti debugging?

I am trying to ptrace_attach the main process and its threads (/proc/<pid>/task) of an android unity app to avoid malicious users debugging the app(which is a game). I developed a ndk library ...
0
votes
1answer
914 views

What's the most straightforward way to change a simple thing in Android APK java application?

I need to make some simple tweaks to Android APP that keeps crashing. Viewing the code and seeing possible problems is pretty simple. I can either: Use Apktool (eg. apktool d name_of_apk.apk -o ...
2
votes
0answers
283 views

Why can I not read .so file public functions compiled in C?

I can read the public functions (name and full signature) of some .so files that associated with Android APK, whereas others only show the function name. For example, running this command only ...
1
vote
0answers
88 views

How to get to daemon source? [closed]

I'm performing static analysis on system framework code, and some of the interesting ones seem to be talking to daemons via sockets. How do I get to the source of the daemons to see what they do with ...
3
votes
1answer
725 views

Reverse engineering Android device framework

I'm trying to get to an Android device framework source to perform static analysis on it. I'm specifically looking at a Samsung Galaxy S6 device with Android 5.1.1. I downloaded the firmware image, ...
4
votes
2answers
9k views

Mapping Android resource IDs to resource string

I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to ...
1
vote
1answer
2k views

Reverse Engineering Android Kernel

How do I reverse engineer the Android kernel currently running on an Android phone? I'm most interested in seeing/manipulating the call stack. Basically, gdb or something like Ollydgb would be great....
0
votes
1answer
238 views

Analyzing an APK without tools [closed]

I know you can unpack APKs with apktool and the likes, however we're doing an exercise at uni where we're supposed to get some info like permissions declared and permissions used from some APKs ...
6
votes
2answers
2k views

Trace system calls, including stack (and java stack if possible), on android?

I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption. The app in question consists ...
9
votes
5answers
4k views

Lifting up binaries of any arch into an intermediate language for static analysis

Background As the title is self-explanatory, I would like to translate binaries of any architecture (e.g. x86, ARM, ARM Thumb) to an intermediate language in order to apply arch-independent static ...
2
votes
1answer
393 views

Removing uncalled smali

Does anyone know of a smali re-compiler that will remove uncalled code without obfuscation? I just want to remove unused classes and methods.
5
votes
1answer
3k views

Reverse engineering Android vendor system apps

I'm trying to reverse engineer certain Samsung system apps in the Galaxy S6 firmware system image, such as KnoxAttestationAgent.apk. I'm a noob when it comes to reverse engineering, and so far my ...
1
vote
0answers
361 views

SSL Unpinning Twitter app [duplicate]

I want to run twitter app behind a proxy so i decompiled the app to read the source code.I have noticed that it is using this code to pin the certificate. https://github.com/moxie0/AndroidPinning/...
1
vote
0answers
770 views

SSL unpinning Twitter android app [closed]

I want to run twitter app behind a proxy so i decompiled the app to read the source code.I have noticed that it is using this code https://github.com/moxie0/AndroidPinning/tree/master/src/org/...

1
3 4
5
6 7