All Questions
57 questions
1
vote
1
answer
779
views
How to decode lua files and resource files that are protected from Frida and IDA64?
I am trying to decrypt Lua files from an Android game "The Sea Road: Fate Assembly" (APK download link). It uses Cocos2d-x, but it's encrypted, maybe with AES encryption.
With Frida, the ...
- 53
0
votes
1
answer
80
views
IDA Pro: JDWP error: ABSENT_INFORMATION - Desired information is not available
I am trying to debug a dex file from an APK file in IDA Pro. I set some breakpoints when launching the activity. When I start the process, the application waits for the debugger. After some time, IDA ...
1
vote
1
answer
570
views
HELP Decrypting Lua files
i'm trying to mod a game named : DDTank Mobile, which is on both Android & IOS.
This game runs on cocos2d engine, the thing is the lua files are encrypted.
I read somewhere to look for 'sign' at ...
0
votes
1
answer
429
views
Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header
I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum.
file output:
libTheArmKing.so: ELF ...
- 259
1
vote
0
answers
37
views
IDA debug function spawned by pthread_once
I am using IDA to debug android, some libs use pthread_once/pthread_create function to call a function. How do I use/set up IDA to debug the function passed to pthread_once ?
- 59
0
votes
1
answer
495
views
What does this function do?
I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
- 1
2
votes
1
answer
707
views
Debugging Native Lib using IDA Pro Fails to Load Registers and other Information
Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
- 121
1
vote
0
answers
358
views
Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point
Here's the problem:
I set a breakpoint in IDA debugger
the program stop at the breakpoint
deactivated the breakpoint
IDA keep receiving SIGTRAP or SIGSEGV
( program stop at breakpoint as expected ) :...
- 131
1
vote
2
answers
746
views
Why IDA debugger on android doesn't show all threads?
My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file.
Here's what I've done:
download a x86_64 system image android emulator from android studio
install that .apk ...
- 131
1
vote
0
answers
127
views
Is this native code possible for further static analysis?
I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function ...
- 309
1
vote
1
answer
2k
views
Remote debugging android native lib(.so) No connection could be made because the target machine actively refused it. when connecting to
I have a running IDA debug-server on my virtual android device(check attachments).
The problem is: when I try hit Attach procces it gives me an error(check title).
Here is some kinda params that I'm ...
1
vote
0
answers
355
views
Frida not able to trace sub_XXXXX which must have been called
I have the following pseudocode generated by IDA Pro decompiler:
__int64 *__usercall sub_155B5@<X0>(__int64 *a1@<X0>, unsigned int a2@<W1>, char **a3@<X8>)
{
...
result = ...
- 111
2
votes
1
answer
1k
views
IDA Pro: How to change segment register value
For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
- 21
1
vote
1
answer
830
views
Unable to intercept traffic of an android app even after patching ssl pinning
Recently, I was trying to test an app developed on Rhomobile, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but ...
- 309
0
votes
0
answers
501
views
Using IDA pro 7.2 and android server breakpoints problem
i have been trying to use IDA to make a breakpoints on a 4 byte memory address
to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support ...
- 1
0
votes
1
answer
2k
views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
0
votes
1
answer
268
views
Why does this command crash IDA Android native debugger?
In Android shared library that heavily protected against debugging, I found following code:
CODE32
ldr pc, [pc, #-4]
For me, this instruction looks like NOP; it just jumps to next instruction in ARM ...
- 395
1
vote
0
answers
199
views
How to find implementation of native method in the library .so (Android)
I need to make reverse engineering of one android app.
In this app I found class with name Im2MessageNative, this class contains a lot of native methods.
For example:
static native long ...
2
votes
1
answer
20k
views
Decrypting Lua Files
I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.
...
- 31
1
vote
1
answer
1k
views
IDA taking forever to run autoanalysis on remote Android app?
I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp....
- 111
1
vote
0
answers
186
views
IDA Pro how debug constant function returning different results?
The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
- 121
1
vote
1
answer
3k
views
How to deobfuscate native Android library obfuscated with OLLVM?
When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
- 121
-1
votes
1
answer
440
views
Gdbserver and idapro
I would like to reverse a file so of an apk using idapro (on windows) and gdbserver(on remote target device) . I arrived until the attach of the running process. But after? Is there a tutorial ...
- 19
1
vote
0
answers
130
views
Missing Map from Java Native Method to C Code
When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
- 121
1
vote
1
answer
800
views
How to find the executable code of the native method in the library * .so? (Android)
I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
- 11
1
vote
2
answers
1k
views
IDA Pro Search classes within a Dex file inclusive of package name
Let's just assume that our classes.dex file has a class:
com.example.MyClass
in which there's a method "meth":
public final com.example.MyClass.meth(java.lang.String p0)
how/where can I search the ...
- 175
0
votes
1
answer
2k
views
Need help reversing an Android Game
I am trying to find the portion of code in an android game that is responsible for the main logic of the game. (e.g Calculating damage when shooting the zombie) The game is obviously using native code ...
- 175
1
vote
1
answer
3k
views
How to combine 2 dex files into a single dex file for more complete disassembly by IDA Pro
Most apk files, when disassembled, produces 2 dex files instead of one. However since IDA Pro only allows the loading of one dex file at a time,it may result in missing information as a result of the ...
- 175
0
votes
3
answers
3k
views
Is it possible to call function in dynamic link library(.so) generated by Android JNI project?
I unzipped an apk file and got one libxx.so file. I find that there are some "exported"(but I guess the "fun" function is not exported by the original programer) functions in this ...
- 1
9
votes
3
answers
1k
views
Is there a name for this kind of "obfuscation" for the machine code from C++?
I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
- 118
2
votes
1
answer
2k
views
How to find Xref to strings in proprietary binaries?
When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro.
The image has ...
- 143
0
votes
2
answers
778
views
How can I debug android native library with ida demo?
I am trying to debug android native library using ida demo version everything otherthing is working except some one I can't find android_server file for keeping on android device and can't see the ...
- 101
1
vote
1
answer
4k
views
Saving .so file with IDA
I edited a ".so" file (which extracted from an APK) with IDA Pro, and now I am trying to save it with the same format. But it seems that I cannot find it.
Could you please explain to me step by step ...
- 11
3
votes
1
answer
8k
views
Decompiling 64bit ARMv8 Android .so library
I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
- 359
1
vote
2
answers
2k
views
IDA Dalvik Debugger doesn't work with official Android emulator
I try to use IDA to debug application with official Android ARM emulator. I set up debugger, installed APK and run application, it starts, writes "waiting for debugger", and debugger writes that "...
- 395
1
vote
1
answer
2k
views
gdb shows wrong instruction
I'm debugging android jni with gdb. There's a jni function A(), I need to set breakpoint there and step through. I calculated the address with module_base+offset, which is 0x99B62C7A, then I tried to ...
- 209
7
votes
2
answers
1k
views
Attach Shared Object to android process with IDA
I am:
working with an Android game,
using an Android Emulator,
and trying to attach an android .so library to a process.
I have the whole IDA server set up, I can attach to processes when a classes....
- 71
2
votes
0
answers
951
views
crash using ida 6.8 debugging on android 5.0
I need to debug .so of my.apk, I'm working on a phone with android 5.0, using ida 6.8's android_server. It seems ok for attaching ida to the process, but when clicking something on the apk there is ...
- 209
1
vote
1
answer
555
views
Adding/Finding Places for Instructions - Game Library IDA
Is there any way to add instructions to a library in IDA? My predicament is that there is no room in a game library (.so ELF, android) to fit my own code. There is an empty bss segment but IDA doesn't ...
- 41
1
vote
1
answer
158
views
Discrepancies in function declarations from decompilers?
An Android application I'm analyzing makes calls to a native library to generate a certain value. Here's an example of the native library function declaration from SMALI (Decompiled Java):
.method ...
- 195
1
vote
1
answer
896
views
IDA Strings to Functions (ARM, Protected Functions)
I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference ...
- 41
4
votes
1
answer
2k
views
How Do I get proficient at Reverse engineering?
Please bear with me as I explain this situation.
Maybe 10 days ago I took up the challenge of reverse engineering an Android app. Learning from scratch, I installed ADB, Apktool, Android Studio, ...
- 195
1
vote
1
answer
1k
views
Android - Analyzing complex hash algorithm
An APK I'm working on uses some sort of algorithm to generate a hash which is sent along with an HTTP request. I want to figure out how the algorithm works.
Decompiling the APK to Java is of no help ...
- 195
2
votes
2
answers
3k
views
Problem with IDA pro 6.8 disassemble galaxy s6 sboot
I have some problem with Galaxy S6 boot loader (sboot.bin).
From 0x3F000 of that file, I think that there exists the real boot loader.
So I tried to disassemble it with ida 6.8 pro (64bit)
But It does ...
- 21
5
votes
2
answers
703
views
ARM - Is calling function from external static library possible?
Basically i'm debugging a closed source binary on Android and i want to execute some of my code in between which is large enough not to fit in codecave. So is it possible to compile library with my ...
- 165
1
vote
0
answers
71
views
How to modify arm .so? [duplicate]
I want to modify android app writen on c++.
It stores its code mostly in .so file. The code is compiled for arm architecture.
When I open it in IDA it says that it can only read but modify.
But I ...
- 111
0
votes
1
answer
1k
views
Anyone had success with IDA & Windroye/Andydroid/BlueStacks?
Has anyone had luck debugging JNI code inside of an Android Emulator using IDA? I haven't been able to get any of the popular Windows Android emulators to work. Been trying step such as in http://...
- 101
6
votes
2
answers
11k
views
Offset calculation for branch instruction in ARM
As the title says, how to calculate offsets for branch instructions?
For example i have following assembly code,
0x60ECE B loc_60EE6
;
;
;
0x60EE6 LDR.W R2, #0x123
Hex code for location ...
- 165
5
votes
1
answer
1k
views
Replacing small length instruction with larger length instruction
Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code.
I am using IDA Pro for analyzing native ...
- 165
6
votes
3
answers
12k
views
Use Android Shared library (.so) files in Linux
I decompiled an APK file,and that program have native codes in a .so file.
I want to use that .so file in Linux in order to use inline functions.
These codes have functions to connect to a server and ...
- 61