Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 60

Android is Google's Linux-based operating system for mobile devices. Initially developed by Android, Inc., Android is the world's most widely used smartphone platform.

5
votes
There are two options I can see. Start the Dalvik VM manually using app_process. The command line seems to be something like (see am script source): app_process /system/bin com.android.commands.am. …
answered Apr 30 '13 by Igor Skochinsky
1
vote
There were some cases where uninitialized memory was used as an entropy source, e.g. OpenSSL, but I doubt this is happening here. Possibly there is something not present in the snippet you posted, or …
answered Aug 7 by Igor Skochinsky
1
vote
If the engine includes native components, names of files in the lib directory of the APK might give you some hints. E.g. libunity.so and libmono.so likely mean the game is using Unity.
answered Aug 19 '18 by Igor Skochinsky
1
vote
since these formats seem to be custom to the game, I suspect there is no other way than disassembling/decompiling the game code to see how they're processed.
answered Aug 14 '17 by Igor Skochinsky
2
votes
Well, if the original file does not export the symbols, I can only think of two possibilities: the methods are registered dynamically at load time. (most likely) the file is obfuscated/encrypted and …
answered Apr 26 '17 by Igor Skochinsky
3
votes
The required shared libraries are stored as DT_NEEDED entries in the dynamic section of the executable. This entry, in turn, points into the dynamic string table. So, to add another library, you will …
answered Apr 20 '14 by Igor Skochinsky
1
vote
This instruction is not a NOP. It reads memory and jumps to the address loaded. If the memory is inaccessible or the loaded address is invalid/non-executable, you will get an exception, so the debugge …
answered Sep 3 by Igor Skochinsky
1
vote
IDA demo does not include remote debuggers so you can't debug Android programs with it. You need the full version. …
answered Jul 5 '17 by Igor Skochinsky
35
votes
It's not only possible but has been done already, and not just once. Here's three I know about, and there may be more. Kivlad by Cody Brocious http://www.matasano.com/research/kivlad/ DAD by Zost ( …
answered Mar 20 '13 by Igor Skochinsky
4
votes
Here's a blog post describing this technique in a little more detail as well as some hints on how to undo it: https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html EDIT …
answered Jul 6 '17 by Igor Skochinsky
3
votes
These objects are indeed instances of the type_info class (or, more likely, one of its descendants). The structure of those classes is described in the Itanium C++ ABI. You can also inspect the rtti.h …
answered May 12 '14 by Igor Skochinsky
4
votes
Linux systems and linker binary on Android). GOT[2] is also filled in by the dynamic linker and points to the resolver function (_dl_runtime_resolve in glibc, not sure on Android). The snippet you … to links from @perror, I found this post which explains some of the reserved GOT entries (although for x64 Linux and not ARM Android). …
answered Sep 18 '18 by Igor Skochinsky
0
votes
You can save the debug-time segments in the IDB for “offline” analysis but on subsequent runs this will be useful only if they are allocated at exactly the same addresses.
answered Aug 20 by Igor Skochinsky
0
votes
Probably the app has some additional checks against modification. Try to track down the login error shown, maybe you can find the check which triggers it and disable it. Instead of patching the app …
answered Sep 8 '17 by Igor Skochinsky