Hot answers tagged

98 votes
Accepted

How do I reverse engineer .so files found in android APKs?

The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app ...
user avatar
28 votes

What are the tools use for reverse engineering android apk?

There are many tools, some are more low-level and some build on top of the low-level tools to make nicer and more complete tools. Here are my favorites: JADX - GUI (and Command line) to produce ...
user avatar
  • 411
25 votes

How do I reverse engineer .so files found in android APKs?

Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ...
user avatar
  • 351
20 votes

Repackaging APK file using baksmali and smali

I use apktool for this purpose, and a short little pair of shell scripts for decompiling and recompiling APKs: decompile-apk #!/bin/bash -e if ! [ "$1" ]; then echo "usage: $0 <file.apk>" ...
user avatar
  • 1,243
20 votes

How difficult is to decompile C++ file?

Not hard enough! First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used. If you save the key ...
user avatar
  • 693
15 votes

Debugging third party android APKs

To debug an APK without the source code, you need to perform the following: Enable debug mode in the APK (use apktool to achieve this) Sign the APK (use keytool and jarsigner) Install the app and ...
user avatar
  • 446
14 votes

How do I reverse engineer .so files found in android APKs?

You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with ...
user avatar
13 votes

How difficult is to decompile C++ file?

A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
user avatar
  • 10.5k
12 votes

How do I reverse engineer .so files found in android APKs?

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
user avatar
9 votes

Bypassing certificate pinning in android

Use Xposed. Learn the API, is the way you should hook & manipulate Android apps. Xposed + JustTrustMe Xposed module (thx Fuzion24). The method calls you're looking for are in the below source ...
user avatar
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
user avatar
  • 5,850
8 votes
Accepted

How Do I get proficient at Reverse engineering?

I spent the last 3 or 4 days spending the majority of my day analysing Smali code making almost no progress. I know it feels like you've made "no progress", but I'd encourage you to not look at ...
user avatar
7 votes
Accepted

Why two virtual destructors?

According to documentation the first one is base object destructor and the second one is deleting destructor. Constructors and destructors are simply special cases of <unqualified-name>, where ...
user avatar
  • 7,700
7 votes
Accepted

Replacing small length instruction with larger length instruction

As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try: It's very likely you have a function or 2 in your text segment that are present in ...
user avatar
7 votes
Accepted

Reverse engineering an application's client connection to a host

I did this with a lot of Android apps so I'll share what I have learned. When thinking of sniffing traffic, the first thing that comes to mind is "I'll just root the Android device, run tcpdump on it ...
user avatar
7 votes
Accepted

print [B byte array in frida js script

var ret = this.fn(); var buffer = Java.array('byte', ret); console.log(buffer.length); var result = ""; for(var i = 0; i < buffer.length; ++i){ result+= (String.fromCharCode(buffer[i])); } ...
user avatar
7 votes

Android- hiding private keys in .so file

If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story. Obfuscation can slow people down, but it won't stop everyone, ...
user avatar
  • 1,972
7 votes

What are the tools use for reverse engineering android apk?

If you want to modify code, then the only real option I know of is bak/smali, which apktool provides a helpful wrapper for. If you merely want to understand the code, there's lots of options. For ...
user avatar
  • 1,972
7 votes
Accepted

does android apk contain game mechanics?

Short answer Single player games most frequently do contain all the information hard coded in the APK. Multiplayer games usually require more work such as packet analysis and more black box work but ...
user avatar
7 votes
Accepted

Disassemble ELF - PC is set to 0?

In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime. In ...
user avatar
  • 18k
6 votes
Accepted

Reverse engineering from an APK file to a project by MAC

See this. You can unzip the classes.dex from your apk file on the mac, and dex2jar should work on a mac as well. The last part, jd, is a windows program, but they have an online demo on their ...
user avatar
6 votes
Accepted

gdb shows wrong instruction

Your instructions shown by Ida are Thumb-mode instructions. The easiest way to verify this is by checking the addresses - each instruction has 2 bytes. Gdb doesn't know this however, and assumes 4 ...
user avatar
6 votes
Accepted

Is there a name for this kind of "obfuscation" for the machine code from C++?

Unfortunately it is not enough code to say exactly what it is, but, as @0xec said, it looks very much like control flow flattening. Usually such kind of code transformations are done automatically ...
user avatar
  • 7,700
6 votes

How to detect JNI calls from smali code?

You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
user avatar
6 votes
Accepted

How to use IDA Pro debug Android Application?

(Although IDA lets you reverse .class files, there are tools that convert the Java byte code back to source code and are preferred for this) It's pretty common nowadays to compile libraries and use ...
user avatar
  • 693
6 votes
Accepted

How does API call work on Android (NDK)?

To answer your question, let us first set a solid ground in terms of entities and definitions. ELF stands for "Executable and Linkable format". That is, it defines the structure and shape of two ...
user avatar
  • 76
6 votes
Accepted

Decrypting Lua Files

xxtea encrypt with KEY: sxpDM2018 result FightLogic.lua how find the KEY IDA look at Function window press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
user avatar
  • 131
6 votes
Accepted

Where is Android binary XML format documented?

There is no actual documentation or specification. You pretty much just have to look at the source. See, e.g. https://android.googlesource.com/platform/frameworks/base/+/master/libs/androidfw/...
user avatar
5 votes

Reverse engineer Android native code

Get the Android NDK and unzip. Use objdump as follows: android-ndk-r9d\toolchains\arm-linux-androideabi-4.6\prebuilt\windows-x86_64\arm-linux-androideabi\bin\objdump.exe -d libinquestion_jni.so > ...
user avatar
  • 151
5 votes
Accepted

Offset calculation for branch instruction in ARM

The instruction format is in little-endian, so bytes 0A E0 gets parsed as machine code 0xE00A, or 1110000000001010b in binary. According to the documentation for the THUMB Instruction Set, the first ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible