98
votes
Accepted
How do I reverse engineer .so files found in android APKs?
The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app ...
- 12.6k
28
votes
What are the tools use for reverse engineering android apk?
There are many tools, some are more low-level and some build on top of the low-level tools to make nicer and more complete tools.
Here are my favorites:
JADX - GUI (and Command line) to produce ...
- 411
25
votes
How do I reverse engineer .so files found in android APKs?
Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ...
- 351
20
votes
Repackaging APK file using baksmali and smali
I use apktool for this purpose, and a short little pair of shell scripts for decompiling and recompiling APKs:
decompile-apk
#!/bin/bash -e
if ! [ "$1" ]; then
echo "usage: $0 <file.apk>"
...
- 1,243
20
votes
How difficult is to decompile C++ file?
Not hard enough!
First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used.
If you save the key ...
- 693
15
votes
Debugging third party android APKs
To debug an APK without the source code, you need to perform the following:
Enable debug mode in the APK (use apktool to achieve this)
Sign the APK (use keytool and jarsigner)
Install the app and ...
- 446
14
votes
How do I reverse engineer .so files found in android APKs?
You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with ...
13
votes
How difficult is to decompile C++ file?
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
- 10.5k
12
votes
How do I reverse engineer .so files found in android APKs?
Use android-ndk, https://developer.android.com/ndk/downloads/index.html.
You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
- 121
9
votes
Bypassing certificate pinning in android
Use Xposed. Learn the API, is the way you should hook & manipulate Android apps.
Xposed + JustTrustMe
Xposed module (thx Fuzion24). The method calls you're looking for are in the below source ...
- 91
9
votes
Accepted
Find function in a stripped dynamic ELF library
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
- 5,850
8
votes
Accepted
How Do I get proficient at Reverse engineering?
I spent the last 3 or 4 days
spending the majority of my day analysing Smali code making almost no
progress.
I know it feels like you've made "no progress", but I'd encourage you to not look at ...
- 20.4k
7
votes
Accepted
Why two virtual destructors?
According to documentation the first one is base object destructor and the second one is deleting destructor.
Constructors and destructors are simply special cases of <unqualified-name>, where ...
- 7,700
7
votes
Accepted
Replacing small length instruction with larger length instruction
As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try:
It's very likely you have a function or 2 in your text segment that are present in ...
- 12.6k
7
votes
Accepted
Reverse engineering an application's client connection to a host
I did this with a lot of Android apps so I'll share what I have learned.
When thinking of sniffing traffic, the first thing that comes to mind is "I'll just root the Android device, run tcpdump on it ...
- 410
7
votes
Accepted
print [B byte array in frida js script
var ret = this.fn();
var buffer = Java.array('byte', ret);
console.log(buffer.length);
var result = "";
for(var i = 0; i < buffer.length; ++i){
result+= (String.fromCharCode(buffer[i]));
}
...
- 86
7
votes
Android- hiding private keys in .so file
If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story.
Obfuscation can slow people down, but it won't stop everyone, ...
- 1,972
7
votes
What are the tools use for reverse engineering android apk?
If you want to modify code, then the only real option I know of is bak/smali, which apktool provides a helpful wrapper for.
If you merely want to understand the code, there's lots of options. For ...
- 1,972
7
votes
Accepted
does android apk contain game mechanics?
Short answer
Single player games most frequently do contain all the information hard coded in the APK.
Multiplayer games usually require more work such as packet analysis and more black box work but ...
- 364
7
votes
Accepted
Disassemble ELF - PC is set to 0?
In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime.
In ...
- 18k
6
votes
Accepted
Reverse engineering from an APK file to a project by MAC
See this. You can unzip the classes.dex from your apk file on the mac, and dex2jar should work on a mac as well.
The last part, jd, is a windows program, but they have an online demo on their ...
- 12.6k
6
votes
Accepted
gdb shows wrong instruction
Your instructions shown by Ida are Thumb-mode instructions. The easiest way to verify this is by checking the addresses - each instruction has 2 bytes. Gdb doesn't know this however, and assumes 4 ...
- 12.6k
6
votes
Accepted
Is there a name for this kind of "obfuscation" for the machine code from C++?
Unfortunately it is not enough code to say exactly what it is, but,
as @0xec said, it looks very much like control flow flattening.
Usually such kind of code transformations are done automatically ...
- 7,700
6
votes
How to detect JNI calls from smali code?
You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
- 591
6
votes
Accepted
How to use IDA Pro debug Android Application?
(Although IDA lets you reverse .class files, there are tools that convert the Java byte code back to source code and are preferred for this)
It's pretty common nowadays to compile libraries and use ...
- 693
6
votes
Accepted
How does API call work on Android (NDK)?
To answer your question, let us first set a solid ground in terms of entities and definitions.
ELF stands for "Executable and Linkable format".
That is, it defines the structure and shape of two ...
- 76
6
votes
Accepted
Decrypting Lua Files
xxtea encrypt with KEY: sxpDM2018
result
FightLogic.lua
how find the KEY
IDA look at Function window
press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
- 131
6
votes
Accepted
Where is Android binary XML format documented?
There is no actual documentation or specification. You pretty much just have to look at the source.
See, e.g.
https://android.googlesource.com/platform/frameworks/base/+/master/libs/androidfw/...
- 591
5
votes
Reverse engineer Android native code
Get the Android NDK and unzip. Use objdump as follows:
android-ndk-r9d\toolchains\arm-linux-androideabi-4.6\prebuilt\windows-x86_64\arm-linux-androideabi\bin\objdump.exe -d libinquestion_jni.so > ...
- 151
5
votes
Accepted
Offset calculation for branch instruction in ARM
The instruction format is in little-endian, so bytes 0A E0 gets parsed as machine code 0xE00A, or 1110000000001010b in binary.
According to the documentation for the THUMB Instruction Set, the first ...
- 20.4k
Only top scored, non community-wiki answers of a minimum length are eligible