Hot answers tagged

28 votes

What are the tools use for reverse engineering android apk?

There are many tools, some are more low-level and some build on top of the low-level tools to make nicer and more complete tools. Here are my favorites: JADX - GUI (and Command line) to produce ...
  • 411
21 votes

Repackaging APK file using baksmali and smali

I use apktool for this purpose, and a short little pair of shell scripts for decompiling and recompiling APKs: decompile-apk #!/bin/bash -e if ! [ "$1" ]; then echo "usage: $0 <file.apk>" ...
  • 1,283
16 votes

Debugging third party android APKs

To debug an APK without the source code, you need to perform the following: Enable debug mode in the APK (use apktool to achieve this) Sign the APK (use keytool and jarsigner) Install the app and ...
  • 496
12 votes

How do I reverse engineer .so files found in android APKs?

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
12 votes

How difficult is to decompile C++ file?

A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
  • 10.6k
9 votes

Bypassing certificate pinning in android

Use Xposed. Learn the API, is the way you should hook & manipulate Android apps. Xposed + JustTrustMe Xposed module (thx Fuzion24). The method calls you're looking for are in the below source ...
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
  • 5,950
8 votes
Accepted

How Do I get proficient at Reverse engineering?

I spent the last 3 or 4 days spending the majority of my day analysing Smali code making almost no progress. I know it feels like you've made "no progress", but I'd encourage you to not look at ...
8 votes
Accepted

print [B byte array in frida js script

var ret = this.fn(); var buffer = Java.array('byte', ret); console.log(buffer.length); var result = ""; for(var i = 0; i < buffer.length; ++i){ result+= (String.fromCharCode(buffer[i])); } ...
7 votes
Accepted

Reverse engineering an application's client connection to a host

I did this with a lot of Android apps so I'll share what I have learned. When thinking of sniffing traffic, the first thing that comes to mind is "I'll just root the Android device, run tcpdump on it ...
7 votes
Accepted

Replacing small length instruction with larger length instruction

As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try: It's very likely you have a function or 2 in your text segment that are present in ...
7 votes
Accepted

Is there a name for this kind of "obfuscation" for the machine code from C++?

Unfortunately it is not enough code to say exactly what it is, but, as @0xec said, it looks very much like control flow flattening. Usually such kind of code transformations are done automatically ...
  • 8,185
7 votes

Android- hiding private keys in .so file

If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story. Obfuscation can slow people down, but it won't stop everyone, ...
  • 1,972
7 votes

What are the tools use for reverse engineering android apk?

If you want to modify code, then the only real option I know of is bak/smali, which apktool provides a helpful wrapper for. If you merely want to understand the code, there's lots of options. For ...
  • 1,972
7 votes
Accepted

does android apk contain game mechanics?

Short answer Single player games most frequently do contain all the information hard coded in the APK. Multiplayer games usually require more work such as packet analysis and more black box work but ...
7 votes
Accepted

Disassemble ELF - PC is set to 0?

In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime. In ...
  • 18.5k
6 votes
Accepted

gdb shows wrong instruction

Your instructions shown by Ida are Thumb-mode instructions. The easiest way to verify this is by checking the addresses - each instruction has 2 bytes. Gdb doesn't know this however, and assumes 4 ...
6 votes

How to detect JNI calls from smali code?

You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
6 votes
Accepted

How does API call work on Android (NDK)?

To answer your question, let us first set a solid ground in terms of entities and definitions. ELF stands for "Executable and Linkable format". That is, it defines the structure and shape of two ...
  • 76
6 votes
Accepted

Decrypting Lua Files

xxtea encrypt with KEY: sxpDM2018 result FightLogic.lua how find the KEY IDA look at Function window press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
  • 131
6 votes
Accepted

Where is Android binary XML format documented?

There is no actual documentation or specification. You pretty much just have to look at the source. See, e.g. https://android.googlesource.com/platform/frameworks/base/+/master/libs/androidfw/...
5 votes
Accepted

Offset calculation for branch instruction in ARM

The instruction format is in little-endian, so bytes 0A E0 gets parsed as machine code 0xE00A, or 1110000000001010b in binary. According to the documentation for the THUMB Instruction Set, the first ...
5 votes

Use Android Shared library (.so) files in Linux

First, extract the whole APK (it's a renamed ZIP) and check whether there's not a x86 version of the binary, in addition of the ARM. It will depend on the best option to choose. The following options ...
5 votes
Accepted

Opening mono droid .so files in .NET decompiler

If you're looking at a "normal" mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP' /assemblies/Sikur.Monodroid.dll /assemblies/...
  • 348
5 votes

Working with Android obfuscation

Here's how I would approach it. Which isn't necessarily the best approach. The first step is to find out what kind of obfuscation the app is using by looking around with your favorite decompiler. ...
  • 1,972
5 votes
Accepted

Lifting up binaries of any arch into an intermediate language for static analysis

My recommendation is to use libVEX, as it's the most robust intermediate code library that I know of. It's part of Valgrind and supports a load of architectures. You can either use libVEX in a C/C++ ...
  • 4,395
5 votes
Accepted

Mapping Android resource IDs to resource string

Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id. In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
  • 428
5 votes

Is there a name for this kind of "obfuscation" for the machine code from C++?

Here's a blog post describing this technique in a little more detail as well as some hints on how to undo it: https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html EDIT ...
  • 35.6k

Only top scored, non community-wiki answers of a minimum length are eligible