Hot answers tagged

29 votes

What are the tools use for reverse engineering android apk?

There are many tools, some are more low-level and some build on top of the low-level tools to make nicer and more complete tools. Here are my favorites: JADX - GUI (and Command line) to produce ...
Gal's user avatar
  • 421
16 votes

Debugging third party android APKs

To debug an APK without the source code, you need to perform the following: Enable debug mode in the APK (use apktool to achieve this) Sign the APK (use keytool and jarsigner) Install the app and ...
3asm_'s user avatar
  • 506
12 votes

How do I reverse-engineer .so files found in Android APKs?

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
Shailesh Mota's user avatar
12 votes

How difficult is to decompile C++ file?

A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
0xC0000022L's user avatar
  • 10.9k
10 votes
Accepted

print [B byte array in frida js script

var ret = this.fn(); var buffer = Java.array('byte', ret); console.log(buffer.length); var result = ""; for(var i = 0; i < buffer.length; ++i){ result+= (String.fromCharCode(buffer[i])); } ...
user23797's user avatar
  • 116
9 votes

Bypassing certificate pinning in android

Use Xposed. Learn the API, is the way you should hook & manipulate Android apps. Xposed + JustTrustMe Xposed module (thx Fuzion24). The method calls you're looking for are in the below source ...
lulzpwner's user avatar
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
0xec's user avatar
  • 6,040
8 votes
Accepted

How Do I get proficient at Reverse engineering?

I spent the last 3 or 4 days spending the majority of my day analysing Smali code making almost no progress. I know it feels like you've made "no progress", but I'd encourage you to not look at ...
Jason Geffner's user avatar
7 votes
Accepted

Is there a name for this kind of "obfuscation" for the machine code from C++?

Unfortunately it is not enough code to say exactly what it is, but, as @0xec said, it looks very much like control flow flattening. Usually such kind of code transformations are done automatically ...
w s's user avatar
  • 8,388
7 votes

Android- hiding private keys in .so file

If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story. Obfuscation can slow people down, but it won't stop everyone, ...
Antimony's user avatar
  • 2,002
7 votes

What are the tools use for reverse engineering android apk?

If you want to modify code, then the only real option I know of is bak/smali, which apktool provides a helpful wrapper for. If you merely want to understand the code, there's lots of options. For ...
Antimony's user avatar
  • 2,002
7 votes
Accepted

does android apk contain game mechanics?

Short answer Single player games most frequently do contain all the information hard coded in the APK. Multiplayer games usually require more work such as packet analysis and more black box work but ...
Elian Kamal's user avatar
7 votes
Accepted

Disassemble ELF - PC is set to 0?

In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime. In ...
perror's user avatar
  • 18.9k
7 votes
Accepted

How does API call work on Android (NDK)?

To answer your question, let us first set a solid ground in terms of entities and definitions. ELF stands for "Executable and Linkable format". That is, it defines the structure and shape of two ...
Lero's user avatar
  • 86
6 votes

Use Android Shared library (.so) files in Linux

First, extract the whole APK (it's a renamed ZIP) and check whether there's not a x86 version of the binary, in addition of the ARM. It will depend on the best option to choose. The following options ...
Cécile Bertau's user avatar
6 votes

How do I reverse-engineer .so files found in Android APKs?

You can also reverse-engineer APK files directly on an android device. Java part: Show Java .so files: Android disassembler. (Disclaimer: I 'm the developer) Version 1.4.2 release. Android-...
KYHSGeekCode's user avatar
6 votes
Accepted

gdb shows wrong instruction

Your instructions shown by Ida are Thumb-mode instructions. The easiest way to verify this is by checking the addresses - each instruction has 2 bytes. Gdb doesn't know this however, and assumes 4 ...
Guntram Blohm's user avatar
6 votes

How to detect JNI calls from smali code?

You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
JesusFreke's user avatar
6 votes
Accepted

Decrypting Lua Files

xxtea encrypt with KEY: sxpDM2018 result FightLogic.lua how find the KEY IDA look at Function window press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
user29082's user avatar
  • 131
6 votes
Accepted

Where is Android binary XML format documented?

There is no actual documentation or specification. You pretty much just have to look at the source. See, e.g. https://android.googlesource.com/platform/frameworks/base/+/master/libs/androidfw/...
JesusFreke's user avatar
5 votes
Accepted

Opening mono droid .so files in .NET decompiler

If you're looking at a "normal" mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP' /assemblies/Sikur.Monodroid.dll /assemblies/...
diff's user avatar
  • 358
5 votes

Working with Android obfuscation

Here's how I would approach it. Which isn't necessarily the best approach. The first step is to find out what kind of obfuscation the app is using by looking around with your favorite decompiler. ...
Antimony's user avatar
  • 2,002
5 votes
Accepted

Lifting up binaries of any arch into an intermediate language for static analysis

My recommendation is to use libVEX, as it's the most robust intermediate code library that I know of. It's part of Valgrind and supports a load of architectures. You can either use libVEX in a C/C++ ...
joxeankoret's user avatar
  • 4,470
5 votes
Accepted

Mapping Android resource IDs to resource string

Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id. In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
Misty's user avatar
  • 428
5 votes

Is there a name for this kind of "obfuscation" for the machine code from C++?

Here's a blog post describing this technique in a little more detail as well as some hints on how to undo it: https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html EDIT ...
Igor Skochinsky's user avatar
  • 36.4k
5 votes

Animal Crossing: Pocket Camp .zdat File

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
TkTech's user avatar
  • 326
5 votes

Does Google encrypt APK when downloading it from Play Store?

Disclaimer: I took a different approach to find your solution. I don't use Fiddler, it has many adwares. You may use Fiddler and may find same result as I did. Does anyone know how to unpack/...
Biswapriyo's user avatar
  • 1,559
5 votes

Disassemble ELF - PC is set to 0?

While the other answer is not wrong, it does not actually cover the real issue: how come that calling a zero address does not lead to a crash? AFAIK there is no official standard or complete ...
Igor Skochinsky's user avatar
  • 36.4k

Only top scored, non community-wiki answers of a minimum length are eligible