28
votes
What are the tools use for reverse engineering android apk?
There are many tools, some are more low-level and some build on top of the low-level tools to make nicer and more complete tools.
Here are my favorites:
JADX - GUI (and Command line) to produce ...
- 411
21
votes
Repackaging APK file using baksmali and smali
I use apktool for this purpose, and a short little pair of shell scripts for decompiling and recompiling APKs:
decompile-apk
#!/bin/bash -e
if ! [ "$1" ]; then
echo "usage: $0 <file.apk>"
...
- 1,283
16
votes
Debugging third party android APKs
To debug an APK without the source code, you need to perform the following:
Enable debug mode in the APK (use apktool to achieve this)
Sign the APK (use keytool and jarsigner)
Install the app and ...
- 496
12
votes
How do I reverse engineer .so files found in android APKs?
Use android-ndk, https://developer.android.com/ndk/downloads/index.html.
You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
- 121
12
votes
How difficult is to decompile C++ file?
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
- 10.6k
9
votes
Bypassing certificate pinning in android
Use Xposed. Learn the API, is the way you should hook & manipulate Android apps.
Xposed + JustTrustMe
Xposed module (thx Fuzion24). The method calls you're looking for are in the below source ...
- 91
9
votes
Accepted
Find function in a stripped dynamic ELF library
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
- 5,950
8
votes
Accepted
How Do I get proficient at Reverse engineering?
I spent the last 3 or 4 days
spending the majority of my day analysing Smali code making almost no
progress.
I know it feels like you've made "no progress", but I'd encourage you to not look at ...
- 20.6k
8
votes
Accepted
print [B byte array in frida js script
var ret = this.fn();
var buffer = Java.array('byte', ret);
console.log(buffer.length);
var result = "";
for(var i = 0; i < buffer.length; ++i){
result+= (String.fromCharCode(buffer[i]));
}
...
- 96
7
votes
Accepted
Reverse engineering an application's client connection to a host
I did this with a lot of Android apps so I'll share what I have learned.
When thinking of sniffing traffic, the first thing that comes to mind is "I'll just root the Android device, run tcpdump on it ...
- 410
7
votes
Accepted
Replacing small length instruction with larger length instruction
As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try:
It's very likely you have a function or 2 in your text segment that are present in ...
- 12.8k
7
votes
Accepted
Is there a name for this kind of "obfuscation" for the machine code from C++?
Unfortunately it is not enough code to say exactly what it is, but,
as @0xec said, it looks very much like control flow flattening.
Usually such kind of code transformations are done automatically ...
- 8,185
7
votes
Android- hiding private keys in .so file
If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story.
Obfuscation can slow people down, but it won't stop everyone, ...
- 1,972
7
votes
What are the tools use for reverse engineering android apk?
If you want to modify code, then the only real option I know of is bak/smali, which apktool provides a helpful wrapper for.
If you merely want to understand the code, there's lots of options. For ...
- 1,972
7
votes
Accepted
does android apk contain game mechanics?
Short answer
Single player games most frequently do contain all the information hard coded in the APK.
Multiplayer games usually require more work such as packet analysis and more black box work but ...
- 364
7
votes
Accepted
Disassemble ELF - PC is set to 0?
In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime.
In ...
- 18.5k
6
votes
Accepted
gdb shows wrong instruction
Your instructions shown by Ida are Thumb-mode instructions. The easiest way to verify this is by checking the addresses - each instruction has 2 bytes. Gdb doesn't know this however, and assumes 4 ...
- 12.8k
6
votes
How to detect JNI calls from smali code?
You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
- 591
6
votes
Accepted
How does API call work on Android (NDK)?
To answer your question, let us first set a solid ground in terms of entities and definitions.
ELF stands for "Executable and Linkable format".
That is, it defines the structure and shape of two ...
- 76
6
votes
Accepted
Decrypting Lua Files
xxtea encrypt with KEY: sxpDM2018
result
FightLogic.lua
how find the KEY
IDA look at Function window
press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
- 131
6
votes
Accepted
Where is Android binary XML format documented?
There is no actual documentation or specification. You pretty much just have to look at the source.
See, e.g.
https://android.googlesource.com/platform/frameworks/base/+/master/libs/androidfw/...
- 591
5
votes
Accepted
Offset calculation for branch instruction in ARM
The instruction format is in little-endian, so bytes 0A E0 gets parsed as machine code 0xE00A, or 1110000000001010b in binary.
According to the documentation for the THUMB Instruction Set, the first ...
- 20.6k
5
votes
Use Android Shared library (.so) files in Linux
First, extract the whole APK (it's a renamed ZIP) and check whether there's not a x86 version of the binary, in addition of the ARM. It will depend on the best option to choose.
The following options ...
5
votes
Accepted
Opening mono droid .so files in .NET decompiler
If you're looking at a "normal" mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP'
/assemblies/Sikur.Monodroid.dll
/assemblies/...
- 348
5
votes
Working with Android obfuscation
Here's how I would approach it. Which isn't necessarily the best approach.
The first step is to find out what kind of obfuscation the app is using by looking around with your favorite decompiler. ...
- 1,972
5
votes
Accepted
Lifting up binaries of any arch into an intermediate language for static analysis
My recommendation is to use libVEX, as it's the most robust intermediate code library that I know of. It's part of Valgrind and supports a load of architectures. You can either use libVEX in a C/C++ ...
- 4,395
5
votes
Accepted
Mapping Android resource IDs to resource string
Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id.
In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
- 428
5
votes
Is there a name for this kind of "obfuscation" for the machine code from C++?
Here's a blog post describing this technique in a little more detail as well as some hints on how to undo it:
https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html
EDIT
...
- 35.6k
Only top scored, non community-wiki answers of a minimum length are eligible