29
votes
What are the tools use for reverse engineering android apk?
There are many tools, some are more low-level and some build on top of the low-level tools to make nicer and more complete tools.
Here are my favorites:
JADX - GUI (and Command line) to produce ...
- 421
12
votes
How do I reverse-engineer .so files found in Android APKs?
Use android-ndk, https://developer.android.com/ndk/downloads/index.html.
You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
- 121
12
votes
How difficult is to decompile C++ file?
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
- 10.9k
10
votes
Accepted
print [B byte array in frida js script
var ret = this.fn();
var buffer = Java.array('byte', ret);
console.log(buffer.length);
var result = "";
for(var i = 0; i < buffer.length; ++i){
result+= (String.fromCharCode(buffer[i]));
}
...
- 116
9
votes
Accepted
Find function in a stripped dynamic ELF library
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
- 6,100
7
votes
Accepted
Is there a name for this kind of "obfuscation" for the machine code from C++?
Unfortunately it is not enough code to say exactly what it is, but,
as @0xec said, it looks very much like control flow flattening.
Usually such kind of code transformations are done automatically ...
- 8,528
7
votes
Android- hiding private keys in .so file
If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story.
Obfuscation can slow people down, but it won't stop everyone, ...
- 2,012
7
votes
What are the tools use for reverse engineering android apk?
If you want to modify code, then the only real option I know of is bak/smali, which apktool provides a helpful wrapper for.
If you merely want to understand the code, there's lots of options. For ...
- 2,012
7
votes
Accepted
does android apk contain game mechanics?
Short answer
Single player games most frequently do contain all the information hard coded in the APK.
Multiplayer games usually require more work such as packet analysis and more black box work but ...
- 364
7
votes
Accepted
Disassemble ELF - PC is set to 0?
In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime.
In ...
- 19.2k
7
votes
Accepted
How does API call work on Android (NDK)?
To answer your question, let us first set a solid ground in terms of entities and definitions.
ELF stands for "Executable and Linkable format".
That is, it defines the structure and shape of two ...
- 86
6
votes
Use Android Shared library (.so) files in Linux
First, extract the whole APK (it's a renamed ZIP) and check whether there's not a x86 version of the binary, in addition of the ARM. It will depend on the best option to choose.
The following options ...
6
votes
How do I reverse-engineer .so files found in Android APKs?
You can also reverse-engineer APK files directly on an android device.
Java part: Show Java
.so files: Android disassembler.
(Disclaimer: I 'm the developer)
Version 1.4.2 release.
Android-...
- 341
6
votes
Accepted
gdb shows wrong instruction
Your instructions shown by Ida are Thumb-mode instructions. The easiest way to verify this is by checking the addresses - each instruction has 2 bytes. Gdb doesn't know this however, and assumes 4 ...
- 13k
6
votes
How to detect JNI calls from smali code?
You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
- 591
6
votes
Accepted
Decrypting Lua Files
xxtea encrypt with KEY: sxpDM2018
result
FightLogic.lua
how find the KEY
IDA look at Function window
press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
- 131
6
votes
Accepted
Where is Android binary XML format documented?
There is no actual documentation or specification. You pretty much just have to look at the source.
See, e.g.
https://android.googlesource.com/platform/frameworks/base/+/master/libs/androidfw/...
- 591
5
votes
Accepted
Lifting up binaries of any arch into an intermediate language for static analysis
My recommendation is to use libVEX, as it's the most robust intermediate code library that I know of. It's part of Valgrind and supports a load of architectures. You can either use libVEX in a C/C++ ...
- 4,558
5
votes
Is there a name for this kind of "obfuscation" for the machine code from C++?
Here's a blog post describing this technique in a little more detail as well as some hints on how to undo it:
https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html
EDIT
...
- 36.9k
5
votes
Animal Crossing: Pocket Camp .zdat File
The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
- 326
5
votes
Does Google encrypt APK when downloading it from Play Store?
Disclaimer: I took a different approach to find your solution. I don't use Fiddler, it has many adwares. You may use Fiddler and may find same result as I did.
Does anyone know how to unpack/...
- 1,579
5
votes
Disassemble ELF - PC is set to 0?
While the other answer is not wrong, it does not actually cover the real issue: how come that calling a zero address does not lead to a crash?
AFAIK there is no official standard or complete ...
- 36.9k
5
votes
How to reverse engineering a proguarded .apk?
Without the proguard mapping, this is not possible. That information is simply no longer contained in the dex file.
The best you could do would be to manually rename the methods, etc. with your own ...
- 591
4
votes
Accepted
Call Android method without running whole Android-App
You should be able to write a separate application that dynamically loads the dex file from the app that you are interested in using DexClassLoader, allowing you to construct classes and call methods ...
- 591
4
votes
Lifting up binaries of any arch into an intermediate language for static analysis
I reviewed about 14 intermediate representations for the project I'm working on. It seems like any author (even for PhDs and master thesis) found all other existing IRs lacking and invented their own ...
- 2,906
4
votes
Lifting up binaries of any arch into an intermediate language for static analysis
I would like to add BAP to your list. Disclaimer, I'm one of the authors.
We just released the 1.0.0 version. This is our tenth public release (after about ten years of in-house development). ...
- 141
4
votes
How do I reverse-engineer .so files found in Android APKs?
You can also try the Snowman tool: https://derevenets.com/.
NB: the original author appears to have "pulled" it. Several forks exist, e.g. this one not connected to original) or these.
...
- 41
4
votes
Decompiling 64bit ARMv8 Android .so library
The first tool is IDA decompiler (a plugin for IDA).
As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see here for more details, each of them costs ...
- 8,528
Only top scored, non community-wiki answers of a minimum length are eligible