Hot answers tagged

3

The encryption key is stored in the variable f4800b. It comes out to the following byte array. 43, 57, 97, -68, -63, -61, -40, 9, 50, 87, -104, 101, 63, 34, -78, 60 The cipher algorithm used is Triple-DES in ECB mode. It can be decrypted by the following snippet. Note that it requires the BouncyCastle Crypto provider for Java. import java.security.*; ...


3

If Jadx can not find any usage of a method this may be a false result: A lot of methods can't be decompiled by Jadx, this can happen especially on lengthy or complex methods. All method calls within such non-decompilable methods are invisible to the usage search. Additionally as far as I know Jadx has no functionality for resolving inheritance. This may ...


2

Yes, it's true. So far, Frida 12.11.14 does not support it. You can check https://www.slideshare.net/cisoplatform7/one-step-ahead-of-cheaters-instrumenting-android-emulators not sure if it's working...


2

The reason why your code is slow is not Frida but your code. Your code would be also slow when executed in plain J2SE Java. The simple reason is because you are reading the file byte by byte using an unbuffered FileInputStream which is the worst way you can read a file. Typically IO operations work on blocks of at least 4096 bytes (a typical block site in a ...


2

It is a bit unclear what do you mean by "library being called". If you want to know when the library is loaded, you may look for references to System.loadLibrary(string) or System.load(string) java functions. You might for example hook it using Frida. If you want to see when particular functions exported by the libusbhost.so are called, you also ...


2

I think your approach is generally correct. You probably can't connect to the Bluetooth because your additional code throws an exception somewhere. The best idea would be to check it during dynamic analysis. You can do it using for example Android Studio and smalidea plugin. As far as I see you don't store the result of your ByteArrayToString function call. ...


2

Dex files have a maximum amount of methods which they can contain, specifically 64k methods. Jar files are just zip files containing class files. Knowing both of these, all you need to do is dex2jar (or whatever you're using to create the jar file from the dex file) each dex file individually. Then unzip each file to the same directory, enter the directory ...


2

(Copy of an answer I gave on Stack Overflow) You could try injecting code into the Android app to sniff and dump SSL traffic. Take a look at https://github.com/5alt/ssl_logger (5alt's fork works with Android). Note that you need root for this. This works by hooking functions inside OpenSSL so that the raw traffic can be dumped before encryption/after ...


1

I'm going to guess this is MPEG Streaming of some manner. Here's what file run at various byte offsets into the first 10k bytes of the file produces: 598 /dev/stdin: MPEG-4 LOAS, 4 or more streams, 8 or more streams 838 /dev/stdin: MPEG-4 LOAS 1232 /dev/stdin: MPEG-4 LOAS 1696 /dev/stdin: MPEG sequence, H.264 video, baseline @ L 31 3204 /dev/stdin: MPEG ADTS,...


1

The segment register value applies from one change point until the next or end of segment, so you don't have to set it for each function, just once per segment or a contiguous ARM or Thumb chunk is enough. If you have many wrong intermediate changepoints from previous analysis, you can delete them en masse from the "Jump to segment register..." dialog (Ctrl-...


1

The app could be checking if its signature matches the signature of the key used to sign it. Refer to this SO post on how an android app can perform such a check. One way you may try to bypass the signature is to replace the reference signature in the apk with that of your key, after doing some reverse engineering of the apk. You may get information related ...


1

It looks like that you need to recheck your task_struct and thread_info offsets and the offset you're writing the addr_limit to is wrong. I think that the panic happens in if (signal_pending(current)) { in original source. Here is what you can do for checking the offsets: download the corresponding kernel source, compile it and use pahole (git, example ...


1

You asked how you should begin; the first step is likely to determine what is in each APK and if it is relevant to your goals. Simply extract them all and poke around a bit. Like Robert's comment says, Android App Bundles are a common format, and serve to modularize the app by shipping only the components needed for a particular device. So in this case, it ...


1

In Android there is a class named AsyncTask, designed for running processes in the background without blocking the UI. The developer extends AsyncTask and implements doInBackground() member function which is called by the system. After instancing the derived class and calling the instance's .execute() method, Android will, asynchronously call doInBackground()...


1

Try to learn the structure of the apk, learn SMALI, understand how the apk works, after understanding what your calls are like and learning smali, it is essential to be able to make calls from resources, but stay tuned for apk protections , even considering a somewhat rare factor, there are also several online tools to assist in this factor, with a simple ...


1

It's very likely you need to access the .value of the object. Alternatively you could also "stringfy" this which is an easy was to understand all the properties of the Object. Also, you do not need to perform an overload inside of your overload, just call the method directly using this.decryptAesCipherText() You can do all of the above with the fix ...


1

Replace the iget-object with the opcode you'd like, then smali the file back up. So for your case it would be; const-string v0, "FR" return-object v0


1

I will answer my own question because I figured out what was wrong. The app was not functioning correctly for a number of reasons that frustrated the analysis. For one, there were many advertising domains being contacted by the app on startup. The app made these connections over TLS and the connections would not succeed without trusting the proxy root CA ...


1

It seems that APK resources were obfuscated with AndroResGuard. ApkTool can (mostly) decompile it but compilation is performed with standard aapt2 and it does not understand 'drawable2' resource type, so it complains about invalid file path. You can find more info on this issue here: https://github.com/iBotPeaches/Apktool/issues/1719


1

They must be stored in some variable or in resources, You can check all the usages for that variable or where that resource was used in the classes, and backtrack and see whatever catches your interests


1

Turns out: adb shell uiautomator dump adb pull /sdcard/window_dump.xml path/to/output or adb shell uiautomator dump --compressed adb pull /sdcard/window_dump.xml path/to/output


1

2019-10-13 13:52:46.823 14636-14636/? W/dex2oat: Verification error Looks like dex2oat which is a DEX code compilation tool failed bytecode verification. At first in may seem odd this happens only at runtime, but keep in mind that Android preforms Just-in-time and Ahed-of-time compilation, and both tactics are performed on device. com...GSWebBridge....


1

Answer // Constants const kIgnoreArg = '-'; // Utils function pmalloc() { return Memory.alloc(Process.pointerSize); } function debug() { send({ event: 'DEBUG', data: Array.prototype.slice.call(arguments).join(' ') }); } // Globals var Metadata = {}; // < className, { pointer, methods < methodName, ...


Only top voted, non community-wiki answers of a minimum length are eligible