11 ms·
How I defeated an anti-tamper APK with some Python and a homemade Smali emulator
- torkable 10y agoWhat's an APK
- abpavel 10y agoThis stomps on motivation to develop any novell code, because for all the years of hard work you put into r&d, there will alway be a lot of people who are just waiting for something to slip through your fingers, so they can steal it and call it theirs.
- evilsocket 10y agoI don't see how publishing a research without disclosing specific details about the app itself or any kind of "crack" could stomp on motivation to develop something ... unless you trust in "security through obscurity" of course ... which was proven more than once to be a fail :)
- abpavel 10y agoSo what should I do? My patents have limited geopolitical enforcement jurisdictions, whereas the Internet is global. Plus, I'm deemed evil, even though It's not easy to create something novel. MP3 patent https://www.google.com/patents/US5812672 https://www.google.com/patents/US5812672 was nice, and enforced time to time, but for a small startup the barrier between the abyss and land is just a step away.
- viraptor 10y agoJust like continuously breaking all the DRMs stopped any new movies from being produced, right?
- evilsocket 10y ago^ THIS ^
- pink_dinner 10y agoMulti-billion dollar movie studios are much different than a small company releasing an Android App. They can handle the loss and make it up with licensing deals. The small company will go out of business in an already ridiculously difficult market. It only pushes out the small companies and makes way for an app store environment where only large companies can survive. The exact same thing happened with the music industry over the past decade (filesharing was supposed to help the indy artist..or so many, like you, claimed)
- Natsu 10y agoYou just reminded me of how much of the 09 F9 11 02 9D number I still remember after all this time.
- abpavel 10y agoEveryone remembers that number, but you didn't use it for profit. I'm talking about purposefully reverse engineering a piece of software, to build an internal version of the solution, with direct impact to the inventor, not a global corporation. And it's not a web or a games or a movies or a piece of music.
- Natsu 10y agoCorporations are made of people, too. (Though in a way that somehow reminds me of Soylent green...)
- golergka 10y agoNot blockbuster movies, no. But all the small indie games (not indie superhits your hear about!) both for iOS, Android and PC are typically have 10x, 100x more downloads on Torrents than purchases. Same goes for small label releases on Beatport, Bandcamp and Juno: they get hundreds of individual sales on those sites after the tracks are out on trackers. Don't know about movies though; but in the industries I'm familiar with, it's the little guys who get screwed mostly, not the big ones.
- duncan_bayne 10y agoI upvoted for discussion, but I actually disagree. Consider Web development as a major counterexample.
- evilsocket 10y agommm would you please elaborate?
- fapjacks 10y agoYou pretty much publish everything related to your job if you're a web developer. People are continually creating awesome things as web developers, despite their source code being out there for everyone to see. There isn't a "copyright violation holocaust" happening as implied by the top comment.
- abpavel 10y agoWell, obviously, I'm not a web developer. Nor am I a music producer, nor a film maker. As the world becomes increasingly more digital, more technologies can be expressed as code. You all like MPEG-4, but many patents are involved there, such a http://www.google.com/patents/US6092120 http://www.google.com/patents/US6092120
- tyingq 10y agoShould be interesting to see what webassembly does to this existing ecosystem.
- onion2k 10y agoI believe there's more profit-oriented piracy of SaaS based businesses than traditional software. It's rare that someone will take an app, crack it, and start selling it under their own brand. People clone apps but in general they've remade the code entirely by looking at the software and coding their own version. Conversely however, I do hear about companies that have taken someone's SaaS app by dumping the front-end code, and building their own backend, and releasing it with absolutely no changes to the elements they've stolen. This may be due to my filter bubble making it so I hear more about web apps (I write web based apps) but anecdotally it does seem that SaaS is not a protection against piracy.
- kuschku 10y agoYou realise that you never had any copyright to your algorithms, etc anyway? If you spend years of R&D on algorithms, patent them. But boilerplate code can neither be patented nor copyrighted (except in its source form, but the binary, for example, can’t), so you never owned anything to begin with. Disclaimer: This is just a general info about EU law, this is not legal advice, I am not a lawyer.
- abpavel 10y agoBut I do have a patent, in multiple countries, and have legal advice. How is that suppose to stop people like the op? He clearly didn't bother with any of it, and EFF is on the side of crooks like him. So I spend all my fortune on R&D, spend another fortune on legal, and the result is that my kids have nothing to eat, because there is always a way when none of it means squat. Whether it's RCA ripping off Farnsworth, who has to fight all his life to protect his invention, or Edison blatantly stealing from Melies by simply changing the titles in his movies and swapping French text for English.
- kuschku 10y ago> Whether it's RCA ripping off Farnsworth You realize Farnsworth ripped off Braun? Also, if you have a patent, you can always sue. That’s not an issue.
- waspleg 10y agoI'm a card carrying EFF member. The EFF supports Internet Freedom and Privacy (those things go hand in hand). Without even looking, if they're against you the chances are they're in the right. I've yet to see them do anything I disagree with as someone who considers those points very important.
- slededit 10y ago> Without even looking, if they're against you the chances are they're in the right This is a very dangerous attitude to have regardless of who it concerns.
- cyphar 10y agoWhy does your novel code need to be proprietary?
- abpavel 10y agoBecause I've invented something unseen before, spent a fortune developing a method, patented it, also spending a fortune on legal, and don't want script kiddies to mooch off my talent that easily. I have a sense of proprietorship and want to own something. Patents mean jack squat to people like op, and I'm stuck between a rock and a hard place. If I invoke my patent, I'm deemed "evil" because I have a patent, and will have to spend lifetime in courts protecting my invention. If I compile, I'm deemed "evil" because there is no such thing as innovative code.
- dkopi 10y ago> and don't want script kiddies to mooch off my talent that easily. We all "mooch" off of other's talents. That's the beauty of our industry. We get inspired, we share, and we base our works on the works of others. That's why its so important to pair huge investments in R&D with awesome business people. Don't obsess about protecting your inventions. Obsess about getting your inventions out there, selling, supporting, and custom tailoring it for what customers really need.
- abpavel 10y ago> Obsess about getting your inventions out there That's what I want to do, but all of the legal advice I got was to do otherwise. At first I thought that losing all that you've built in an instance was a rare event, but the more I talked to business owners and lawyers, I haven't gotten a single advise to release it in any way that would put it outside of my control. And the thing they cited is almost exactly of what OP describes: once someone else has your code, the whole world has it. And it hurts that I careless about the code - it can be rewritten in a million ways. What I care about is what code does, and the multitude of GloboCorps working on the same issue in vane, and their ability to reproduce our work in months once they understand the secret sauce.
- hawleyal 10y agoFlamebait
- kuschku 10y agoIt’s always funny how large developers – say, Google – still try to obfuscate their code when it’s so easy to reverse. Even better, as in many legislations a derivate of manually deobfuscated code does not count as derivate of the original source, they even give up their copyright on their code, practically. I’m surprised that this still happens. By now anyone should know that if you can run a piece of code, you can decompile, deobfuscate, and understand it. DRM and obfuscation only work to waste a week or two of the time of the person taking it apart.
- raverbashing 10y agoEasy to reverse, but not trivial. 100% protection does not exist, which doesn't mean you shouldn't try to make it a bit difficult (keeping honest people honest and all that)
- Aissen 10y ago> Even better, as in many legislations a derivate of manually deobfuscated code does not count as derivate of the original source, they even give up their copyright on their code, practically. I never heard that, source ? It's not really "clean room".
- kuschku 10y agoIt’s not clean room, but the ECJ has allowed it one time already. Which did set an interesting precedent.
- Aissen 10y agoI'm guessing you're talking about this then: https://en.wikipedia.org/wiki/SAS_Institute_Inc_v_World_Programming_Ltd#Court_of_Justice_of_the_European_Union_reference https://en.wikipedia.org/wiki/SAS_Institute_Inc_v_World_Prog... I still don't see how it's a derivative of RE'd code (like https://news.ycombinator.com/item?id=3919250 https://news.ycombinator.com/item?id=3919250 was). It's just the classic "reverse engineering allowed for compatibility".
- marcelftw 10y agoThey should have used JEB and save some time. https://www.pnfsoftware.com/ https://www.pnfsoftware.com/ (not my product)
- evilsocket 10y agomaybe I tried and it didn't work?
- StavrosK 10y agoDid you? :P
- deleted 10y ago[deleted]
- unlinker 10y agoSeriously, it's 2016, stop it with the memes.
- evilsocket 10y agooh come on! it doesn't hurt smiling a little bit from time to time you know? :)
- acqq 10y agoUnfortunately often the only person smiling is the author, while others just cringe.
- hawleyal 10y agoSome people find them charming, and like a little chuckle with their articles.
- calebfenton 10y agomaybe you could make a chrome extension which blocks all forms of fun and frivolity. you could just hide images from various meme sites, maybe do some checksum comparisons?
- unlinker 10y agoI don't have anything against fun things, but seeing the same memes we have all seen every day for years now is not really funny.
- calebfenton 10y agoon one hand, I completely agree with you. on the other hand, i've had to make presentations and talks and the stuff just looks so dry and boring and people respond surprisingly well to old jokes. if you don't include any sort of lulz they just sit there thinking they're learning, but if you mix in a few memes, it helps wake them up and they start to pay attention.
- 10y ago
- dkopi 10y agoMy highlights after reading this: 0. Really impressive work. 1. Great link with the Dalvik opcodes manual http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html This came up with a google search: https://source.android.com/devices/tech/dalvik/dalvik-bytecode.html https://source.android.com/devices/tech/dalvik/dalvik-byteco... 2. If you run in to obfuscated smali filenames in the APK, a simple search replace will help you rename the files. 3. Instead of trying to understand the proprietary encryption/decryption, just run the decryption code without understanding it. 4. OP Created a smali emulator for this task (#3). Only supporting a small subset of dalvik instructions. Which means than for now, the emulator can be defeated using as many dalvik opcodes as possible in your encryption/decryption code. A simple check-cast for example (Throw a ClassCastException if the reference in the given register cannot be cast to the indicated type.) can break the emulator. 5. Being written in python, relying heavily on regular expressions and without much algorithmic improvements (the opcode lookup for example is a for loop instead of a lookup table) - there's a lot to improve the emulator performance, but this is an incredible first step.
- evilsocket 10y agothanks for the great feeedback! i'll treasure your words :)
- kanzure 10y ago> Instead of trying to understand the proprietary encryption/decryption, just run the decryption code without understanding it. When I have encountered this sort of problem in the past, I would drop the encryption module into another Android app and directly call the functions. I would then run the other Android app on a phone or Android emulator. Custom emulation seems unnecessary for most cases.
- falcolas 10y agoUnnecessary, but fun.
- calebfenton 10y agoshameless plug: this is basically what dex-oracle does https://github.com/CalebFenton/dex-oracle https://github.com/CalebFenton/dex-oracle It has modules which look for patterns in code. Then you can tell it to run some method from the original app to understand what the code should be. Then, you can replace the obfuscated code with whatever you computed.
- tyingq 10y agoReminds me of the reverse engineering of the dropbox client: https://www.usenix.org/system/files/conference/woot13/woot13-kholia.pdf https://www.usenix.org/system/files/conference/woot13/woot13...
- ultramancool 10y agoGuessing this is most likely just some commercial obfuscator - Are there not generic deobfuscators in Java or Android land? I know several for .NET including SimpleAssemblyExplorer and De4Dot (though de4dot also includes several specific deobs). EDIT: Looking around you might try something like https://github.com/CalebFenton/simplify https://github.com/CalebFenton/simplify or https://github.com/contra/JMD https://github.com/contra/JMD after converting with dex2jar or similar.