3 ms·

Yeah calling everything “a” is pretty much the only thing Proguard (the default Android obfuscator) really does that impacts reverse engineering in any way. Mos

Yeah calling everything “a” is pretty much the only thing Proguard (the default Android obfuscator) really does that impacts reverse engineering in any way. Most reverse engineers I know working with Android already have good tools to deal with this (interactive renaming, very similar to refactor renaming, works wonders; as does the fact that most Android code leaves class and sometimes method names intact in logging and debug infrastructure!). Renaming classes and methods into annoying names is something I see with .NET much more frequently - one obfuscator I’ve seen basically uses different mixes of Unicode spaces to name everything which is pretty cute. Unfortunately most of these techniques are easy to work around as a reverse engineer.

atesti 7y ago
Which are the best tools to reverse engineer Android Apps? For me jd-gui was not working very well, it was not able to decompile many long methods and just threw errors. Is there any actively developed JAR or dalvik decompiler?
- krackers 7y ago
  JEB decompiler (https://www.pnfsoftware.com/ https://www.pnfsoftware.com/) seems to be the standard
- mdaniel 7y ago
  I doubt there are "best," as each tool has strengths and weaknesses, along with the workflow and prerequisites that go with them, but I've had good experience using dex2jar and then feeding the jar to procyon (for clarity I am just investigating normal apps, and not malware samples) https://github.com/pxb1988/dex2jar#readme https://github.com/pxb1988/dex2jar#readme https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompile...
- nneonneo 7y ago
  I used a mix of apktool (reading raw Smali code) and jd-gui for a while, but recently transitioned mostly to using JADX: https://github.com/skylot/jadx https://github.com/skylot/jadx JADX is really nice - there’s a decent GUI, and it also supports exporting the whole thing as an Android Studio project so you can directly take advantage of the refactor tools there for more deobfuscation. It also has a smarter decompiler than JD as it’s specialized to go straight from dex to Java (JD makes a trip through the classic JVM class format, which loses some nuance of dex). Of course, many of the apps I’m taking apart have native components, for which I use GHIDRA and IDA.

atesti 7y ago

Which are the best tools to reverse engineer Android Apps? For me jd-gui was not working very well, it was not able to decompile many long methods and just threw errors. Is there any actively developed JAR or dalvik decompiler?

krackers 7y ago
JEB decompiler (https://www.pnfsoftware.com/ https://www.pnfsoftware.com/) seems to be the standard
mdaniel 7y ago
I doubt there are "best," as each tool has strengths and weaknesses, along with the workflow and prerequisites that go with them, but I've had good experience using dex2jar and then feeding the jar to procyon (for clarity I am just investigating normal apps, and not malware samples) https://github.com/pxb1988/dex2jar#readme https://github.com/pxb1988/dex2jar#readme https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompile...
nneonneo 7y ago
I used a mix of apktool (reading raw Smali code) and jd-gui for a while, but recently transitioned mostly to using JADX: https://github.com/skylot/jadx https://github.com/skylot/jadx JADX is really nice - there’s a decent GUI, and it also supports exporting the whole thing as an Android Studio project so you can directly take advantage of the refactor tools there for more deobfuscation. It also has a smarter decompiler than JD as it’s specialized to go straight from dex to Java (JD makes a trip through the classic JVM class format, which loses some nuance of dex). Of course, many of the apps I’m taking apart have native components, for which I use GHIDRA and IDA.