5 ms·

APKTool is amazing! I wrote an article on how to do end-to-end reverse engineering of Android apps using APKTool: https://yasoob.me/posts/reverse-engineering-an

by yasoob 5y ago

APKTool is amazing! I wrote an article on how to do end-to-end reverse engineering of Android apps using APKTool: https://yasoob.me/posts/reverse-engineering-android-apps-apktool/ https://yasoob.me/posts/reverse-engineering-android-apps-apk... I love using Jadx (https://github.com/skylot/jadx https://github.com/skylot/jadx) to get a better understanding of the code in Java and then use APKTool to reverse engineer, decompile and recompile the app If you are interested, Frida is also an amazing tool that makes certain type of reverse engineerings a lot easier compared to using APKTool. I wrote an article on that as well: https://yasoob.me/posts/reverse-engineering-nike-run-club-using-frida-android/ https://yasoob.me/posts/reverse-engineering-nike-run-club-us... Reverse engineering is a very exciting field and the moment you learn and figure out one concept you realize there is a lot more out there for you to figure out.

iotku 5y ago
This looks like a pretty decent write up at a quick glance, thanks! I've been toying around in the space a little bit (primarily around patching stuff to get past https pinning) but I've been meaning to get a better understanding on how stuff works rather than just throwing darts at the wall.
- deleted 5y ago
  [deleted]
elliottcarlson 5y ago
I wrote a script a few years back to automate decompiling, and weaving in code in to an APK, then recompiling it using a recipe type structure -- https://github.com/elliottcarlson/Otto https://github.com/elliottcarlson/Otto -- kind of abandoned it sadly, but figure it's worth sharing in case anyone has value in it.
- mmastrac 5y ago
  You might like the work the guys at Fullstory are doing. When I worked there on the mobile product, we were basically doing this professionally.
eixiepia 5y ago
This is the best article on Android app reverse engineering I have read. Thanks. Some more details on this step would be nice: > I currently have an iPhone so I installed the Android Emulator on my Linux machine and install the app on that. Then I launched mitmproxy and started intercepting the traffic from the emulator. Is this also the emulator from Android Studio? It would be very nice to intercept app traffic, without the need for a real device, but I have never been able to get it working.
- l-albertovich 5y ago
  Not OP but thought I could help : Usually you have to use (or create) an unpinner frida script. In my experience it's been easier to just write down custom dumpers to avoid having to deal with that and also modifying the request (at least some time ago mitmproxy downgraded http/2 to http) which would result in the endpoint being able to detect the tampering. As for the emulator, I haven't ever used the official one to work, I know some people who used Anbox in Linux but I don't have much to say because I use a real device most of the times (although I pleayer with ldplayer, bluestacks and genymotion all of which behaved nicely to some extent).
  - mhils 5y ago
    FWIW mitmproxy shouldn't downgrade HTTP/2, at least if you have a version that was released in 2016 or later. If that's not the case please feel free to file a bug and I'll look into it. :)
stuaxo 5y ago
You probably cant answer this here at least: Several UK TV apps are available on fire stick but not Android TV. I've seen people de-Amazonify older versions of these, would Apktool be a good place to do this myself ? I really just want to watch programs I already have access to on pretty similar hardware (Android TV), but getting more hardware for that just seems wasteful.
- l-albertovich 5y ago
  Not OP but thought I could help : To some degree yes, apktool will unpack the apk and disassemble the dex files in a way in which you can modify them and then compile the project again, sign it and deploy it (as long as your device supports it). In this case you would have to either modify the smali code itself to make those changes. When the modifications are basic such as changing a few instructions to avoid checks or adding simplistic payloads writing them in smali is just fine but if your modifications are more substantial I'd suggest creating a placeholder java project, decompiling it and adapting that smali so it's less of a pain in the neck. Another valid approach would be embedding a custom shared object or fridas gadget with a configuration file to run a payload on start. As for understanding what you need to change and how, jadx is the way to go most of the times but for some nastier code you can either use dex2java and then jd on the converted file or just go straight to the smali code (honestly that's not that usual) Also, while testing your patched version I'd suggest heavily using and abusing frida in a rooted device if possible. Note : I don't usually use the "create a java project" option so your mileage might vary but I recon it's probably the easiest.
thephoenix215 5y ago
Now only if there's an open source ide besides android studio that lets you edit apks on the fly that would be great....

by yasoob 5y ago

iotku 5y ago

This looks like a pretty decent write up at a quick glance, thanks! I've been toying around in the space a little bit (primarily around patching stuff to get past https pinning) but I've been meaning to get a better understanding on how stuff works rather than just throwing darts at the wall.

deleted 5y ago
[deleted]

elliottcarlson 5y ago

I wrote a script a few years back to automate decompiling, and weaving in code in to an APK, then recompiling it using a recipe type structure -- https://github.com/elliottcarlson/Otto https://github.com/elliottcarlson/Otto -- kind of abandoned it sadly, but figure it's worth sharing in case anyone has value in it.

mmastrac 5y ago
You might like the work the guys at Fullstory are doing. When I worked there on the mobile product, we were basically doing this professionally.

eixiepia 5y ago

This is the best article on Android app reverse engineering I have read. Thanks. Some more details on this step would be nice: > I currently have an iPhone so I installed the Android Emulator on my Linux machine and install the app on that. Then I launched mitmproxy and started intercepting the traffic from the emulator. Is this also the emulator from Android Studio? It would be very nice to intercept app traffic, without the need for a real device, but I have never been able to get it working.

l-albertovich 5y ago
Not OP but thought I could help : Usually you have to use (or create) an unpinner frida script. In my experience it's been easier to just write down custom dumpers to avoid having to deal with that and also modifying the request (at least some time ago mitmproxy downgraded http/2 to http) which would result in the endpoint being able to detect the tampering. As for the emulator, I haven't ever used the official one to work, I know some people who used Anbox in Linux but I don't have much to say because I use a real device most of the times (although I pleayer with ldplayer, bluestacks and genymotion all of which behaved nicely to some extent).
- mhils 5y ago
  FWIW mitmproxy shouldn't downgrade HTTP/2, at least if you have a version that was released in 2016 or later. If that's not the case please feel free to file a bug and I'll look into it. :)

stuaxo 5y ago

You probably cant answer this here at least: Several UK TV apps are available on fire stick but not Android TV. I've seen people de-Amazonify older versions of these, would Apktool be a good place to do this myself ? I really just want to watch programs I already have access to on pretty similar hardware (Android TV), but getting more hardware for that just seems wasteful.

l-albertovich 5y ago
Not OP but thought I could help : To some degree yes, apktool will unpack the apk and disassemble the dex files in a way in which you can modify them and then compile the project again, sign it and deploy it (as long as your device supports it). In this case you would have to either modify the smali code itself to make those changes. When the modifications are basic such as changing a few instructions to avoid checks or adding simplistic payloads writing them in smali is just fine but if your modifications are more substantial I'd suggest creating a placeholder java project, decompiling it and adapting that smali so it's less of a pain in the neck. Another valid approach would be embedding a custom shared object or fridas gadget with a configuration file to run a payload on start. As for understanding what you need to change and how, jadx is the way to go most of the times but for some nastier code you can either use dex2java and then jd on the converted file or just go straight to the smali code (honestly that's not that usual) Also, while testing your patched version I'd suggest heavily using and abusing frida in a rooted device if possible. Note : I don't usually use the "create a java project" option so your mileage might vary but I recon it's probably the easiest.

thephoenix215 5y ago

Now only if there's an open source ide besides android studio that lets you edit apks on the fly that would be great....