10 ms·
Apk.sh is a Bash script that makes reverse engineering Android apps easier
- varenc 4y agoI love seeing more excellent tooling made with bash/shell scripts. For situations like this one, where all the underlying heavy lifting is done with other CLI utilities, shellscript is the perfect fit.
- simmonmt 4y agoIME that's true until around 250 lines or so (this one is 500+). Then you've passed the point where "rewrite it in something more scalable / testable / maintainable" can easily be done, and you start having endless iterations of "it needs to be rewritten but I just want this one feature added so we'll do the rewrite later." And heaven help you if the script changes owners, gets additional owners, or you have to pick it up again after ignoring it for a year. That's not to say the above doesn't happen with other languages/systems. It most certainly does. It just seems to happen faster in shell (especially when people start getting adventuresome in their use of fancy shell features).
- chasil 4y agoThe Android system shell is the MirBSD Korn shell. Why not use the preferred tool? Otherwise, why not write it in dash for strict POSIX conformance? I do admit that there are some profound bash applications that are important to me, principally rear.
- danuker 4y agoScripts like this empowering the end-user is why I consider the Android ecosystem superior.
- Waterluvian 4y ago*superior when evaluated against one of many different criteria for what’s important to many different users. (A good time to remind tech people: 98% of users are not our user persona)
- otachack 4y agoRight, but the transparency and access allow the 2% to put in the work and advocate for the rest.
- dec0dedab0de 4y agoI think 98% is a bit high, but even if it were true the desires of the masses only matter if you're trying to sell something. I think it's safe to just assume that all opinions and suggestions on hn are for a technical audience.
- Waterluvian 4y agoThe timeless problem is when the n% confidently declare they know what’s best and impose their perspective on everyone else. The most common way I see this happen is the pitfall of someone assuming everyone experiences something the same way they do.
- realusername 4y agoThat's fine, nobody is being forced to customise their system if they don't want to, the option should be there.
- saagarjha 4y agoSounds like a recommendation for the author of the script, rather than the platform, no?
- black3r 4y agoi used to be an android poweruser in high school and college, I rooted my phones, played around with lots of custom roms, had a terminal emulator and full power of arm debian installed in a chroot environment, tried different keyboard apps, launchers, and all other customization possibilities... then I started working full-time and had way less free time and realized 99% of the time I now use my phone to read news sites and take quick photos, and then switched to iPhone...
- danuker 4y agoAmong the top 5 deathbed regrets is working too much. Many indicators of quality of life face diminishing returns past a $30k/yr (2005) threshold.
- ta988 4y agoI switched to a job that gives me more free time, can't be happier. Money past a comfortable level (enough for food, living and some savings) clearly can't buy not having to run around everywhere and think about your next move all the time. I've seen so many people regretting they spent their life just for their job(s) chasing they didn't even knew what. I feel so sorry when I ask how are you and the reply is "busy".
- quacksilver 4y agoIs it more socially acceptable or expected in society to say 'I worked too much' rather than 'my family and wife were dull and annoying and took up loads of time, I wish I had got better at my passions / done more research instead' or similar platitudes? I imagine some people who genuinely think stuff similar the latter won't say it, and others may have it written off as deathbed delirium / psychosis and ignored if they do
- danuker 4y agoI believe them. I remember calculating the optimal amount to work, to maximize non-work non-sleep healthy life expectancy, and it was somewhere around 2 hours per day in my case. Accounting for retirement, it'd be around 4 hours. If you work more than optimal, you lose free time.
- userbinator 4y agoI've noticed that a lot of the people who do Android modding, custom ROMs, etc. don't otherwise actually have any formal training in software or computing; they're just pursuing a goal of "I want my phone to do X" and end up learning a lot in the process. Indeed, this may be their first and only exposure to Java.
- mmastrac 4y agoIf you haven't tried Jadx [1], give it a shot. It's by far the easiest way to reverse Android APKs. It doesn't do patching or reassembly, but I used it for reversing the Delong'hi APK for longshot [2][3] and the quality of output was fantastic. Note that scripts like this are extremely useful, but in the long term they're cobbling together a lot of tools and will become brittle or difficult to use across versions. I suggest that even if it works for you today, understanding exactly what's happening under the hood will help if the tool becomes unsupported long-term. [1] https://github.com/skylot/jadx https://github.com/skylot/jadx [2] https://github.com/mmastrac/longshot https://github.com/mmastrac/longshot [3] https://grack.com/blog/2022/12/02/hacking-bluetooth-to-brew-coffee-on-github-actions-part-2/ https://grack.com/blog/2022/12/02/hacking-bluetooth-to-brew-...
- djmips 4y agoDid you do this just for fun ( which is awesome ) or do you have some longer term goal?
- motohagiography 4y agoThese are great. I used jadx to pull apart a conference attendee app I was supposed to install to see what it hoovered up. There is a level of reverse engineering that people can just get comfortable with doing without ahcieving the virtuosity of the stuff people publish papers and get talks about. Simple things like, what SDKs does this thing use (adware), what external APIs does it call (trackers), what interfaces does it use (mic, gps, etc), what data does it hoover up (contacts, sms messages, etc), what parties does it send them to, how much effort do the authors go to obfuscate or hide what they are doing (packers, code obfuscators), does it use a static encryption key or derive one from predictable components, does it have hidden features from triggers and arguments - are all achievable for someone with a bit of interest and an afternoon. The more niche the app, the less sophisticated the protections on it, I find.
- blacksmith_tb 4y agoI have used ClassyShark[1] to get some of that (from F-droid) with pretty good results. 1: https://fossdroid.com/a/classyshark3xodus.html https://fossdroid.com/a/classyshark3xodus.html
- jacob019 4y agoIt seems to be made for injecting Frida into APKs. I'm having trouble understanding what Frida is. Can I do something cool with it?
- saagarjha 4y agoFrida lets you hook behavior in apps. Think of it like mocking but for reverse engineers.
- jacob019 4y agoWould this help to reverse engineer an encrypted API?
- jefficient 4y agoYes. For example you could hook the function that encrypts the outgoing payload and print it out before it is encrypted. And then for decryption you could hook the function that decrypts the payload as it comes in print out the result. Going further, the API likely uses some secret key for encryption/decryption and you could hook that value out of the app as well.
- SeriousM 4y agoWow, that sounds really cool! Searching around i found this list: https://github.com/dweinstein/awesome-frida https://github.com/dweinstein/awesome-frida
- varenc 4y agoSadly the name "Frida" suffers from poor googleability. But here you go: https://frida.re/ https://frida.re/ Basically it's _the_ reverse engineering toolkit for security researchers. Has excellent support across Android, iOS, macOS, Windows, etc.
- biosboiii 4y ago
- jrm4 4y agoWhile I'm here: What is going on with "Android Emulation on Linux???" I feel like I have to be missing something obvious, I can't see how it can be so darn hard to just run android apps on (desktop) Linux given..you know, that it is Linux.
- tpush 4y agoThe API of 'Linux' is its system calls, and I guess very few Android apps are coded against that; most use the Android SDK. So presumably Android's services and API surface need to be ported to desktop Linux, which is probably very involved.
- MishaalRahman 4y agoIs it hard? Check out Waydroid if you haven't already. https://waydro.id/ https://waydro.id/
- jrm4 4y agoHa. I'm such a Wayland hater. FINE. Maybe this will be thing...
- bembo 4y agoWhy do you think it's hard? Waydroid is very good.
- tommieb 4y agoReminds me of the old days of running this tool - kitchen sink, https://forum.xda-developers.com/t/kitchen-android-kitchen-v0-224-linux-mac-windows.633246/ https://forum.xda-developers.com/t/kitchen-android-kitchen-v... those days of cyanogenmod/rolling your own rom based off Gingerbread 2.3.7 and hacking... happy memories :)
- Group_B 4y agoYou recommend any projects that are similar to this and up to date?
- lazycow 4y agoLineageOS build guides are a great resource to get started: https://wiki.lineageos.org/build_guides https://wiki.lineageos.org/build_guides
- Abishek_Muthian 4y ago+ 1. In case anyone wants to use Play store apps with push notifications(GCM) on LineageOS, I highly recommend MicroG+F-droid bundled version[1]. If not for privacy, De-googling results in excellent power backup. [1]: https://lineage.microg.org/ https://lineage.microg.org/
- geokon 4y agoI don't really know much about this, but since microG reimplements the GooglePlay API.. doesn't that mean it must phone back to Google servers? If you want privacy, I assume you shouldn't use any of these?
- Abishek_Muthian 4y agoFor absolute Privacy (If that's even possible without going off-grid), Then yes. But if you need to use apps which you trust but it depends upon proprietary Google bits then microG is the best alternative now. microG > Open Gapps > Gapps e.g. Signal needs GCM to send notifications, If it doesn't find one it will revert to pull notifications. Pull notifications are unreliable and are subject to being killed by battery management due to power consumption. Not to mention missing notifications during emergencies could be dangerous. microG is totally configurable, You don't need a Google account to use it. So even if Google knows about your device, It would require parallel construction to identify you personally. I think that's even better than using any Google app on iOS.
- fareesh 4y agoCan this be used to create a version of YouTube with no ads?
- Lammy 4y agohttps://github.com/revanced/revanced-manager https://github.com/revanced/revanced-manager
- Mogzol 4y agoThat already exists https://github.com/revanced https://github.com/revanced
- fareesh 4y agoCool they resurrected vanced - I must have missed this
- dariosalvi78 4y agohttps://newpipe.net/ https://newpipe.net/
- Sugimot0 4y agoIIRC it should be noted that newpipe is more resistant to getting taken down because they're utilizing public api data and not altering youtube's app. Not sure if the new revanced is still a modded youtube apk.
- ris58h 4y agoYou could use Firefox with uBlock Origin and Video Background Play Fix extensions. Just saying.
- SeriousM 4y agoFor a complete integration into vscode one can use ApkLab https://github.com/APKLab/APKLab https://github.com/APKLab/APKLab
- orliesaurus 4y agoIf anyone in this thread is really into this stuff I suggest you look into Lucky Patcher too!
- tyilo 4y agoSeems similar to my own script: https://github.com/tyilo/apkmagician https://github.com/tyilo/apkmagician
- ngcc_hk 4y agoFinally!!! Well, this is not a news site but a <<hacker>> news site. Great!!!
- julkali 4y agoThe problem with tools that rely on apktool is that they tend to fail to patch the most sophisticatedly obfuscated apps typically banking apps. This is because they abuse implementation details in the Android source to essentially make it possible to unpack the app while installing, but impossible to repackage it (usually using sketchy non-utf8 characters and broken Manifests). The only way I found to patch these apps is by making them debuggable and then injecting Frida at run-time. This is possible by delicately patching the Manifest as precisely as possible. Full disclosure, I made a Python script without any dependencies: https://github.com/julKali/makeDebuggable https://github.com/julKali/makeDebuggable