Beginners Guide to Reverse Engineering
Android Apps
SESSION ID: STU-W02B
Pau Oliva Fora
Sr. Mobile Security Engineer
viaForensics
@pof
Agenda
Anatomy of an Android app
Obtaining our target apps
Getting our hands dirty: reversing the target application
Demo using Santoku Linux
#RSAC
Anatomy of an
Android app
Anatomy of an Android app
Simple ZIP file, renamed to
APK extension
App resources
Signature
Manifest (binary XML)
#RSAC
Obtaining our target
apps
Getting the APK from the phone
Backup to SD Card:
APKOptic
Astro file manager
etc
#RSAC
Getting the APK from the phone
Using ADB (Android Debug Bridge):
adb shell pm list packages
adb pull /data/app/package-name-1.apk
#RSAC
Downloading the APK from Google Play
Using unofficial Google Play API:
https://github.com/egirault/googleplay-api
Using a web service or browser extension:
http://apps.evozi.com/apk-downloader/
http://apify.ifc0nfig.com/static/clients/apk-downloader/
#RSAC
Downloading the APK from Google Play
Using unofficial Google Play API:
https://github.com/egirault/googleplay-api
Using a web service or browser extension:
http://apps.evozi.com/apk-downloader/
http://apify.ifc0nfig.com/static/clients/apk-downloader/
#RSAC
Getting our hands
dirty: reversing the
target application
Disassembling
DEX
Smali
#RSAC
11
Apktool
apktool https://code.google.com/p/android
-apktool/
Multi platform, Apache 2.0 license
Decode resources to original form
(and rebuild after modification)
Transforms binary Dalvik bytecode
(classes.dex) into Smali source
#RSAC
12
Smali
#RSAC
13
Decompiling Java Decompiler
DEX
JAR
JAVA
#RSAC
14
Dex2Jar
dex2jar - https://code.google.com/p/dex2jar/
Multi platform, Apache 2.0 license
Converts Dalvik bytecode (DEX) to java bytecode (JAR)
Allows to use any existing Java decompiler with the resulting JAR file
#RSAC
15
Java Decompilers
Jd-gui - http://jd.benow.ca/
Multi platform
closed source
JAD - http://varaneckas.com/jad/
Multi platform
closed source
Command line
Others: Dare, Mocha, Procyon,
#RSAC
16
Decompiling Android (Dalvik) decompiler
DEX
JAVA
#RSAC
17
Dalvik Decompilers
Transforming DEX to JAR looses important metadata that the
decompiler could use.
Pure Dalvik decompilers skip this step, so they produce better output
Unfortunately there are not as many choices for Android decompilers
as for Java decompilers:
Open Source: Androguards DAD - https://code.google.com/p/androguard/
Commercial: JEB - http://www.android-decompiler.com/
Others?
#RSAC
18
Demo Santoku
Demo Santoku Linux
Santoku Linux https://santoku-linux.com/
Mobile Forensics
Mobile Malware analysis
Mobile application
assessment
#RSAC
20
Summary
APK files are ZIP files, can be extracted with any unzip utility
Apktool helps extracting binary resources, and allows repacking
Dex2jar converts Dalvik Bytecode to Java Bytecode
Pure Android decompilers are better
Santoku Linux has all the tools you need to reverse engineering
mobile apps
#RSAC
21
Q&A | Contact | Feedback
Thanks for listening
@pof
github.com/poliva
poliva@viaforensics.com
#RSAC
22
