Android Reverse Engineering
5 likes1,536 views
The document discusses reverse engineering in Android, focusing on understanding app behavior and data extraction using tools like dex2jar and apktool. It explains the process of decompiling an APK, analyzing smali code, and modifying applications by recompiling them. It provides examples of Android bytecode, method signatures, and details on implementing and modifying interfaces and classes in the reverse-engineered code.
![Demo
public class XposedHook implements IXposedHookLoadPackage {
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return;
Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a",
lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "a",
int.class, int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
Integer first = (Integer) param.args[0];
Integer second = (Integer) param.args[1];
Integer result = first * second;
param.setResult(result);
}
});
}
}](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-113-320.jpg)
![Demo
public class XposedHook implements IXposedHookLoadPackage {
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return;
Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a",
lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "a",
int.class, int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
Integer first = (Integer) param.args[0];
Integer second = (Integer) param.args[1];
Integer result = first * second;
param.setResult(result);
}
});
}
}](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-114-320.jpg)
![Demo
public class XposedHook implements IXposedHookLoadPackage {
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return;
Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a",
lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "a",
int.class, int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
Integer first = (Integer) param.args[0];
Integer second = (Integer) param.args[1];
Integer result = first * second;
param.setResult(result);
}
});
}
}](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-115-320.jpg)
![Demo
public class XposedHook implements IXposedHookLoadPackage {
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return;
Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a",
lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "a",
int.class, int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
Integer first = (Integer) param.args[0];
Integer second = (Integer) param.args[1];
Integer result = first * second;
param.setResult(result);
}
});
}
}](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-116-320.jpg)
![Demo
public class XposedHook implements IXposedHookLoadPackage {
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return;
Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a",
lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "a",
int.class, int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
Integer first = (Integer) param.args[0];
Integer second = (Integer) param.args[1];
Integer result = first * second;
param.setResult(result);
}
});
}
}](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-117-320.jpg)
![Demo
public class XposedHook implements IXposedHookLoadPackage {
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return;
Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a",
lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "a",
int.class, int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
Integer first = (Integer) param.args[0];
Integer second = (Integer) param.args[1];
Integer result = first * second;
param.setResult(result);
}
});
}
}](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-118-320.jpg)
![Demo
public class XposedHook implements IXposedHookLoadPackage {
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return;
Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a",
lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "a",
int.class, int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
Integer first = (Integer) param.args[0];
Integer second = (Integer) param.args[1];
Integer result = first * second;
param.setResult(result);
}
});
}
}](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-119-320.jpg)
![Demo
public class XposedHook implements IXposedHookLoadPackage {
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return;
Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a",
lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "a",
int.class, int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
Integer first = (Integer) param.args[0];
Integer second = (Integer) param.args[1];
Integer result = first * second;
param.setResult(result);
}
});
}
}](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-120-320.jpg)
![Multidex Hooking
final Class<?>[] customClass = new Class<?>[1];
customClass[0] = XposedHelpers.findClass(“com.sample.MyApplication”,
paramLoadPackageParam.classLoader);
XposedHelpers.findAndHookMethod(customClass[0], "onCreate",
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
XposedBridge.log(“Hooked");
});](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-143-320.jpg)
![Multidex Hooking
final Class<?>[] customClass = new Class<?>[1];
customClass[0] = XposedHelpers.findClass(“com.sample.MyApplication”,
paramLoadPackageParam.classLoader);
XposedHelpers.findAndHookMethod(customClass[0], "onCreate",
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
XposedBridge.log(“Hooked");
});](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-144-320.jpg)
![Multidex Hooking
final Class<?>[] customClass = new Class<?>[1];
customClass[0] = XposedHelpers.findClass(“com.sample.MyApplication”,
paramLoadPackageParam.classLoader);
XposedHelpers.findAndHookMethod(customClass[0], "onCreate",
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
XposedBridge.log(“Hooked");
});](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-145-320.jpg)
![Multidex Hooking
final Class<?> customClass = new Class<?>[1];
customClass[0] = XposedHelpers.findClass(“com.sample.MyApplication”,
paramLoadPackageParam.classLoader);
XposedHelpers.findAndHookMethod(customClass[0], "onCreate",
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) {
XposedBridge.log(“Hooked");
Class<?> nestedClass = XposedHelpers.findClass(“com.org.d.a.b”,
paramLoadPackageParam.classLoader);
XposedHelpers.findAndHookMethod(nestedClass, "doSomething",
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param){
Log.e("hqthao", “hooked to different dex file");
}
});
});](https://image.slidesharecdn.com/027an4foriyh9kgpfoys-signature-e7ec67efd81f0e74f9b4a0967e7bf301242ce76865968af4ddddb1c4cb0ece98-poli-170422043753/85/Android-Reverse-Engineering-146-320.jpg)
Android Reverse Engineering
- 5. Why we need reverse engineering - understand app behaviors. - get some necessary data. - understand protocol between client and server.
- 6. Why we need reverse engineering - understand app behaviors. - get some necessary data. - understand protocol between client and server. - modify its behaviors.
- 15. Reverse engineering using Android APK Tool - Decompile directly to smali code. - Encode resource Kiles. - Recompile again to normal apk with updated code or resource.
- 17. Android bytecode datatype V Void Z Boolean B byte S short C char I int J long (64 bits) F Kloat D double (64 bits)
- 18. Android bytecode datatype V Void Z Boolean B byte S short C char I int J long (64 bits) F Kloat D double (64 bits) Lpackage1/package2/className;
- 19. Android bytecode datatype V Void Z Boolean B byte S short C char I int J long (64 bits) F Kloat D double (64 bits) Lpackage1/package2/className; package com.hqt.model; class Person { }
- 20. Android bytecode datatype V Void Z Boolean B byte S short C char I int J long (64 bits) F Kloat D double (64 bits) Lpackage1/package2/className; package com.hqt.model; class Person { } Lcom/hqt/model/Person;
- 21. Android bytecode datatype V Void Z Boolean B byte S short C char I int J long (64 bits) F Kloat D double (64 bits) Lpackage1/package2/className; package com.hqt.model; class Person { } Lcom/hqt/model/Person;
- 22. Android bytecode datatype V Void Z Boolean B byte S short C char I int J long (64 bits) F Kloat D double (64 bits) Lpackage1/package2/ className; package com.hqt.model; class Person { } Lcom/hqt/model/ Person;
- 45. Demo
- 47. calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { int firstNumber = Integer.parseInt(firstNumberText.getText().toString()); int secondNumber = Integer.parseInt(secondNumberText.getText().toString()); ICalc calc = new CalcImpl(); int result = calc.sum(firstNumber, secondNumber); resultText.setText(result + ""); } });
- 48. calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { int firstNumber = Integer.parseInt(firstNumberText.getText().toString()); int secondNumber = Integer.parseInt(secondNumberText.getText().toString()); ICalc calc = new CalcImpl(); int result = calc.sum(firstNumber, secondNumber); resultText.setText(result + ""); } });
- 49. calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { int firstNumber = Integer.parseInt(firstNumberText.getText().toString()); int secondNumber = Integer.parseInt(secondNumberText.getText().toString()); ICalc calc = new CalcImpl(); int result = calc.sum(firstNumber, secondNumber); resultText.setText(result + ""); } }); public interface ICalc { int sum(int first, int second); }
- 50. calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { int firstNumber = Integer.parseInt(firstNumberText.getText().toString()); int secondNumber = Integer.parseInt(secondNumberText.getText().toString()); ICalc calc = new CalcImpl(); int result = calc.sum(firstNumber, secondNumber); resultText.setText(result + ""); } }); public interface ICalc { int sum(int first, int second); } public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } }
- 55. Step 3: Understand smali code <activity android:name=".activity.MainActivity"> <intent-filter> <action android:name="android.intent.action.MAIN" /> <category android:name="android.intent.category.LAUNCHER" / > </intent-filter> </activity>
- 59. Step 3: Understand smali code public interface ICalc { int sum(int first, int second); } .class public interface abstract Lcom/hqt/reverse/sample/a/b; .super Ljava/lang/Object; # virtual methods .method public abstract a(II)I .end method
- 60. Step 3: Understand smali code public interface ICalc { int sum(int first, int second); } .class public interface abstract Lcom/hqt/reverse/sample/a/b; .super Ljava/lang/Object; # virtual methods .method public abstract a(II)I .end method interface ICalc became interface “b”
- 61. Step 3: Understand smali code public interface ICalc { int sum(int first, int second); } .class public interface abstract Lcom/hqt/reverse/sample/a/b; .super Ljava/lang/Object; # virtual methods .method public abstract a(II)I .end method method sum became method “a”
- 62. Step 3: Understand smali code package com.hqt.reverse.sample.utils; public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } }
- 63. Step 3: Understand smali code package com.hqt.reverse.sample.utils; public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } } .class public Lcom/hqt/reverse/sample/a/a; .super Ljava/lang/Object; # interfaces .implements Lcom/hqt/reverse/sample/a/b; # direct methods .method public constructor <init>()V .locals 0 invoke-direct {p0}, Ljava/lang/Object;-><init>()V return-void .end method # virtual methods .method public a(II)I .locals 1 add-int v0, p1, p2 return v0 .end method
- 64. Step 3: Understand smali code package com.hqt.reverse.sample.utils; public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } } .class public Lcom/hqt/reverse/sample/a/a; .super Ljava/lang/Object; # interfaces .implements Lcom/hqt/reverse/sample/a/b; # direct methods .method public constructor <init>()V .locals 0 invoke-direct {p0}, Ljava/lang/Object;-><init>()V return-void .end method # virtual methods .method public a(II)I .locals 1 add-int v0, p1, p2 return v0 .end method interface com.hqt.reverse.sample.utils became com.hqt.reverse.a
- 65. Step 3: Understand smali code package com.hqt.reverse.sample.utils; public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } } .class public Lcom/hqt/reverse/sample/a/a; .super Ljava/lang/Object; # interfaces .implements Lcom/hqt/reverse/sample/a/b; # direct methods .method public constructor <init>()V .locals 0 invoke-direct {p0}, Ljava/lang/Object;-><init>()V return-void .end method # virtual methods .method public a(II)I .locals 1 add-int v0, p1, p2 return v0 .end method class CalcImpl became class a
- 66. Step 3: Understand smali code package com.hqt.reverse.sample.utils; public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } } .class public Lcom/hqt/reverse/sample/a/a; .super Ljava/lang/Object; # interfaces .implements Lcom/hqt/reverse/sample/a/b; # direct methods .method public constructor <init>()V .locals 0 invoke-direct {p0}, Ljava/lang/Object;-><init>()V return-void .end method # virtual methods .method public a(II)I .locals 1 add-int v0, p1, p2 return v0 .end method implements ICalc became implements Lcom/hqt/reverse/ sample/a/b
- 67. Step 3: Understand smali code package com.hqt.reverse.sample.utils; public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } } .class public Lcom/hqt/reverse/sample/a/a; .super Ljava/lang/Object; # interfaces .implements Lcom/hqt/reverse/sample/a/b; # direct methods .method public constructor <init>()V .locals 0 invoke-direct {p0}, Ljava/lang/Object;-><init>()V return-void .end method # virtual methods .method public a(II)I .locals 1 add-int v0, p1, p2 return v0 .end method Implicit constructor
- 68. Step 3: Understand smali code package com.hqt.reverse.sample.utils; public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } } .class public Lcom/hqt/reverse/sample/a/a; .super Ljava/lang/Object; # interfaces .implements Lcom/hqt/reverse/sample/a/b; # direct methods .method public constructor <init>()V .locals 0 invoke-direct {p0}, Ljava/lang/Object;-><init>()V return-void .end method # virtual methods .method public a(II)I .locals 1 add-int v0, p1, p2 return v0 .end method
- 69. Step 3: Understand smali code public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } } .class public Lcom/hqt/reverse/sample/a/a; .super Ljava/lang/Object; # interfaces .implements Lcom/hqt/reverse/sample/a/b; # direct methods .method public constructor <init>()V .locals 0 invoke-direct {p0}, Ljava/lang/Object;-><init>()V return-void .end method # virtual methods .method public a(II)I .locals 1 add-int v0, p1, p2 return v0 .end method using method add-int for sum
- 70. Step 4: Modifying smali code package com.hqt.reverse.sample.utils; public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } } .class public Lcom/hqt/reverse/sample/a/a; .super Ljava/lang/Object; # interfaces .implements Lcom/hqt/reverse/sample/a/b; # direct methods .method public constructor <init>()V .locals 0 invoke-direct {p0}, Ljava/lang/Object;-><init>()V return-void .end method # virtual methods .method public a(II)I .locals 1 add-int v0, p1, p2 return v0 .end method .method public mul(II)I .locals 1 mul-int v0, p1, p2 return v0 .end method z using method mul-int for multiplication
- 71. Step 4: Modifying smali code package com.hqt.reverse.sample.utils; public class CalcImpl implements ICalc { @Override public int sum(int first, int second) { return first + second; } } .class public Lcom/hqt/reverse/sample/a/a; .super Ljava/lang/Object; # interfaces .implements Lcom/hqt/reverse/sample/a/b; # direct methods .method public constructor <init>()V .locals 0 invoke-direct {p0}, Ljava/lang/Object;-><init>()V return-void .end method # virtual methods .method public a(II)I .locals 1 add-int v0, p1, p2 return v0 .end method .method public mul(II)I .locals 1 mul-int v0, p1, p2 return v0 .end method z
- 72. Step 4: Modifying smali code @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); firstNumberText = (EditText) findViewById(R.id.first_number_text); secondNumberText = (EditText) findViewById(R.id.second_number_text); resultText = (TextView) findViewById(R.id.result_text); calcButton = (Button) findViewById(R.id.calc_button); calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { int firstNumber = Integer.parseInt(firstNumberText.getText().toString()); int secondNumber = Integer.parseInt(secondNumberText.getText().toString()); ICalc calc = new CalcImpl(); int result = calc.sum(firstNumber, secondNumber); resultText.setText(result + ""); } }); }
- 73. Step 4: Modifying smali code public class MainActivity extends AppCompatActivity { // variable definition @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); // finding view calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { } }); } }
- 74. Step 4: Modifying smali code public class MainActivity extends AppCompatActivity { // variable definition @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); // finding view calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { } }); } } Anonymous inner class became MainActivity$1
- 75. File $MainActivity$1.smali # virtual methods .method public onClick(Landroid/view/View;)V .locals 3 iget-object v0, p0, Lcom/hqt/reverse/sample/activity/MainActivity$1;->a:Lcom/hqt/reverse/sample/activity/MainActivity; iget-object v0, v0, Lcom/hqt/reverse/sample/activity/MainActivity;->m:Landroid/widget/EditText; invoke-virtual {v0}, Landroid/widget/EditText;->getText()Landroid/text/Editable; move-result-object v0 invoke-virtual {v0}, Ljava/lang/Object;->toString()Ljava/lang/String; move-result-object v0 invoke-static {v0}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I move-result v0 iget-object v1, p0, Lcom/hqt/reverse/sample/activity/MainActivity$1;->a:Lcom/hqt/reverse/sample/activity/MainActivity; iget-object v1, v1, Lcom/hqt/reverse/sample/activity/MainActivity;->n:Landroid/widget/EditText; invoke-virtual {v1}, Landroid/widget/EditText;->getText()Landroid/text/Editable; move-result-object v1 invoke-virtual {v1}, Ljava/lang/Object;->toString()Ljava/lang/String; move-result-object v1 invoke-static {v1}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I move-result v1 new-instance v2, Lcom/hqt/reverse/sample/a/a; invoke-direct {v2}, Lcom/hqt/reverse/sample/a/a;-><init>()V invoke-interface {v2, v0, v1}, Lcom/hqt/reverse/sample/a/b;->mul(II)I move-result v0 iget-object v1, p0, Lcom/hqt/reverse/sample/activity/MainActivity$1;->a:Lcom/hqt/reverse/sample/activity/MainActivity;
- 76. File $MainActivity$1.smali # virtual methods .method public onClick(Landroid/view/View;)V .locals 3 iget-object v0, p0, Lcom/hqt/reverse/sample/activity/MainActivity$1;->a:Lcom/hqt/reverse/sample/activity/MainActivity; iget-object v0, v0, Lcom/hqt/reverse/sample/activity/MainActivity;->m:Landroid/widget/EditText; invoke-virtual {v0}, Landroid/widget/EditText;->getText()Landroid/text/Editable; move-result-object v0 invoke-virtual {v0}, Ljava/lang/Object;->toString()Ljava/lang/String; move-result-object v0 invoke-static {v0}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I move-result v0 iget-object v1, p0, Lcom/hqt/reverse/sample/activity/MainActivity$1;->a:Lcom/hqt/reverse/sample/activity/MainActivity; iget-object v1, v1, Lcom/hqt/reverse/sample/activity/MainActivity;->n:Landroid/widget/EditText; invoke-virtual {v1}, Landroid/widget/EditText;->getText()Landroid/text/Editable; move-result-object v1 invoke-virtual {v1}, Ljava/lang/Object;->toString()Ljava/lang/String; move-result-object v1 invoke-static {v1}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I move-result v1 new-instance v2, Lcom/hqt/reverse/sample/a/a; invoke-direct {v2}, Lcom/hqt/reverse/sample/a/a;-><init>()V invoke-interface {v2, v0, v1}, Lcom/hqt/reverse/sample/a/b;->mul(II)I move-result v0 iget-object v1, p0, Lcom/hqt/reverse/sample/activity/MainActivity$1;->a:Lcom/hqt/reverse/sample/activity/MainActivity;
- 78. calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { // some line before ICalc calc = new CalcImpl(); int result = calc.sum(firstNumber, secondNumber); // some line after } });
- 79. Find <icalc_object>.sum(int, int) calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { // some line before ICalc calc = new CalcImpl(); int result = calc.sum(firstNumber, secondNumber); // some line after } });
- 80. Find <icalc_object>.sum(int, int) calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { // some line before ICalc calc = new CalcImpl(); int result = calc.sum(firstNumber, secondNumber); // some line after } }); - icalc_object -> Lcom/hqt/reverse/sample/a/b - sum -> a - (int, int) -> (I,I)
- 81. Find <icalc_object>.sum(int, int) Find Lcom/hqt/reverse/sample/a/b;->a(II)I calcButton.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { // some line before ICalc calc = new CalcImpl(); int result = calc.sum(firstNumber, secondNumber); // some line after } }); - icalc_object -> Lcom/hqt/reverse/sample/a/b - sum -> a - (int, int) -> (I,I)
- 97. Result
- 98. Additional Tools
- 99. Xposed
- 111. Xposed modules • https://github.com/wanam/YouTubeAdAway • https://github.com/pylerSM/YouTubeBackgroundPlayback • https://github.com/devadvance/rootcloak
- 112. Xposed modules • https://github.com/wanam/YouTubeAdAway • https://github.com/pylerSM/YouTubeBackgroundPlayback • https://github.com/devadvance/rootcloak • https://github.com/M66B/XPrivacy
- 113. Demo public class XposedHook implements IXposedHookLoadPackage { public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) { if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return; Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a", lpparam.classLoader); XposedHelpers.findAndHookMethod(clazz, "a", int.class, int.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { Integer first = (Integer) param.args[0]; Integer second = (Integer) param.args[1]; Integer result = first * second; param.setResult(result); } }); } }
- 114. Demo public class XposedHook implements IXposedHookLoadPackage { public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) { if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return; Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a", lpparam.classLoader); XposedHelpers.findAndHookMethod(clazz, "a", int.class, int.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { Integer first = (Integer) param.args[0]; Integer second = (Integer) param.args[1]; Integer result = first * second; param.setResult(result); } }); } }
- 115. Demo public class XposedHook implements IXposedHookLoadPackage { public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) { if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return; Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a", lpparam.classLoader); XposedHelpers.findAndHookMethod(clazz, "a", int.class, int.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { Integer first = (Integer) param.args[0]; Integer second = (Integer) param.args[1]; Integer result = first * second; param.setResult(result); } }); } }
- 116. Demo public class XposedHook implements IXposedHookLoadPackage { public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) { if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return; Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a", lpparam.classLoader); XposedHelpers.findAndHookMethod(clazz, "a", int.class, int.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { Integer first = (Integer) param.args[0]; Integer second = (Integer) param.args[1]; Integer result = first * second; param.setResult(result); } }); } }
- 117. Demo public class XposedHook implements IXposedHookLoadPackage { public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) { if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return; Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a", lpparam.classLoader); XposedHelpers.findAndHookMethod(clazz, "a", int.class, int.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { Integer first = (Integer) param.args[0]; Integer second = (Integer) param.args[1]; Integer result = first * second; param.setResult(result); } }); } }
- 118. Demo public class XposedHook implements IXposedHookLoadPackage { public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) { if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return; Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a", lpparam.classLoader); XposedHelpers.findAndHookMethod(clazz, "a", int.class, int.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { Integer first = (Integer) param.args[0]; Integer second = (Integer) param.args[1]; Integer result = first * second; param.setResult(result); } }); } }
- 119. Demo public class XposedHook implements IXposedHookLoadPackage { public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) { if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return; Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a", lpparam.classLoader); XposedHelpers.findAndHookMethod(clazz, "a", int.class, int.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { Integer first = (Integer) param.args[0]; Integer second = (Integer) param.args[1]; Integer result = first * second; param.setResult(result); } }); } }
- 120. Demo public class XposedHook implements IXposedHookLoadPackage { public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) { if (!lpparam.packageName.equals("com.hqt.reverse.sample")) return; Class<?> clazz = XposedHelpers.findClass("com.hqt.reverse.sample.a.a", lpparam.classLoader); XposedHelpers.findAndHookMethod(clazz, "a", int.class, int.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { Integer first = (Integer) param.args[0]; Integer second = (Integer) param.args[1]; Integer result = first * second; param.setResult(result); } }); } }
- 121. Demo
- 124. ReKlection API - change some internal value. - call some private methods. - Internal Android doesn’t obfuscate its source code.
- 129. Not always work …
- 133. Multidex Supporting
- 135. Multidex Introduction Total number of methods that can be referenced within a single DEX Kile limit to 65,536 public class MyApplication extends Application { @Override protected void attachBaseContext(Context base) { super.attachBaseContext(base); MultiDex.install(this); } }
- 136. Multidex Introduction Total number of methods that can be referenced within a single DEX Kile limit to 65,536 public class MyApplication extends Application { @Override protected void attachBaseContext(Context base) { super.attachBaseContext(base); MultiDex.install(this); } }
- 137. Multidex Smali
- 140. Multidex Hooking XposedHelpers.findAndHookMethod(“com.org.d.a.b”, paramLoadPackageParam.classLoader, "doingSomething", new XC_MethodHook() { protected void afterHookedMethod(MethodHookParam paramAnonymousMethodHookParam) throws Throwable { super.afterHookedMethod(paramAnonymousMethodHookParam); paramAnonymousMethodHookParam.setResult(""); } });
- 141. Multidex Hooking XposedHelpers.findAndHookMethod(“com.org.d.a.b”, paramLoadPackageParam.classLoader, "doingSomething", new XC_MethodHook() { protected void afterHookedMethod(MethodHookParam paramAnonymousMethodHookParam) throws Throwable { super.afterHookedMethod(paramAnonymousMethodHookParam); paramAnonymousMethodHookParam.setResult(""); } }); - This hooking function will fail if this function lies on second dex ile.
- 142. Multidex Hooking XposedHelpers.findAndHookMethod(“com.org.d.a.b”, paramLoadPackageParam.classLoader, "doingSomething", new XC_MethodHook() { protected void afterHookedMethod(MethodHookParam paramAnonymousMethodHookParam) throws Throwable { super.afterHookedMethod(paramAnonymousMethodHookParam); paramAnonymousMethodHookParam.setResult(""); } }); - This hooking function will fail if this function lies on second dex ile. - We must hook all functions after Multidex.install(this) line.
- 143. Multidex Hooking final Class<?>[] customClass = new Class<?>[1]; customClass[0] = XposedHelpers.findClass(“com.sample.MyApplication”, paramLoadPackageParam.classLoader); XposedHelpers.findAndHookMethod(customClass[0], "onCreate", new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { XposedBridge.log(“Hooked"); });
- 144. Multidex Hooking final Class<?>[] customClass = new Class<?>[1]; customClass[0] = XposedHelpers.findClass(“com.sample.MyApplication”, paramLoadPackageParam.classLoader); XposedHelpers.findAndHookMethod(customClass[0], "onCreate", new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { XposedBridge.log(“Hooked"); });
- 145. Multidex Hooking final Class<?>[] customClass = new Class<?>[1]; customClass[0] = XposedHelpers.findClass(“com.sample.MyApplication”, paramLoadPackageParam.classLoader); XposedHelpers.findAndHookMethod(customClass[0], "onCreate", new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { XposedBridge.log(“Hooked"); });
- 146. Multidex Hooking final Class<?> customClass = new Class<?>[1]; customClass[0] = XposedHelpers.findClass(“com.sample.MyApplication”, paramLoadPackageParam.classLoader); XposedHelpers.findAndHookMethod(customClass[0], "onCreate", new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { XposedBridge.log(“Hooked"); Class<?> nestedClass = XposedHelpers.findClass(“com.org.d.a.b”, paramLoadPackageParam.classLoader); XposedHelpers.findAndHookMethod(nestedClass, "doSomething", new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param){ Log.e("hqthao", “hooked to different dex file"); } }); });
- 150. Hooking native layer XPosed: only hook bridge methods. Cydia Substrate: - similar for iOS reverse engineers. - only for Android 4.3 or before. Frida: - using javascript. - fast for prototype. AndroidEagleEye: - Good for implementing. - Not good for testing prototype like Frida.
- 153. Q&A