{"id":570,"date":"2014-10-27T19:22:42","date_gmt":"2014-10-27T18:22:42","guid":{"rendered":"http:\/\/blog.ansuz.nl\/?p=570"},"modified":"2014-10-27T19:22:42","modified_gmt":"2014-10-27T18:22:42","slug":"android-reverse-engineering","status":"publish","type":"post","link":"http:\/\/blog.ansuz.nl\/index.php\/2014\/10\/27\/android-reverse-engineering\/","title":{"rendered":"Android reverse engineering"},"content":{"rendered":"

Often I am quite curious to see how an app is built and what tools the use under the hood. What libraries do they use, what clever tricks are used, etc, etc. Some companies will blog about this on their corporate site, others don’t. An easy way to figure things out is by reverse engineering the application.<\/p>\n

Getting data off the phone<\/strong>
\nThe first thing you need to do is get the application from your phone to your computer.<\/p>\n

To do this, you can use the APK Extractor<\/a> app.<\/p>\n

“This application will extracts APK which is installed on android device and copy to SD card.”<\/p><\/blockquote>\n

From there it is a matter getting the data from the SD card. I normally just use adb pull. Have a look at the adb documentation<\/a> for more details.<\/p>\n

Decompiling<\/strong>
\nOnce you have de application on your computer, there are various tools you can use to reverse engineer it.<\/p>\n

The first step though, is to unpack the APK<\/a>. Luckily this is really easy, as an APK is just a ZIP file. Extract it with your favorite ZIP-tool.<\/p>\n

At this point all extracted data is mostly represented in binary form. Opening the AndroidManifest.xml for instance, won’t give you much information yet. This is where the various tools come in.<\/p>\n

To “decode resources to nearly original form” you can use apktool<\/a>. To decompile an application using apktool, run: <\/p>\n

\n\n\t\t
\n\n\t\t
\n\t\t\t\t\t\t< View plain text<\/span> ><\/a>\n\t\t\t\t\t<\/div>\n\n\t\t
bash<\/div>\n\n\t\t\n\t\t
\n\n\t<\/div>\n\t\n\t
\n\t\t
  1. apktool d name_of_apk.apk<\/div><\/li>\n<\/ol>\t<\/div>\n\n<\/div>\n\n

    For any additional options, have a look at the apktool documentation<\/a>.<\/p>\n

    Decompiling using apktool will result in a new folder with the same name as the APK. This folder will contain all decoded data. If you open up the AndroidManifest.xml file from there, you’ll see it is now in a human-readable format. All code is decompiled to smali. Smali is disassembled code from the dex format used by Dalvik<\/a>. It seems to follow the same package and class naming as the original Java code. If you want to learn more about smali, have a look at the links in the answer to “What’s the best way to learn Smali<\/a>” on Stackoverflow.<\/p>\n

    If you don’t want to change any code and just want to learn about the application’s inner workings, you can make your life a little easier by using a combination of two other tools: dex2jar<\/a> and jd-gui<\/a>.<\/p>\n

    As the name says, dex2jar will convert a .dex file to a jar. This, again, is a fairly simple process. Running the command below will generate name_of_apk.jar.\u00a0<\/p>\n

    \n\n\t\t
    \n\n\t\t
    \n\t\t\t\t\t\t< View plain text<\/span> ><\/a>\n\t\t\t\t\t<\/div>\n\n\t\t
    bash<\/div>\n\n\t\t\n\t\t
    \n\n\t<\/div>\n\t\n\t
    \n\t\t
    1. d2j-dex2jar name_of_apk.apk<\/div><\/li>\n<\/ol>\t<\/div>\n\n<\/div>\n\n

      To explore the jar, open it in JD GUI. The dex2jar process does not guarantee to be able to convert everything. Sometimes you will find conversion errors in the exported code. These are indicated by a line starting with “\/\/ ERROR \/\/”, followed by the smali code.<\/p>\n

      Recompiling<\/strong>
      \nAfter decompiling, you can make changes to the code, recompile the application and install it on your device.<\/p>\n

      Make any modifications you want to the code and recompile using <\/p>\n

      \n\n\t\t
      \n\n\t\t
      \n\t\t\t\t\t\t< View plain text<\/span> ><\/a>\n\t\t\t\t\t<\/div>\n\n\t\t
      bash<\/div>\n\n\t\t\n\t\t
      \n\n\t<\/div>\n\t\n\t
      \n\t\t
      1. apktool b folder_of_decoded_apk<\/div><\/li>\n<\/ol>\t<\/div>\n\n<\/div>\n\n

        Next, sign the new application. Google has great instructions on how to sign an application<\/a>, so I won’t repeat that here.<\/p>\n

        To install the new application on your phone, run <\/p>\n

        \n\n\t\t
        \n\n\t\t
        \n\t\t\t\t\t\t< View plain text<\/span> ><\/a>\n\t\t\t\t\t<\/div>\n\n\t\t
        bash<\/div>\n\n\t\t\n\t\t
        \n\n\t<\/div>\n\t\n\t
        \n\t\t
        1. adb install<\/span> -r<\/span> name_of_apk.apk<\/div><\/li>\n<\/ol>\t<\/div>\n\n<\/div>\n\n

          You will have to uninstall the original version first before you can install your modified one. This is because the version you created is signed with a different certificate.<\/p>\n

          Word to the wise<\/strong><\/p>\n

          Make sure you are not breaking any laws when using reverse engineering. In some countries it is legal, in others it is illegal.<\/p>\n

          When reverse engineering is legal in the country you live in, make sure the software’s (or application’s) Terms and Conditions don’t explicitly forbid you to reverse engineer.<\/p>\n

          Even when the above hurdles are overcome, make sure to not blatantly copy and paste someone else’s code.<\/p>\n","protected":false},"excerpt":{"rendered":"

          Often I am quite curious to see how an app is built and what tools the use under the hood. What libraries do they use, what clever tricks are used, etc, etc. Some companies will blog about this on their … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[112,52,133],"tags":[],"class_list":["post-570","post","type-post","status-publish","format-standard","hentry","category-android","category-java","category-smali"],"_links":{"self":[{"href":"http:\/\/blog.ansuz.nl\/index.php\/wp-json\/wp\/v2\/posts\/570","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blog.ansuz.nl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.ansuz.nl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.ansuz.nl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.ansuz.nl\/index.php\/wp-json\/wp\/v2\/comments?post=570"}],"version-history":[{"count":6,"href":"http:\/\/blog.ansuz.nl\/index.php\/wp-json\/wp\/v2\/posts\/570\/revisions"}],"predecessor-version":[{"id":576,"href":"http:\/\/blog.ansuz.nl\/index.php\/wp-json\/wp\/v2\/posts\/570\/revisions\/576"}],"wp:attachment":[{"href":"http:\/\/blog.ansuz.nl\/index.php\/wp-json\/wp\/v2\/media?parent=570"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.ansuz.nl\/index.php\/wp-json\/wp\/v2\/categories?post=570"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.ansuz.nl\/index.php\/wp-json\/wp\/v2\/tags?post=570"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}