CF2 09 - Android Rev Eng Logs.pdf

(1698 KB) Pobierz

Forensics II

Android reverse engineering

Logs [repetition]

Android reverse enginering tools

• dex2jar

–

A group of tools to work with android .dex and java .class files in

combination with for example Java Decompiler

–

https://code.google.com/p/dex2jar/

• smali/baksmali

–

An assembler/disassembler for the dex format used by dalvik,

Android's Java VM implementation

–

https://code.google.com/p/smali/

• android-apktool

–

A tool for reverse engineering 3rd party, closed, binary Android apps

–

It can decode resources to nearly original form and rebuild them after

making some modifications (smali/baksmali integration)

–

It makes possible to

debug smali code

step by step via DDMS (wiki)

–

https://code.google.com/p/android-apktool/

• apk-signer

–

https://code.google.com/p/apk-signer/

Reversing an Android app

• Task – get rid of the lockout time nag in the Android

Bluetooth GPS output program

–

http://www.meowsbox.com/btgps/index.html

• Tools

–

Apktool, dex2jar, Java Decompiler and jarsigner (Java JDK)

• Get hold of the apk file e.g. /data/app/com.meowsbox.btgps.apk,

(can also be in /data/app-private/) from the Android phone or

Internet

• Unzip the com.meowsbox.btgps.apk file and grab classes.dex file

–

Run ”d2j-dex2jar classes.dex” which will convert the dex file into a

ordinary jar file which can be opened with Java Decompiler

• Run ”apktool d com.meowsbox.btgps.apk” which will decompress

it and disassembly the apk file

–

A folder is created with the resources and .smali ”dalvik” code etc.

• Using Java Decompiler try to localize where the time nag is in the

java code and find the corresponding code in the smali

”assemblies”

Java vs.

dalvik code

I changed the opcode

from

if-eqz

if-nez

BluetoothChat.smali

.method public sendNMEAString(Ljava/lang/String;)V

.locals 8

.parameter "nmeaString"

.prologue

const/4 v7, 0x1

public void sendNMEAString(String paramString)

{

if (this.mChatService.getState() == 3)

{

if (!this.isRegistered)

break label44;

byte[] arrayOfByte1 = paramString.getBytes();

this.mChatService.write(arrayOfByte1);

int i = this.limit_nmeaCount + 1;

this.limit_nmeaCount = i;

}

while (true)

{

return;

label44: if (this.limit_nmeaCount < 3000)

{

byte[] arrayOfByte2 = paramString.getBytes();

this.mChatService.write(arrayOfByte2);

int j = this.limit_nmeaCount + 1;

this.limit_nmeaCount = j;

continue;

}

TextView localTextView = (TextView)findViewById(2131099664);

localTextView.setText(

"***Trial time limit reached: GPS output disabled.");

.line 954

iget-object v4, p0, Lcom/meowsbox/btgps/BluetoothChat;->mChatService:Lcom/meowsbox/btgps/BluetoothChatService;

invoke-virtual {v4}, Lcom/meowsbox/btgps/BluetoothChatService;->getState()I

move-result v4

const/4 v5, 0x3

if-ne v4, v5, :cond_0

.line 955

iget-boolean v4, p0, Lcom/meowsbox/btgps/BluetoothChat;->isRegistered:Z

if-nez v4, :cond_1

.line 956

invoke-virtual {p1}, Ljava/lang/String;->getBytes()[B

First if – jump to :cond_0

Second if – jump!

Repackaging and protection

• When the smali code changes are saved run

–

”apktool b com.meowsbox.btgps com.meowsbox.btgps_new.apk”

• After rebuilding the application it needs to be signed, run

–

"C:\Program Files\Java\jdk1.7.0_XX\bin\jarsigner" -keystore

C:\Users\hjo\.android\debug.keystore com.meowsbox.btgps_new.apk

androiddebugkey

–

Use the password android

• After this you can install the cracked app with ADB etc.

• To protect your code enable proguard in the project.properties file

–

proguard.config == proguard-project.txt

–

Note that Proguard never runs when you compile ”debug” code!

• To obfuscate your android program (android:debuggable should be off

in the AndroidManifest.xml as well) and create ”release” code

–

In eclipse mark your project and select File > Export > Android > Export

Android Application which will compile and align your code

–

Then follow the wizard and point out your debug keystore (as above) or

your registred developer keystore and enter the password

Plik z chomika:

WMatrixie

CF2 09 - Android Rev Eng Logs.pdf

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: