Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[mDevCamp 2020] Reversing Android Apps
Search
Marc Obrador
June 11, 2020
Programming
3
2.7k
[mDevCamp 2020] Reversing Android Apps
Marc Obrador
June 11, 2020
Tweet
Share
More Decks by Marc Obrador
See All by Marc Obrador
[Droidcon London 2023] REST in Peace: A Journey Through API Protection
marcobrador
0
93
[Droidcon Berlin 2023] Obfuscation in Mobile Apps
marcobrador
0
1.3k
[WeAreDevelopers World Conference] Reversing Android Apps
marcobrador
0
610
Introduction to Mobile App Security
marcobrador
2
380
[ICE71 CyberSecurity Networking Night] Mobile App Security: A developer's introduction
marcobrador
0
770
[GDG BCN 2019] Introduction to Android App Security
marcobrador
1
880
[DroidCon Lisbon 2019] Intro to Android App Security
marcobrador
2
450
Other Decks in Programming
See All in Programming
Jakarta EE meets AI
ivargrimstad
0
490
CSS Linter による Baseline サポートの仕組み
ryo_manba
1
160
ナレッジイネイブリングにAIを活用してみる ゆるSRE勉強会 #9
nealle
0
160
なぜイベント駆動が必要なのか - CQRS/ESで解く複雑系システムの課題 -
j5ik2o
14
4.7k
Amazon Bedrockマルチエージェントコラボレーションを諦めてLangGraphに入門してみた
akihisaikeda
1
150
メンテが命: PHPフレームワークのコンテナ化とアップグレード戦略
shunta27
0
310
5分で理解する SOLID 原則 #phpcon_nagoya
shogogg
1
390
PHPのバージョンアップ時にも役立ったAST
matsuo_atsushi
0
230
Formの複雑さに立ち向かう
bmthd
1
940
2025.2.14_Developers Summit 2025_登壇資料
0101unite
0
220
もう僕は OpenAPI を書きたくない
sgash708
6
1.9k
PHPカンファレンス名古屋2025 タスク分解の試行錯誤〜レビュー負荷を下げるために〜
soichi
1
730
Featured
See All Featured
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
28
9.3k
Principles of Awesome APIs and How to Build Them.
keavy
126
17k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
7
650
Raft: Consensus for Rubyists
vanstee
137
6.8k
What’s in a name? Adding method to the madness
productmarketing
PRO
22
3.3k
Typedesign – Prime Four
hannesfritz
41
2.5k
Building an army of robots
kneath
303
45k
The Art of Programming - Codeland 2020
erikaheidi
53
13k
Build The Right Thing And Hit Your Dates
maggiecrowley
34
2.5k
Optimising Largest Contentful Paint
csswizardry
34
3.1k
Fontdeck: Realign not Redesign
paulrobertlloyd
83
5.4k
How STYLIGHT went responsive
nonsquared
99
5.4k
Transcript
Reversing Android Apps
Marc Obrador Lead Architect @ Build38 Barcelona
[email protected]
@marcobrador /in/marc-obrador
None
Source: https://en.wikipedia.org/wiki/Reverse_engineering It’s illegal (in the EU)!
None
Josep Bernad iOS Albert Sunyer UI
Artà is in Mallorca ABF takes place (usually) in June
COVID-19 pushed it to … ?
None
Get to know the app Step 0
Get to know the app
Get to know the app
Get to know the app
Get to know the app
Static Analysis Step 1
Static Analysis
Getting the APK
Decompiling the app https://ibotpeaches.github.io/Apktool/ $ brew install apktool
Decompiling the app
None
None
None
None
None
Let’s keep looking around
Wait… “discount codes”?
App users get a discount for events
None
Let’s take a closer look…
None
HTTP Basic Authorisation = Base64(“username:password”)
None
HTTP Basic Authorisation = Base64(“username:password”) username = “string1” xor “string2”
pasword = “string3” xor “string2”
None
Protecting against static analysis ProGuard is a good start… for
regular apps • It’s just method renaming and code shrinking • Tools for reversing ProGuard exist: http://apk-deguard.com/ Other (paid) alternatives exist for obfuscation Writing sensitve code in native (NDK) is a good idea
Dynamic Analysis Step 2
Dynamic Analysis
Dynamic Analysis
Network Sniffing a.k.a MITM
Network Sniffing https://www.charlesproxy.com/
Setting Up Charles Proxy
Setting Up Charles Proxy
Setting Up Charles Proxy
First attempt…
First attempt…
Setting Up Charles Proxy
Setting Up Charles Proxy
Let’s try again…
None
None
None
None
None
• Implement Root/Debugger/Emulator/Hooking Framework detection • Use certificate pinning •
Try to detect app tampering Protecting against dynamic analysis
Using Certificate Pinning Source: https://developer.android.com/training/articles/security-config
Tampering with the App Step 3
Assuming the app implemented Certificate Pinning…
$ adb install “Downloads/Artà Beer Festival_v1.2.5_apkpure.com.apk” Performing Streamed Install Success
$ adb shell am start com.marcobrador.android.artabeerfestival/.SplashActivity Starting: Intent { act=android.intent.action.MAIN cat=[android.intent.category .LAUNCHER] cmp=com.marcobrador.android.artabeerfestival/.SplashActivity }
Let’s try to remove it
None
None
None
Time to give it a try!
None
None
Preventing Repackaging
Looks like we are done here Looks like we are
done here
This code can be removed, too!
Closing Thoughts
None
None
None
Thank you!