Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[mDevCamp 2020] Reversing Android Apps
Search
Marc Obrador
June 11, 2020
Programming
3
2.7k
[mDevCamp 2020] Reversing Android Apps
Marc Obrador
June 11, 2020
Tweet
Share
More Decks by Marc Obrador
See All by Marc Obrador
[Droidcon London 2023] REST in Peace: A Journey Through API Protection
marcobrador
0
100
[Droidcon Berlin 2023] Obfuscation in Mobile Apps
marcobrador
0
1.3k
[WeAreDevelopers World Conference] Reversing Android Apps
marcobrador
0
630
Introduction to Mobile App Security
marcobrador
2
380
[ICE71 CyberSecurity Networking Night] Mobile App Security: A developer's introduction
marcobrador
0
780
[GDG BCN 2019] Introduction to Android App Security
marcobrador
1
890
[DroidCon Lisbon 2019] Intro to Android App Security
marcobrador
2
460
Other Decks in Programming
See All in Programming
海外のアプリで見かけたかっこいいTransitionを真似てみる
shogotakasaki
1
160
Firebase Dynamic Linksの代替手段を自作する / Create your own Firebase Dynamic Links alternative
kubode
0
230
Youtube Lofier - Chrome拡張開発
ninikoko
0
2.4k
アーキテクトと美学 / Architecture and Aesthetics
nrslib
12
3.3k
サービスクラスのありがたみを発見したときの思い出 #phpcon_odawara
77web
4
610
Agentic Applications with Symfony
el_stoffel
2
250
フロントエンドテストの育て方
quramy
11
2.9k
リアクティブシステムの変遷から理解するalien-signals / Learning alien-signals from the evolution of reactive systems
yamanoku
3
1.2k
List とは何か? / PHPerKaigi 2025
meihei3
0
610
家族・子育て重視/沖縄在住を維持しながらエンジニアとしてのキャリアをどのように育てていくか?
ug
0
260
Going Structural with Named Tuples
bishabosha
0
200
AHC045_解説
shun_pi
0
430
Featured
See All Featured
ReactJS: Keep Simple. Everything can be a component!
pedronauck
666
120k
Intergalactic Javascript Robots from Outer Space
tanoku
270
27k
Why You Should Never Use an ORM
jnunemaker
PRO
55
9.3k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
40
2.2k
Raft: Consensus for Rubyists
vanstee
137
6.9k
Practical Orchestrator
shlominoach
186
10k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
280
13k
Easily Structure & Communicate Ideas using Wireframe
afnizarnur
194
16k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
45
9.5k
ピンチをチャンスに:未来をつくるプロダクトロードマップ #pmconf2020
aki_iinuma
118
51k
It's Worth the Effort
3n
184
28k
Imperfection Machines: The Place of Print at Facebook
scottboms
267
13k
Transcript
Reversing Android Apps
Marc Obrador Lead Architect @ Build38 Barcelona marc@build38.com @marcobrador /in/marc-obrador
None
Source: https://en.wikipedia.org/wiki/Reverse_engineering It’s illegal (in the EU)!
None
Josep Bernad iOS Albert Sunyer UI
Artà is in Mallorca ABF takes place (usually) in June
COVID-19 pushed it to … ?
None
Get to know the app Step 0
Get to know the app
Get to know the app
Get to know the app
Get to know the app
Static Analysis Step 1
Static Analysis
Getting the APK
Decompiling the app https://ibotpeaches.github.io/Apktool/ $ brew install apktool
Decompiling the app
None
None
None
None
None
Let’s keep looking around
Wait… “discount codes”?
App users get a discount for events
None
Let’s take a closer look…
None
HTTP Basic Authorisation = Base64(“username:password”)
None
HTTP Basic Authorisation = Base64(“username:password”) username = “string1” xor “string2”
pasword = “string3” xor “string2”
None
Protecting against static analysis ProGuard is a good start… for
regular apps • It’s just method renaming and code shrinking • Tools for reversing ProGuard exist: http://apk-deguard.com/ Other (paid) alternatives exist for obfuscation Writing sensitve code in native (NDK) is a good idea
Dynamic Analysis Step 2
Dynamic Analysis
Dynamic Analysis
Network Sniffing a.k.a MITM
Network Sniffing https://www.charlesproxy.com/
Setting Up Charles Proxy
Setting Up Charles Proxy
Setting Up Charles Proxy
First attempt…
First attempt…
Setting Up Charles Proxy
Setting Up Charles Proxy
Let’s try again…
None
None
None
None
None
• Implement Root/Debugger/Emulator/Hooking Framework detection • Use certificate pinning •
Try to detect app tampering Protecting against dynamic analysis
Using Certificate Pinning Source: https://developer.android.com/training/articles/security-config
Tampering with the App Step 3
Assuming the app implemented Certificate Pinning…
$ adb install “Downloads/Artà Beer Festival_v1.2.5_apkpure.com.apk” Performing Streamed Install Success
$ adb shell am start com.marcobrador.android.artabeerfestival/.SplashActivity Starting: Intent { act=android.intent.action.MAIN cat=[android.intent.category .LAUNCHER] cmp=com.marcobrador.android.artabeerfestival/.SplashActivity }
Let’s try to remove it
None
None
None
Time to give it a try!
None
None
Preventing Repackaging
Looks like we are done here Looks like we are
done here
This code can be removed, too!
Closing Thoughts
None
None
None
Thank you!