Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[mDevCamp 2020] Reversing Android Apps
Search
Marc Obrador
June 11, 2020
Programming
3
2.8k
[mDevCamp 2020] Reversing Android Apps
Marc Obrador
June 11, 2020
Tweet
Share
More Decks by Marc Obrador
See All by Marc Obrador
[Droidcon London 2023] REST in Peace: A Journey Through API Protection
marcobrador
0
110
[Droidcon Berlin 2023] Obfuscation in Mobile Apps
marcobrador
0
1.3k
[WeAreDevelopers World Conference] Reversing Android Apps
marcobrador
0
660
Introduction to Mobile App Security
marcobrador
2
380
[ICE71 CyberSecurity Networking Night] Mobile App Security: A developer's introduction
marcobrador
0
780
[GDG BCN 2019] Introduction to Android App Security
marcobrador
1
910
[DroidCon Lisbon 2019] Intro to Android App Security
marcobrador
2
470
Other Decks in Programming
See All in Programming
AIと私たちの学習の変化を考える - Claude Codeの学習モードを例に
azukiazusa1
11
4.5k
チームのテスト力を鍛える
goyoki
3
960
Android 16 × Jetpack Composeで縦書きテキストエディタを作ろう / Vertical Text Editor with Compose on Android 16
cc4966
2
270
CloudflareのChat Agent Starter Kitで簡単!AIチャットボット構築
syumai
2
520
AI Coding Agentのセキュリティリスク:PRの自己承認とメルカリの対策
s3h
0
240
MCPでVibe Working。そして、結局はContext Eng(略)/ Working with Vibe on MCP And Context Eng
rkaga
5
2.3k
意外と簡単!?フロントエンドでパスキー認証を実現する WebAuthn
teamlab
PRO
2
780
CJK and Unicode From a PHP Committer
youkidearitai
PRO
0
110
「待たせ上手」なスケルトンスクリーン、 そのUXの裏側
teamlab
PRO
0
600
時間軸から考えるTerraformを使う理由と留意点
fufuhu
16
4.8k
AI時代のUIはどこへ行く?
yusukebe
18
9.2k
AIを活用し、今後に備えるための技術知識 / Basic Knowledge to Utilize AI
kishida
22
5.9k
Featured
See All Featured
Music & Morning Musume
bryan
46
6.8k
Bootstrapping a Software Product
garrettdimon
PRO
307
110k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
15
1.7k
We Have a Design System, Now What?
morganepeng
53
7.8k
The Cost Of JavaScript in 2023
addyosmani
53
8.9k
Visualization
eitanlees
148
16k
The Straight Up "How To Draw Better" Workshop
denniskardys
236
140k
KATA
mclloyd
32
14k
Building Better People: How to give real-time feedback that sticks.
wjessup
368
19k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
49
3k
Building a Scalable Design System with Sketch
lauravandoore
462
33k
Testing 201, or: Great Expectations
jmmastey
45
7.7k
Transcript
Reversing Android Apps
Marc Obrador Lead Architect @ Build38 Barcelona
[email protected]
@marcobrador /in/marc-obrador
None
Source: https://en.wikipedia.org/wiki/Reverse_engineering It’s illegal (in the EU)!
None
Josep Bernad iOS Albert Sunyer UI
Artà is in Mallorca ABF takes place (usually) in June
COVID-19 pushed it to … ?
None
Get to know the app Step 0
Get to know the app
Get to know the app
Get to know the app
Get to know the app
Static Analysis Step 1
Static Analysis
Getting the APK
Decompiling the app https://ibotpeaches.github.io/Apktool/ $ brew install apktool
Decompiling the app
None
None
None
None
None
Let’s keep looking around
Wait… “discount codes”?
App users get a discount for events
None
Let’s take a closer look…
None
HTTP Basic Authorisation = Base64(“username:password”)
None
HTTP Basic Authorisation = Base64(“username:password”) username = “string1” xor “string2”
pasword = “string3” xor “string2”
None
Protecting against static analysis ProGuard is a good start… for
regular apps • It’s just method renaming and code shrinking • Tools for reversing ProGuard exist: http://apk-deguard.com/ Other (paid) alternatives exist for obfuscation Writing sensitve code in native (NDK) is a good idea
Dynamic Analysis Step 2
Dynamic Analysis
Dynamic Analysis
Network Sniffing a.k.a MITM
Network Sniffing https://www.charlesproxy.com/
Setting Up Charles Proxy
Setting Up Charles Proxy
Setting Up Charles Proxy
First attempt…
First attempt…
Setting Up Charles Proxy
Setting Up Charles Proxy
Let’s try again…
None
None
None
None
None
• Implement Root/Debugger/Emulator/Hooking Framework detection • Use certificate pinning •
Try to detect app tampering Protecting against dynamic analysis
Using Certificate Pinning Source: https://developer.android.com/training/articles/security-config
Tampering with the App Step 3
Assuming the app implemented Certificate Pinning…
$ adb install “Downloads/Artà Beer Festival_v1.2.5_apkpure.com.apk” Performing Streamed Install Success
$ adb shell am start com.marcobrador.android.artabeerfestival/.SplashActivity Starting: Intent { act=android.intent.action.MAIN cat=[android.intent.category .LAUNCHER] cmp=com.marcobrador.android.artabeerfestival/.SplashActivity }
Let’s try to remove it
None
None
None
Time to give it a try!
None
None
Preventing Repackaging
Looks like we are done here Looks like we are
done here
This code can be removed, too!
Closing Thoughts
None
None
None
Thank you!