Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[WeAreDevelopers World Conference] Reversing An...
Search
Marc Obrador
June 30, 2021
Programming
0
660
[WeAreDevelopers World Conference] Reversing Android Apps
Marc Obrador
June 30, 2021
Tweet
Share
More Decks by Marc Obrador
See All by Marc Obrador
[Droidcon London 2023] REST in Peace: A Journey Through API Protection
marcobrador
0
110
[Droidcon Berlin 2023] Obfuscation in Mobile Apps
marcobrador
0
1.3k
[mDevCamp 2020] Reversing Android Apps
marcobrador
3
2.8k
Introduction to Mobile App Security
marcobrador
2
380
[ICE71 CyberSecurity Networking Night] Mobile App Security: A developer's introduction
marcobrador
0
780
[GDG BCN 2019] Introduction to Android App Security
marcobrador
1
900
[DroidCon Lisbon 2019] Intro to Android App Security
marcobrador
2
470
Other Decks in Programming
See All in Programming
Claude Code で Astro blog を Pages から Workers へ移行してみた
codehex
0
150
バイブスあるコーディングで ~PHP~ 便利ツールをつくるプラクティス
uzulla
1
270
iOS開発スターターキットの作り方
akidon0000
0
180
状態遷移図を書こう / Sequence Chart vs State Diagram
orgachem
PRO
3
260
Gemini CLIの"強み"を知る! Gemini CLIとClaude Codeを比較してみた!
kotahisafuru
2
160
Claude Code + Container Use と Cursor で作る ローカル並列開発環境のススメ / ccc local dev
kaelaela
12
7.4k
AI時代の『改訂新版 良いコード/悪いコードで学ぶ設計入門』 / ai-good-code-bad-code
minodriven
24
10k
なぜあなたのオブザーバビリティ導入は頓挫するのか
ryota_hnk
2
390
Vibe Codingの幻想を超えて-生成AIを現場で使えるようにするまでの泥臭い話.ai
fumiyakume
18
9.2k
CIを整備してメンテナンスを生成AIに任せる
hazumirr
0
210
「テストは愚直&&網羅的に書くほどよい」という誤解 / Test Smarter, Not Harder
munetoshi
1
220
Claude Code派?Gemini CLI派? みんなで比較LT会!_20250716
junholee
1
700
Featured
See All Featured
Reflections from 52 weeks, 52 projects
jeffersonlam
351
21k
Designing Dashboards & Data Visualisations in Web Apps
destraynor
231
53k
Scaling GitHub
holman
461
140k
How to Think Like a Performance Engineer
csswizardry
25
1.8k
Optimising Largest Contentful Paint
csswizardry
37
3.3k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
33
2.4k
Automating Front-end Workflow
addyosmani
1370
200k
Understanding Cognitive Biases in Performance Measurement
bluesmoon
29
1.8k
It's Worth the Effort
3n
185
28k
Stop Working from a Prison Cell
hatefulcrawdad
271
21k
Agile that works and the tools we love
rasmusluckow
329
21k
Learning to Love Humans: Emotional Interface Design
aarron
273
40k
Transcript
Reversing Android Apps
Marc Obrador Lead Architect @ Build38 Barcelona marc@build38.com @marcobrador /in/marc-obrador
None
Source: https://en.wikipedia.org/wiki/Reverse_engineering It’s illegal (in the EU)!
None
Josep Bernad iOS Albert Sunyer UI
Artà is in Mallorca ABF takes place (usually) in June
COVID-19 pushed it to … ?
None
Get to know the app Step 0
Get to know the app
Get to know the app
Get to know the app
Get to know the app
Static Analysis Step 1
Static Analysis
Getting the APK
Decompiling the app https://ibotpeaches.github.io/Apktool/ $ brew install apktool
Decompiling the app
None
None
None
None
None
Let’s keep looking around
Wait… “discount codes”?
App users get a discount for events
None
Let’s take a closer look…
None
HTTP Basic Authorisation = Base64(“username:password”)
None
HTTP Basic Authorisation = Base64(“username:password”) username = “string1” xor “string2”
pasword = “string3” xor “string2”
None
Protecting against static analysis ProGuard is a good start… for
regular apps • It’s just method renaming and code shrinking • Tools for reversing ProGuard exist: http://apk-deguard.com/ Other (paid) alternatives exist for obfuscation Writing sensitve code in native (NDK) is a good idea
Dynamic Analysis Step 2
Dynamic Analysis
Dynamic Analysis
Network Sniffing a.k.a MITM
Network Sniffing https://www.charlesproxy.com/
Setting Up Charles Proxy
Setting Up Charles Proxy
Setting Up Charles Proxy
First attempt…
First attempt…
Setting Up Charles Proxy
Setting Up Charles Proxy
Let’s try again…
None
None
None
None
None
• Use certificate pinning • Implement Root/Debugger/Emulator/Hooking Framework detection •
Try to detect app tampering Protecting against dynamic analysis
Using Certificate Pinning Source: https://developer.android.com/training/articles/security-config
Tampering with the App Step 3
Assuming the app implemented Certificate Pinning…
$ adb install “Downloads/Artà Beer Festival_v1.2.5_apkpure.com.apk” Performing Streamed Install Success
$ adb shell am start com.marcobrador.android.artabeerfestival/.SplashActivity Starting: Intent { act=android.intent.action.MAIN cat=[android.intent.category .LAUNCHER] cmp=com.marcobrador.android.artabeerfestival/.SplashActivity }
Let’s try to remove it
None
None
None
Time to give it a try!
None
None
Preventing Repackaging
Looks like we are done here Looks like we are
done here
This code can be removed, too!
Closing Thoughts
None
None
None
Thank you!