Android applications are an interesting target for
reverse engineering. They are written in Java, which is tradi-
tionally good to decompile and are executed by Google’s custom
Java virtual machine, making them interesting to study. In this
paper we present the basic methods and approaches as well as
the necessary tools to reverse engineer Android applications. We
discuss how to change Android applications and show alternative
approaches including man-in-the-middle attacks and automation.
Scaling API-first – The story of a global engineering organization
How to reverse engineer Android applications
1. How to reverse engineer
Android applications
Finding Vulnerabilities through Reverse Engineering
Hasso Plattner Institute, Potsdam
Hubert Hesse, Lukas Pirl,
Christoph Matthies, Conrad Calmez
using a popular word game
as an example
??
Images: “Freepik” on flaticon.com (CC BY 3.0), Google (CC BY 3.0)
2. 1 Get the .apk
23 4
Extract the .apk
5
Decompilation
to Smali
Debugging
6Putting it
together
7 8Automation
Proxy
Decompilation
to Java
3. Our Example—a word game
● Top 10 word game in 145 countries (as of July 2014)
● More than 10.000.000 installs
● Over 50 million players
● Play online (with friends)
● 14 languages
● Free and premium version
6. ● APK (application package file),
archive file, based on JAR format
● Similar to Deb packages (in Ubuntu) or
MSI packages (in Windows)
● Contains program code, resources, assets, certificates, and
manifest file
● Can’t be directly downloaded from App Store
1
Get the .apk
Download using online “APK Downloader”
(http://apps.evozi.com/apk-downloader/)
- or -
Install on device and download using SDK tools
(adb pull <app_path> downloaded.apk)
7. 2
Extract the .apk
● Normal decompression using unzip fails
● Special tool: APKTool
○ Standard is APKTool 1.5.2. (not able to recompress correctly) (https:
//code.google.com/p/android-apktool/downloads/list)
○ APKTool 2.0.0 Beta 9 works
(http://connortumbleson.com/2014/02/apktool-2-0-0-beta-9-released/)
Decrompressing:
apktool d -d game.apk -o outdir
9. 2
Modifying resources
● Change arbitrary resources
● Repack into .apk file and install
Recrompressing:
apktool b -d outdir -o com.company.game.free_patch.apk
● Recompression works, Android fails with “can’t install”, wrong
certificate
○ APKTool tries to reuse as much as possible, doesn’t
recompute signature
10. 2Manually sign repacked apk:
● Create custom CA
● Java JAR Signing and Verification Tool
(http://docs.oracle.com/javase/7/docs/technotes/tools/windows/jarsigner.html)
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-
release-key.keystore com.company.game.free_patch.apk alias_name
Modifying resources
11.
12. .apk contains compiled code
● Dalvik bytecode interpreted by
the Dalvik Process virtual machine
● Stored in .dex (Dalvik EXecutable) files
APKTool translates this to “smali” (https://code.google.com/p/smali/)
● Abstraction of bytecode, closer to Java
● Dalvik opcodes (http://s.android.com/tech/dalvik/dalvik-bytecode.html)
● Can be edited directly
3Decompilation to Smali
13. .class public LHelloWorld;
.super Ljava/lang/Object;
.method public static main([Ljava/lang/String;)V
.registers 2
sget-object v0, Ljava/lang/System;->out:Ljava/io/PrintStream;
const-string v1, "Hello World!"
invoke-virtual {v0, v1}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V
return-void
.end method
3
Smali Hello World
14. Interactive debugging
● Set debuggable=”true” in AndroidManifest.xml
○ Repack using APKTool
● Need to connect smali sources to binary
● Workaround: pretend we have valid Java code
4
Debugging
<application android:allowBackup="true" android:hardwareAccelerated="true"
android:icon="@drawable/launcher_icon" android:label="@string/app_name"
android:name="com.company.game.core.GameApplication" android:theme="
@style/Theme.GameTheme" android:debuggable="true">
15. a=0;// .class public abstract La;
a=0;// .super Ljava/lang/Object;
a=0;//
a=0;//
a=0;// # instance fields
a=0;// .field protected final a:Ljava/lang/Object;
a=0;//
a=0;// .field private final b:Landroid/os/Handler;
a=0;//
4
Debugging
Smali code in comments
Placeholder
Java
16. Two ways to obtain java code
● Convert .dex files to .jar
○ Use standard java bytecode decompilers
● Disassemble .dex directly to .java
5
Decompilation to Java
17. Using dex files
● Androguard (https://code.google.com/p/androguard/)
○ Maps DEX format into full Python objects
○ Works in memory (My 4GB machine wasn’t enough)
○ Doesn’t immediately dump code into Java files
5
Decompilation to Java
18. Using jar files
● dex2jar (https://code.google.com/p/dex2jar/)
○ dex2jar, jar2dex, apk-sign
○ Supports recreating .dex from Java
● JD-GUI (http://jd.benow.ca/)
○ Popular jar-decompiler
○ Works 100% with “Hello World” app
5
Decompilation to Java
19. Combining Java decompilation and Smali
● Java more readable than Smali
● Unfortunately Java decompilation not
100% perfect
○ Invalid Java constructs or only
method signatures
○ Cannot recompile from Java sources
6
Putting it together
20. private void fixSpecialChars()
{
int i;
char ac[];
int j;
int k;
i = 0;
ac = tiles;
j = ac.length;
k = 0;
_L9:
if(k >= j)
break MISSING_BLOCK_LABEL_161;
ac[k];
JVM INSTR lookupswitch 6: default 80
// 40: 125
// 41: 137
// 47: 149
// 91: 89
// 92: 101
// 93: 113;
goto _L1 _L2 _L3 _L4 _L5 _L6 _L7
_L4:
break MISSING_BLOCK_LABEL_149;
_L1:
break; /* Loop/switch isn't completed */
_L5:
break; /* Loop/switch isn't completed */
_L10:
i++;
k++;
if(true) goto _L9; else goto _L8
_L8:
6When Decompilation fails
an example
Goto not supported in Java
Bare JVM instructions
21. Combining Java decompilation and Smali
● Approach: Use multiple Java decompilers
○ They tend to fail in different places
6
Putting it together
1. Find interesting parts in Java source
2. Check corresponding smali sources
3. Edit those
22. protected void roundEnd(boolean paramBoolean)
{
// …
this.resultData.setTotalScore(this.totalScore);
// …
startRoundSummary();
if (!this.isPractice)
{
this.currentRound.setWordsInRound(this.resultData.getMoves().size());
// …
this.currentRound.setPlayer1Moves(GameHelper.encodeMoves(this.resultData.
getMoves()));
this.currentRound.setPlayer1Score(this.totalScore);
// …
6
Manipulating the score
Opportunities for manipulation
● Server validation disallows this
27. 7
Proxy
Route all app traffic through custom proxy
● Used MitMProxy (https://github.com/mitmproxy/mitmproxy)
● Retrieve real server URL via Wireshark
● Redirect app traffic via /etc/hosts on device
● Custom SSL certificate
○ Install own CA in device
○ No certificate pinning
● Avoid compressed responses via HTTP header
○ Accept-Encoding: gzip;q=0,deflate,sdch
31. 8
Automation
Play the game automatically
● Generic external approach
○ No modification of binary necessary
○ Works for any app
Monkeyrunner (http://developer.android.com/tools/help/monkeyrunner_concepts.html)
● Test apps at the functional/framework level
● Able to simulate keystrokes, take screenshots
● Python bindings
32. 8Obtain all possible words
to play correctly
● apk contains .jet “dictionary” for
each language
● Btw, also a wordlist (probably)
used to check for cheaters
Automation
33. 8
Automation
Ruzzle .jet files
● Binary files
● Trie / Radix tree structure
● Optimal for the way the game
is played
● No duplicate encoding
of characters
● List of all excepted
words constructable
G
GA
GAM
GAME
GO
GOD GOT
G
O
D T
A
M
E
34. 8
Automation
Achieving the highscore
● Get all 16 letters
○ Input by hand / screenshot + OCR
● Find all valid words using the extracted
dictionary
● Simulate keystrokes for found words
○ Actually not enough time to enter all
valid words
36. Achievements
Found possibilities to:
✓ Enable logging
✓ Unlock premium features
✓ Achieve insanely high score through automation
✓ Extract protocol via man-in-the-middle attack
38. Pinned certificate
(installed at dev.
time)
App
Server
Get current
server
certificate
1
Compare
current and
pinned
certificates
2
if identical:
establish
connection
else: reject
3
Certificate Pinning
