31–40 of 49 posts
Does anyone have any stories to share involving apktool? Random note: It's curious how the homepage and the linked repo are on GitHub but the binary downloads are served from bitbucket.
APKTool is amazing. I used it to reverse engineer an old version of Netflix to allow it running on my Xiaomi projector. I no longer need it now as the projector is now Netflix-certified but it was incredibly useful to me in the earlier days. If your devices support Widevine L1 but not certified to run Netflix, you could use this little patch. https://github.com/longseespace/netflix_patch
Does anyone have any stories to share involving apktool? Random note: It's curious how the homepage and the linked repo are on GitHub but the binary downloads are served from bitbucket.
APKTool is so great. Earlier versions Android were way more loose with everything, there were tons of undocumented APIs, permissions weren't granular, didn't map to things that well, etc. 2012-2013 I wrote a parental control app for Android that "locked" down the device so you could give it to your kid and it would only run what you wanted it to run for however long you wanted, like "30 mins of games per day". To do…
Do you still have the code for this app? I was thinking of making something similar.
APKTool is amazing! I wrote an article on how to do end-to-end reverse engineering of Android apps using APKTool: https://yasoob.me/posts/reverse-engineering-android-apps-apk... I love using Jadx ( https://github.com/skylot/jadx ) to get a better understanding of the code in Java and then use APKTool to reverse engineer, decompile and recompile the app If you are interested, Frida is also an amazing tool that makes c…
You probably cant answer this here at least: Several UK TV apps are available on fire stick but not Android TV. I've seen people de-Amazonify older versions of these, would Apktool be a good place to do this myself ? I really just want to watch programs I already have access to on pretty similar hardware (Android TV), but getting more hardware for that just seems wasteful.
To some degree yes, apktool will unpack the apk and disassemble the dex files in a way in which you can modify them and then compile the project again, sign it and deploy it (as long as your device supports it).
In this case you would have to either modify the smali code itself to make those changes.
When the modifications are basic such as changing a few instructions to avoid checks or adding simplistic payloads writing them in smali is just fine but if your modifications are more substantial I'd suggest creating a placeholder java project, decompiling it and adapting that smali so it's less of a pain in the neck.
Another valid approach would be embedding a custom shared object or fridas gadget with a configuration file to run a payload on start.
As for understanding what you need to change and how, jadx is the way to go most of the times but for some nastier code you can either use dex2java and then jd on the converted file or just go straight to the smali code (honestly that's not that usual)
Also, while testing your patched version I'd suggest heavily using and abusing frida in a rooted device if possible.
Note : I don't usually use the "create a java project" option so your mileage might vary but I recon it's probably the easiest.
APKTool is amazing! I wrote an article on how to do end-to-end reverse engineering of Android apps using APKTool: https://yasoob.me/posts/reverse-engineering-android-apps-apk... I love using Jadx ( https://github.com/skylot/jadx ) to get a better understanding of the code in Java and then use APKTool to reverse engineer, decompile and recompile the app If you are interested, Frida is also an amazing tool that makes c…
This is the best article on Android app reverse engineering I have read. Thanks. Some more details on this step would be nice: > I currently have an iPhone so I installed the Android Emulator on my Linux machine and install the app on that. Then I launched mitmproxy and started intercepting the traffic from the emulator. Is this also the emulator from Android Studio? It would be very nice to intercept app traffic, wi…
Usually you have to use (or create) an unpinner frida script. In my experience it's been easier to just write down custom dumpers to avoid having to deal with that and also modifying the request (at least some time ago mitmproxy downgraded http/2 to http) which would result in the endpoint being able to detect the tampering.
As for the emulator, I haven't ever used the official one to work, I know some people who used Anbox in Linux but I don't have much to say because I use a real device most of the times (although I pleayer with ldplayer, bluestacks and genymotion all of which behaved nicely to some extent).
Does anyone have any stories to share involving apktool? Random note: It's curious how the homepage and the linked repo are on GitHub but the binary downloads are served from bitbucket.
Using APKTool I managed to decompile the app, add some printf logging to figure out the issue, fix it in the Italian/more advanced one, merge it with the English one and rebuild it.
The only issue is that the signing key was lost too, so partners had to uninstall and reinstall, but nothing I could do about it.
Oh, and another time I cracked the in-app purchase for the password manager I was using on a spare Android device while my Lumia was in RMA (it had separate purchases for each platform). Of course I bought it once I let go of Windows Phone and moved to Android permanently.
Does anyone have any stories to share involving apktool? Random note: It's curious how the homepage and the linked repo are on GitHub but the binary downloads are served from bitbucket.
Android has this really annoying feature where apps don't trust self-signed CA certs (but Chrome & webviews do, strangely). You either need to need to add it to the app's network_security_config.xml, or root the device and add it as a system CA.
I looked into using apktool as part of a pipeline to inject our self-signed CA as a custom trust anchor when customers uploaded their APK for testing. But in the end, we found it was easier and simpler to just add a the cert as a system CA on a custom rooted AVD.
That whole project really made me appreciate that no matter how shit I feel web dev is some days, at least I'm not an android developer.