Monday, December 8, 2014

Simplify - Android Deobfuscator / Decryptor

Here it is: https://github.com/CalebFenton/simplify
I'd build you a jar, but there have been a lot of commits recently, and you'll probably want to build it yourself.

It decrypts most types of string encryption and can remove some types of obfuscation, especially code that doesn't actually do anything.

This may be all you want to know. But this has got me thinking about optimization and deobfuscation, so continue on if you're into that sort of thing.

App obfuscation and string encryption are getting more popular, and they can be annoying as fuck. But, fundamentally, obfuscators just apply a set of rules to code, and the rules aren't that complex, because complex is really hard. It's just a thin layer of changes added on top. Intuitively, this means a general solution for undoing the changes probably takes a little more effort to undo than it did to conceive the original rules. So no matter how bad things get for crackers, it should always be possible to make a tool to fix things up.

In the PC scene, obfuscators are more evolved, but so are the deobfuscators. Just look at the feature list on this: https://github.com/0xd4d/de4dot. It's a deobfuscator and an unpacker, plus it supports a huge list of stuff.

There are a few tools like this for Android, but they are not nearly as complex (yet). Time for bullet points!
Simplify deobfuscates by virtually executing an app and analyzing the execution afterwards. So if there is an encrypted string that gets decrypted at run time, Simplify will see the encrypted, see it passed to the decryption method, and see it get get decrypted. And after it knows the value, it can remove the encrypted value and the decryption method call as redundant and replace it with a 'const-string' instruction with the decrypted literal.

It's not all the way cooked yet, but the idea is solid, and there are some interesting issues github page I'd quite like to see implemented. One of them is deobfuscating reflection.

Also, anyone who takes the time to create issues on github and follow through with closing them when they're resolved, is probably more than a little obsessive. Should be fun to watch.

Saturday, September 20, 2014

Things Look Different

After a bunch of people told me how much the black background + white text was murderizing their eyes, I decided a bunch of people didn't appreciate my enlightened aesthetic sensibilities. Today's blog layout change to a white background + black text is in no way me admitting I was wrong.

Enjoy.

Unpacking APKProtect, Bangcle, LIAPP, Qihoo

Android packers getting more common, and if you're doing any significant amount of reversing, you're bound to come across one. While any serious reverser should 1.) familiarize themselves with how they work,  2.) unpack a few by hand, and 3.) write their own tool, it's always nice to kick back and pull something off the shelf. Or, at least, learn how someone else is doing it.

For this reason, I'd like to share with you the provocatively named android-unpacker from strazzere. Nothing says "i write c code" like a blunt and unambiguous project title!
https://github.com/strazzere/android-unpacker/tree/master/native-unpacker

From the readme, it already supports a few popular unpackers:
  • Bangcle (SecNeo)
  • APKProtect
  • LIAPP (preprelease demo)
  • Qihoo

Thursday, March 20, 2014

jadx - Dex to Java decompiler

there's a new decompiler on the block. it targets dex directly, rather than java class bytecode, so it doesn't rely on dex2jar. i'm pleased by it's performance so far, and it's worth checking out: https://github.com/skylot/jadx
  • it's mostly a cli, with a simple, "experimental" gui.
  • it takes dex or jar files as input
  • it can make a control flow graph.
  • output is configurable -- you can chose to have "simple" branching, where it wont try to be smart about how it decompiles conditionals and loops. this can actually be much easier to read than jd-gui's pervasive "while(true) //a bunch of stuff" constructs.

screenshot
GitHub page curiously lacking in GUI money-shot

Thursday, February 13, 2014

Native Protection & Mono by Nihilus


another interesting tutorial from Nihilus. here's the description from the guide:
this tutorial covers a basic understanding of the Mono/Xamarin for Android, specifically how C#/.NET is used lately to protect games and, who knows, even malwares.
here's the link: https://mega.co.nz/#!C1xU1YqA!m2QKsCIYePGnzmfGCQcZBQOho0nXINV_B4KfCdc6nOA

i was not aware of this ability to run mono code on android and found it interesting.

related to this, wine is on the way for android. this could get interesting.
http://wiki.winehq.org/FOSDEM2014?action=AttachFile&do=get&target=wine-on-android-fosdem-2014.pdf


Wednesday, February 12, 2014

zerdei's luyten, a worthwhile jd-gui alternative

if you use dex2jar + jd-gui and you find the results less than satisfying, that's normal. jd-gui hasn't been updated in at least 100 years. methods often fail to compile and blocks of code are sometimes omitted.

luyten, by deathmarine, which you can get here: https://github.com/deathmarine/Luyten/releases is a front end for procyon, a java decompiler. procyon+luyten has a higher success rate for decompiling methods in my experience, and has higher fidelity output, though it's more verbose. the UI isn't that great, but this pull request by zerdei includes several noteworthy improvements: https://github.com/deathmarine/Luyten/pull/13

feel free to clone and build the jar yourself, but if you're lazy, and somewhat trusting, i built this for you!
https://mega.co.nz/#!K95RlRiB!ak2DWRxC2DgPYDic0eDpQibAuGtIoFZGtU67GzyjEjM

Tuesday, December 24, 2013

hexicle utility

Hex has released a tool called hexicle which wraps a lot of common tools such as smali, baksmali, zipalign, etc. with a friendly ui. it's written in python and is made for linux. here's a bit from the readme, which you should totally read:

The tool is written in python using curses library. The tool comes inclusive of all tools that are necessary for it's fuctionality. Hexicle will always overwrite files. The sources are decompiled in a folder with a same name.


download v1.1: http://www.mediafire.com/download/8o9m2dr7pky2mnf/Hexicle+v1.1.zip
password: hexicle


 if you have any bugs or comments, Hex requested that you just post them here.