Saturday, September 20, 2014

Things Look Different

After a bunch of people told me how much the black background + white text was murderizing their eyes, I decided a bunch of people didn't appreciate my enlightened aesthetic sensibilities. Today's blog layout change to a white background + black text is in no way me admitting I was wrong.


Unpacking APKProtect, Bangcle, LIAPP, Qihoo

Android packers getting more common, and if you're doing any significant amount of reversing, you're bound to come across one. While any serious reverser should 1.) familiarize themselves with how they work,  2.) unpack a few by hand, and 3.) write their own tool, it's always nice to kick back and pull something off the shelf. Or, at least, learn how someone else is doing it.

For this reason, I'd like to share with you the provocatively named android-unpacker from strazzere. Nothing says "i write c code" like a blunt and unambiguous project title!

From the readme, it already supports a few popular unpackers:
  • Bangcle (SecNeo)
  • APKProtect
  • LIAPP (preprelease demo)
  • Qihoo

Thursday, March 20, 2014

jadx - Dex to Java decompiler

there's a new decompiler on the block. it targets dex directly, rather than java class bytecode, so it doesn't rely on dex2jar. i'm pleased by it's performance so far, and it's worth checking out:
  • it's mostly a cli, with a simple, "experimental" gui.
  • it takes dex or jar files as input
  • it can make a control flow graph.
  • output is configurable -- you can chose to have "simple" branching, where it wont try to be smart about how it decompiles conditionals and loops. this can actually be much easier to read than jd-gui's pervasive "while(true) //a bunch of stuff" constructs.

GitHub page curiously lacking in GUI money-shot

Thursday, February 13, 2014

Native Protection & Mono by Nihilus

another interesting tutorial from Nihilus. here's the description from the guide:
this tutorial covers a basic understanding of the Mono/Xamarin for Android, specifically how C#/.NET is used lately to protect games and, who knows, even malwares.
here's the link:!C1xU1YqA!m2QKsCIYePGnzmfGCQcZBQOho0nXINV_B4KfCdc6nOA

i was not aware of this ability to run mono code on android and found it interesting.

related to this, wine is on the way for android. this could get interesting.

Wednesday, February 12, 2014

zerdei's luyten, a worthwhile jd-gui alternative

if you use dex2jar + jd-gui and you find the results less than satisfying, that's normal. jd-gui hasn't been updated in at least 100 years. methods often fail to compile and blocks of code are sometimes omitted.

luyten, by deathmarine, which you can get here: is a front end for procyon, a java decompiler. procyon+luyten has a higher success rate for decompiling methods in my experience, and has higher fidelity output, though it's more verbose. the UI isn't that great, but this pull request by zerdei includes several noteworthy improvements:

feel free to clone and build the jar yourself, but if you're lazy, and somewhat trusting, i built this for you!!K95RlRiB!ak2DWRxC2DgPYDic0eDpQibAuGtIoFZGtU67GzyjEjM

Tuesday, December 24, 2013

hexicle utility

Hex has released a tool called hexicle which wraps a lot of common tools such as smali, baksmali, zipalign, etc. with a friendly ui. it's written in python and is made for linux. here's a bit from the readme, which you should totally read:

The tool is written in python using curses library. The tool comes inclusive of all tools that are necessary for it's fuctionality. Hexicle will always overwrite files. The sources are decompiled in a folder with a same name.

download v1.1:
password: hexicle

 if you have any bugs or comments, Hex requested that you just post them here.

Tuesday, October 29, 2013

Nihilus' Reversing DexGuard 5.x

Here's another tutorial kindly written by Nihilus.

It's a teardown of reversing DexGuard's protections, which are legion, along with some of the thought process behind it. I like it because it's pure reversing -- no cracking of the commercial app.

alternate link:!s8MgkDyY!Qd36YVri66wLN1mXFRCQrlebNnxqRKT-ftrlpybCs80

Kindly post feedback if you're so inclined, and contact me if you'd like to share your reversing knowledge :D