smali syntax highlighting for sublime

i have been using sublime text 2 + androguard plugin for decompiling and am liking it very much. it doesn't do as well producing correct java as, say, dex2jar + jdgui, but it's sometimes easier to read. it doesn't handle try/catch blocks at all -- just ignores them. this means it's a great alternative for jdgui, which will error out on methods with overlapping try/catch stuff.

since i've been using sublime, i've also needed a smali syntax highlighter, which i found here: https://github.com/ShaneWilton/sublime-smali

it's the best syntax highlighter i've seen because of the line level syntax validation it does. when you write smali, you can be more confident it is correct with this. you should check out the regex if you're a fan of such tedium.

three MessyBinary tutorials

MessyBinary has been hard at it, writing up some pretty slick tutorials. i'd like to share them with you. bonus points for posting mirrors.

• FaceNiff v2.4 - https://hotfile.com/dl/192441522/1464c87/fn24tut.zip.html
• WifiKill v2.2 - https://hotfile.com/dl/194586198/224b441/wfk22tut.zip.html
• GMD Smart Rotate v2.2.0 - https://hotfile.com/dl/202164304/8ac3409/gsr220tut.zip.html

the android reversing community is continually getting larger, but i'm not aware of any good forum where crackme's and specific app tutorials can be posted. when i find one, i'll let you all know.

update~~

new link for all three tutorials, https://www.mediafire.com/?l9e5k1a43kvccvd
thanks Nihilus!

string decryption with dex2jar

i have been getting a lot of questions about string decryption lately, so let's talk.

let's say you have an app and notice encrypted strings. strings are an easy way to get a basic idea of what code is doing so naturally you want to decrypt them. but how? there are many different ways to encrypt strings and then decrypt at runtime but in practices there are some assumptions we can make in decreasing order of likelihood.

1. the encryption must be reversible. the strings must be decrypted at run time somehow. this is good but we can assume even more.

2. the process is automated. when Alice wants to release her app she puts the source code through an automated modification process which iterates over every string literal, encrypts it and replaces it with a call to a decryption method with the encrypted string as a parameter.

3. decryption is the same or nearly the same for each string. there is only one decryption method.

4. the type signature of the method is:

static String decryptMethod(String)

while these assumptions hold, it is not very difficult to create a general technique by which we can decrypt all of the strings of an app in place. the real question is do you want to do it at the java or smali level? if you primarily look at decompiled code you can work at the java level. and you're in luck, such a tool already exists in dex2jar: http://code.google.com/p/dex2jar/

there is a wiki article about it here: http://code.google.com/p/dex2jar/wiki/DecryptStrings but it is unfinished. you can at least get a visual for what the decompiled code will look like before and after. if you're a good person, you will update the wiki. i leave that as a task for some good reader.

the tool is currently incorrectly spelled as d2j-decrpyt-string.(sh|bat). it takes at least two parameters and sometimes needs three. they are:

1. method name, -mn : in our case, decryptMethod
2. method owner, -mo : let's say com.alice.utils
3. class path, -cp : if decryptMethod makes use of any framework api, you will need to give the path to a framework.jar from the android.sdk

d2j-decrpyt-string -mn decryptMethod -mo com.alice.utils -cp ~/android/sdk/platforms/android-4/framework.jar

doing this at the smali level requires access to a dalvik vm, so in that regard it is trickier, but there are many emulators and you can even use your phone. here's how the process can work:

• pull out all of the strings and put into a file
• write some java code, unless you're comfortable with smali, to open the file and iterate over each line and call the decryption method on each string.
• compile java bytecode and convert to dalvik executable with dx from the android sdk
• run the code on a dalvik vm

android reverse tools - ART

here's a cool tool i was shown the other day. it's an easy-mode gui for all your decompiling and recompiling needs. ordinarily this would be rather unimpressive. it's not too hard to write a little wrapper for some java commands, but he/she really put some polish on this.

not only does it come with everything you need, including java and bits of the android sdk, but it even has a slick manual and a complete walk-through for my lesson0.crackme0.

here's a screen shot of the app:

 

here's the link to download (24mb): http://ul.to/or3kme6t
virus scan: https://www.virustotal.com/file/f6ac4279161b666811d80736a7a23790709c5b3ccb36a8f83dd138d9601eb480/analysis/1334082130/

as a first exercise, i recommend that you update the apktool included with the pack. it may have gone out of date. you can update the other components if you're so inclined but it might not help much.

if you have any trouble decompiling or compiling, remember it's using apktool under the hood so trouble shoot apktool first.

and if you want some more crackmes to try, here's deurus' profile on crackmes.de: http://crackmes.de/users/deurus

self-keygen tutorial by synack

previously, i posted a keygen tutorial and challenge, and synack has put his solution forward along with an interesting tutorial on creating a self-keygen, or a keygen that makes use of the original code to do the heavy lifting. it's very clearly written and organized, with plenty of good insight into the thought process as opposed to low-level "click here change this with no idea why" style tutorials.

download the solution and tutorial here: http://www.mediafire.com/?wzc45p269bcpbr5

keygen tutorial and challenge by zAWS!

keygen'ing as a style of cracking requires you to really know and understand how the protection works. it also requires no modification of the original application, so is a very pure way of cracking.

zAWS!, who posted a keygen for lesson 0's crackme0b, sent me this challenge to share:
http://www.mediafire.com/?5ik1659n1k514f9


but before you start, you may want to see his/her keygen tutorial. it comes with the original apk and has videos showing the process:
http://www.mediafire.com/?ckvuiadh5cegl9l

way of the android cracker 0 rewrite

i have learned a lot since first writing way of the android cracker so i rewrote it. actually i rewrote it about 17 times. this one was the least annoyingly pedantic.

here's a direct link: http://www.mediafire.com/download.php?5ybhkqbzwguubf3

lesson 1 rewrite is next.

update: crackme0b has been updated. thanks to zAWS! for writing a keygen for crackme0b so quickly (even copied the icon) and helping me see it. unfortunately the update breaks the keygen.