Android APK reverse engineering: Smali patching and Frida hooking

// Smali Patching Basics

Smali is the assembly language used by Android. When you get an APK, you're often presented with a mix of Java and Smali. Patching it involves modifying Smali code to alter application behavior.

Extracting the APK

First, you need the APK itself. Use apktool to decompile the APK:

apktool d app_name.apk

This command generates a directory containing the Smali files. The important folder is smali, which contains the Smali code you can edit.

Identifying the Target Method

To patch a method, identify its corresponding Smali file. Use the following to search:

grep -r "methodName" ./smali/

Once you find the method, locate its Smali representation. Smali methods are defined with the .method directive.

Making Changes

Edit the Smali file. For instance, if you're altering a return value:

.method public getSomeValue()I
    .locals 1

    const/4 v0, 0x1  # Original return value
    return v0
.end method

Change the return value to fit your needs:

    const/4 v0, 0x2  # Patch to change return value

Rebuilding the APK

After editing, rebuild the APK with:

apktool b app_name

You can then sign the APK using jarsigner or similar tools before deployment.

// Frida Hooking

Frida is a dynamic instrumentation toolkit that allows you to intercept function calls in real-time, which is particularly useful for bypassing security mechanisms.

Setting Up Frida

Install Frida on your device and your workstation:

pip install frida-tools

To inject Frida into the application, start by launching the app and noting its process ID (PID):

adb shell pidof com.example.app

Writing a JavaScript Hook Script

Create a hook script. For example, to alter a function that fetches sensitive data:

Java.perform(function () {
    var targetClass = Java.use('com.example.app.TargetClass');

    targetClass.sensitiveMethod.implementation = function () {
        console.log('Original method called');
        return 'Pwned!';  // Change return value
    };
});

Running the Hook

Use Frida to run the hook on the target app:

frida -U -l hook_script.js -f com.example.app --no-pause

The -U flag targets a USB device, -l specifies the script, and -f indicates the application.

// Certificate Pinning Bypass

Certificate pinning is a common defense mechanism in mobile apps to prevent MITM attacks. Bypassing this often allows for inspection of HTTPS traffic.

Using Frida for Unpinning

Modify your Frida hooking script to bypass certificate checks:

Java.perform(function () {
    var CertificatePinner = Java.use('okhttp3.CertificatePinner');

    CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function () {
        console.log('Certificate pinning bypassed');
        return;
    };
});

Running the Modified Script

Run the modified script similarly to before to enable your unpinning:

frida -U -l unpin_script.js -f com.example.app --no-pause

// Common Pitfalls

1. Incorrect Smali Syntax: Ensure you follow Smali syntax rules; a single mistake can break your APK.

2. Obfuscation: If the app is obfuscated, you may need additional tools like JADX to decompile Java bytecode for better visibility.

3. Security Mechanisms: Applications may detect hooking. Use techniques like frida-trace to aid in stealthier analysis.

4. Verification Issues: After patching, verify the app behaves as intended and does not crash during execution.

// Checklist for Reverse Engineering

• [ ] Extract APK with apktool
• [ ] Locate and modify target Smali methods
• [ ] Rebuild and sign the APK
• [ ] Install and run on a test device
• [ ] Create and run Frida scripts to hook methods
• [ ] Test for successful modifications

The complexities of mobile security demand thorough knowledge and caution. Always practice in a controlled environment where you have permission to operate, and ensure that your methods align with ethical guidelines.

--- // FIELDOPS REPORT AUTHORIZED BY: Bruce H. //