Apk.sh is a Bash script that makes reverse engineering Android apps easier

https://github.com/ax/apk.sh

by petodo • 4 years ago

401 88 4 years ago

github.com

danuker3• 4 years ago

Scripts like this empowering the end-user is why I consider the Android ecosystem superior.

Waterluvian2• 4 years ago

*superior when evaluated against one of many different criteria for what’s important to many different users.

(A good time to remind tech people: 98% of users are not our user persona)

otachack• 4 years ago

Right, but the transparency and access allow the 2% to put in the work and advocate for the rest.

dec0dedab0de• 4 years ago

I think 98% is a bit high, but even if it were true the desires of the masses only matter if you're trying to sell something. I think it's safe to just assume that all opinions and suggestions on hn are for a technical audience.

realusername• 4 years ago

That's fine, nobody is being forced to customise their system if they don't want to, the option should be there.

black3r2• 4 years ago

i used to be an android poweruser in high school and college, I rooted my phones, played around with lots of custom roms, had a terminal emulator and full power of arm debian installed in a chroot environment, tried different keyboard apps, launchers, and all other customization possibilities...

then I started working full-time and had way less free time and realized 99% of the time I now use my phone to read news sites and take quick photos, and then switched to iPhone...

danuker3• 4 years ago

Among the top 5 deathbed regrets is working too much.

Many indicators of quality of life face diminishing returns past a $30k/yr (2005) threshold.

tpush2• 4 years ago

Why the switch, though? You can check the news and take quick photos on an Android, too; The vast majority of Android phones aren't being used for tinkering.

freedomben5• 4 years ago

This is fascinating, I really want to understand.

Was Android (even stock) insufficient for reading news sites and quick photos? Or is iOS much better for you at those tasks? If that's all you need, then I would consider both Android or iOS sufficient, but I don't quite get why you'd give up so many options and capabilities to switch, unless iOS is much better at reading news and taking photos.

Maybe an analogy to help with my question. If all I need to do is unscrew Phillips number 2 screws and the occasional flathead, and I already had a great power drill with a bunch of bits in the kit (and had mastered it), why then buy a different power drill that that takes a proprietary bit and can only do Phillips and flathead? At some point I might have a need to do torx or hex or square, etc. Wouldn't you be better off having the capability should you need it? Why is it better to not have the capability?

t00• 4 years ago

Sounds like a step back, both in terms of creativity achieved by tinkering, and a downgrade of the quality of photos and videos.

saagarjha3• 4 years ago

Sounds like a recommendation for the author of the script, rather than the platform, no?

bool3max• 4 years ago

Is it possible to even create such a script for iOS applications?

userbinator• 4 years ago

I've noticed that a lot of the people who do Android modding, custom ROMs, etc. don't otherwise actually have any formal training in software or computing; they're just pursuing a goal of "I want my phone to do X" and end up learning a lot in the process. Indeed, this may be their first and only exposure to Java.

mmastrac4• 4 years ago

If you haven't tried Jadx [1], give it a shot. It's by far the easiest way to reverse Android APKs. It doesn't do patching or reassembly, but I used it for reversing the Delong'hi APK for longshot [2][3] and the quality of output was fantastic.

Note that scripts like this are extremely useful, but in the long term they're cobbling together a lot of tools and will become brittle or difficult to use across versions. I suggest that even if it works for you today, understanding exactly what's happening under the hood will help if the tool becomes unsupported long-term.

[1] https://github.com/skylot/jadx

[2] https://github.com/mmastrac/longshot

[3] https://grack.com/blog/2022/12/02/hacking-bluetooth-to-brew-...

motohagiography• 4 years ago

These are great. I used jadx to pull apart a conference attendee app I was supposed to install to see what it hoovered up. There is a level of reverse engineering that people can just get comfortable with doing without ahcieving the virtuosity of the stuff people publish papers and get talks about.

Simple things like, what SDKs does this thing use (adware), what external APIs does it call (trackers), what interfaces does it use (mic, gps, etc), what data does it hoover up (contacts, sms messages, etc), what parties does it send them to, how much effort do the authors go to obfuscate or hide what they are doing (packers, code obfuscators), does it use a static encryption key or derive one from predictable components, does it have hidden features from triggers and arguments - are all achievable for someone with a bit of interest and an afternoon. The more niche the app, the less sophisticated the protections on it, I find.

blacksmith_tb• 4 years ago

I have used ClassyShark[1] to get some of that (from F-droid) with pretty good results.

1: https://fossdroid.com/a/classyshark3xodus.html

j-bos• 4 years ago

How did you get the apk file to reverse without having already installed it?

anfractuosity• 4 years ago

Jadx is really neat :), I've used it to work out how an android app turned on the wifi of a wildlife camera via bluetooth.

I was also trying to use it to see how an app sends images to an NFC e-ink pricetag, but that looks rather more tricky at the moment.

grishka• 4 years ago

Jadx is useful for decompilation, yes — it produces the best results of all the decompilers I tried because it works with dalvik bytecode directly (vs converting it into regular JVM classes). If I need to patch an apk though, I'd first use jadx to find the place I need to change, but then it's apktool for actual patching in bytecode because it disassembles and reassembles dex files losslessly.

Java decompilers aren't intended to produce valid code that you can compile back. Sometimes they do, but it's more of a coincidence.

By the way. Another underrated reverse engineering tool is xposed framework. It was never intended to be one, but the ability to inject arbitrary code into any app and install hooks without having to modify the apk is a godsend.

mmastrac4• 4 years ago

Totally agree with this. I spend most of my time reading and only occasionally patching, so Jadx is perfect.

djmips• 4 years ago

Did you do this just for fun ( which is awesome ) or do you have some longer term goal?

jacob0192• 4 years ago

It seems to be made for injecting Frida into APKs. I'm having trouble understanding what Frida is. Can I do something cool with it?

saagarjha3• 4 years ago

Frida lets you hook behavior in apps. Think of it like mocking but for reverse engineers.

jacob0192• 4 years ago

Would this help to reverse engineer an encrypted API?

varenc2• 4 years ago

Sadly the name "Frida" suffers from poor googleability. But here you go: https://frida.re/

Basically it's _the_ reverse engineering toolkit for security researchers. Has excellent support across Android, iOS, macOS, Windows, etc.

biosboiii• 4 years ago

I did not know that Frida is used for anything but Mobile apps, thanks :D

xeonax• 4 years ago

It helps you inject a js runtime in your apps which have access to everything via reflection.

No need to recompile the app after making changes to smali (decompiled but modifiable language).

As you can just modify the js script and get the modified behavior.

varenc2• 4 years ago

I love seeing more excellent tooling made with bash/shell scripts. For situations like this one, where all the underlying heavy lifting is done with other CLI utilities, shellscript is the perfect fit.

simmonmt• 4 years ago

IME that's true until around 250 lines or so (this one is 500+). Then you've passed the point where "rewrite it in something more scalable / testable / maintainable" can easily be done, and you start having endless iterations of "it needs to be rewritten but I just want this one feature added so we'll do the rewrite later." And heaven help you if the script changes owners, gets additional owners, or you have to pick it up again after ignoring it for a year.

That's not to say the above doesn't happen with other languages/systems. It most certainly does. It just seems to happen faster in shell (especially when people start getting adventuresome in their use of fancy shell features).

chasil• 4 years ago

The Android system shell is the MirBSD Korn shell.

Why not use the preferred tool?

Otherwise, why not write it in dash for strict POSIX conformance?

I do admit that there are some profound bash applications that are important to me, principally rear.

jrm42• 4 years ago

While I'm here:

What is going on with "Android Emulation on Linux???"

I feel like I have to be missing something obvious, I can't see how it can be so darn hard to just run android apps on (desktop) Linux given..you know, that it is Linux.

tpush2• 4 years ago

The API of 'Linux' is its system calls, and I guess very few Android apps are coded against that; most use the Android SDK. So presumably Android's services and API surface need to be ported to desktop Linux, which is probably very involved.

MishaalRahman• 4 years ago

Is it hard? Check out Waydroid if you haven't already.

https://waydro.id/

jrm42• 4 years ago

Ha. I'm such a Wayland hater.

FINE. Maybe this will be thing...

bembo• 4 years ago

Why do you think it's hard? Waydroid is very good.

tommieb• 4 years ago

Reminds me of the old days of running this tool - kitchen sink, https://forum.xda-developers.com/t/kitchen-android-kitchen-v... those days of cyanogenmod/rolling your own rom based off Gingerbread 2.3.7 and hacking... happy memories :)

Group_B• 4 years ago

You recommend any projects that are similar to this and up to date?

lazycow• 4 years ago

LineageOS build guides are a great resource to get started: https://wiki.lineageos.org/build_guides

Abishek_Muthian4• 4 years ago

I was into reverse engineering android apps in the same period, My toolchain at that time was -

Java Decompilation:

Method 1: Dare + JD Decompiler +Cavaj (or) DJ Decompiler

Method 2: dex2jar + JD Decompiler + Cavaj (or) DJ Decompiler

Method 3 : AndroChef Java Decompiler

Accessing Apk Resource Files:

Apk Tool.

Selecting Decompilation of System Files:

Smali, Backsmali

Later a tool called Procyon replaced many of the aforementioned tools.

P.S. Not including links for any of those tools as apart from being obviously outdated, Many of those tools started flagging for malware in later days; Perhaps they're just false positive considering their feature set but I don't want to risk it.

mmastrac4• 4 years ago

dex2jar + JD Decompiler was my go-to as well, but I spent a long time staring at Smali directly.

fareesh2• 4 years ago

Can this be used to create a version of YouTube with no ads?

Lammy• 4 years ago

https://github.com/revanced/revanced-manager

Mogzol• 4 years ago

That already exists

https://github.com/revanced

fareesh2• 4 years ago

Cool they resurrected vanced - I must have missed this

dariosalvi78• 4 years ago

https://newpipe.net/

Sugimot02• 4 years ago

IIRC it should be noted that newpipe is more resistant to getting taken down because they're utilizing public api data and not altering youtube's app. Not sure if the new revanced is still a modded youtube apk.

ris58h• 4 years ago

You could use Firefox with uBlock Origin and Video Background Play Fix extensions. Just saying.

SeriousM2• 4 years ago

For a complete integration into vscode one can use ApkLab https://github.com/APKLab/APKLab

orliesaurus• 4 years ago

If anyone in this thread is really into this stuff I suggest you look into Lucky Patcher too!

tyilo• 4 years ago

Seems similar to my own script: https://github.com/tyilo/apkmagician

ngcc_hk• 4 years ago

Finally!!!

Well, this is not a news site but a <<hacker>> news site.

Great!!!

julkali• 4 years ago

The problem with tools that rely on apktool is that they tend to fail to patch the most sophisticatedly obfuscated apps typically banking apps. This is because they abuse implementation details in the Android source to essentially make it possible to unpack the app while installing, but impossible to repackage it (usually using sketchy non-utf8 characters and broken Manifests). The only way I found to patch these apps is by making them debuggable and then injecting Frida at run-time. This is possible by delicately patching the Manifest as precisely as possible. Full disclosure, I made a Python script without any dependencies: https://github.com/julKali/makeDebuggable

Apk.sh is a Bash script that makes reverse engineering Android apps easier

Related Stories