SlideShare a Scribd company logo
Dynamic Analysis of Android Apps
MobSecCon 2015
Erez Metula , Application Security Expert
AppSec Labs (Chairman & Founder)
ErezMetula@AppSec-Labs.com
About me
Founder of AppSec Labs
Application security expert
Book author
Managed Code Rootkits (Syngress)
Speaker & Trainer
Presented at BlackHat, Defcon, RSA, OWASP USA,
OWASP IL, etc..
Secure Coding / Hacking trainer
AppSec Labs
The leading Application Security Company
A bunch of Application Security Experts
Ninja Pentesters of Web & Mobile Apps
Elite Trainers for Hacking & Secure coding courses
Agenda
Why dynamic analysis?
Memory dumps and analysis
Smali debugging
Setting breakpoints
Native debugging with IDA (building signatures, types etc.)
Runtime instrumentation and manipulation using
ReFrameworker
Why dynamic analysis?
Pentesing the app “from the inside”
Some examples – real world
scenarios encountered in the wild
Requests to the server side are encrypted , signed, or just
cannot be MiTMed for some reason
Your proxy is useless.
Dynamic values stored in memory - created while the app
runs, received from network, etc.
Decompiling is useless. The value is not in the code
Strings are obfuscated
Decompiling is hard
The app is using some hard coded values such as URLS,
encryption keys
Patching is time consuming
Example – requests with
signed data
Cannot manipulate with requests since they are
signed
Example – requests with
encrypted data
Cannot view/manipulate with requests since they
contain encrypted data
Example – obfuscated
code/values
Cannot read values from decompiled code since it is
obfuscated
What to do?
We must “work from the inside”
Let’s start with direct memory analysis
Exposure of
Code sections
Sensitive data – application data, passwords, encryption
keys, network traffic, calculations, etc.
Interactions with OS – files, processes, etc.
Memory Analysis
Eclipse’s MAT (Memory Analyzer Tool)
Dump the application’s current memory to disk
Go to the “DDMS” Perspective, select the app and click
“Dump HPROF file”
Query
Debugging
Debugging allows us to analyze the app in real time
Setting breakpoints
Bypassing restrictions
Jump into specific code sections
Expose secrets from memory
Debugging With Source
Debugging with the source is easy
Just load the project in eclipse
Place your breakpoint
And click debug
Debugging Without Source
(“smali debugging”)
Most often you will not have the source
Extracting the java code using dex2jar and creating
an eclipse project is a bit tricky
Rebuilding the project dependencies
Decompiled code not always recompiles
Alternatively, we can remote debug smali code
Major Steps
Decode apk in debug (-d) mode:
apktool d -d app.apk out
Make it debuggable at the AndroidManifest.xml <application>
tag
<application …. android:debuggable="true“ …>
Build new apk in debug (-d) mode:
apktool b -d out
Sign, install and run new apk
signapk input.apk
Major Steps - Continued
create Netbeans project
add new Java Project with Existing Sources, select "out" directory as project root
and "smali" subdirectory as sources dir.
Find application port using DDMS
it should be something like "86xx / 8700".
Attached debugger in Netbeans
Debug -> Attach Debugger -> select JPDA and set Port to 8700 (or whatever you
saw in previous step).
Set breakpoint.
NOTE – Officially, not all versions works, you need to use:
netbeans 6.8 and apktool 1.4.1
Currently, you can also use NetBeans 7.2 with Apktool
v2.0.0-Beta9
DEMO
Smali debugging
Tip - Wait for Debugger
Programmatically – by calling
android.os.Debug.waitForDebugger()
or
boolean debuggerAttached = false; while(!debuggerAttached ) { ; }
Another option – DEV tools
JNI Debugging
Suppose our target code is inside native .so files.
We can use IDA to analyze it, and GDB to remotely
debug it
Using IDA
You can use existing static binary analysis (such IDA) to better
understand the code
It will give you the idea where to start, where to set
breakpoints, etc.
JNI Debugging - Main Steps
Find the process id, attach to it and create a listener port
inside the device. Then remotely debug the app
ps
gdbserver :5050 --attach 1234 //pid=1234, port=5050
adb forward tcp:5050 tcp:5050
ndk-gdb
target remote :5050
Then use regular GDB commands such as break, continue,
finish, etc.
The ReFrameworker Platform
Changing App Behavior Without
Patching Any Code
Runtime manipulation framework by AppSec Labs
Integrated as part of AppUse
Released at BlackHat USA 2013
Presented at OWASP IL 2013 – look for the slides from last
year for more info!!
How it Works
The Android runtime was compiled with many hooks
placed into key placed inside its code.
The hooks look for a file called "Reframeworker.xml",
located inside /data/system.
So each time an application is executed, whenever a
hooked runtime method is called, it loads the
ReFrameworker configuration along with the
contained rules ("items") and acts accordingly.
Overview - With
ReFrameworker
Enabling / Disabling
ReFrameworker
Replacing the original device jars with our modified
version
DEMO – ReFrameworker
(if time permits)
Summary
Runtime analysis provide us with the means to
observe the behavior of an app during its execution
It allows us to inspect issues such as communication,
memory, file access, etc.
We can detect problems that are hard to see using
just static methods
ReFreameworker is a great platform for that
QUESTIONS ?
THANK YOU !
Erez Metula , Application Security Expert
AppSec Labs (Founder)
ErezMetula@AppSec-Labs.com
…and last thing: we’re hiring !!!

More Related Content

What's hot (20)

PPT
Agnitio: its static analysis, but not as we know it
Security BSides London
 
PDF
Ja coco ignite
Aleksandr Zhuikov
 
PDF
Code Review
Tu Hoang
 
PPTX
Mobile security part 2
Romansh Yadav
 
PPTX
Dynamic Security Analysis & Static Security Analysis for Android Apps.
VodqaBLR
 
PDF
Scrum Events and Artifacts in Action
Lemi Orhan Ergin
 
PDF
Code Coverage Revised : EclEmma on JaCoCo
Evgeny Mandrikov
 
PPTX
Mobile Application Security Testing (Static Code Analysis) of Android App
Abhilash Venkata
 
PDF
Static Analysis For Security and DevOps Happiness w/ Justin Collins
Sonatype
 
PDF
C# Cookware - presented at CukeUp! 2014
Manuel Pais
 
PDF
Effective code reviews
Sebastian Marek
 
PDF
Learning by hacking - android application hacking tutorial
Landice Fu
 
PPTX
Drozer - An Android Application Security Tool
nullowaspmumbai
 
PPTX
Mobile security part 1(Android Apps Pentesting)- Romansh yadav
Romansh Yadav
 
PDF
Top 5 Features To Look for in a Codeless Automation Solution -- Presentation ...
Applitools
 
PDF
Wrong Tool, Wrong Time: Re-Thinking Test Automation -- w/ State of Visual Tes...
Applitools
 
PPTX
Authentication Without Authentication
Soluto
 
PDF
Android voice skill sprint
Jim McKeeth
 
PDF
Continuous Integration: Live Static Analysis with Puma Scan
Cypress Data Defense
 
Agnitio: its static analysis, but not as we know it
Security BSides London
 
Ja coco ignite
Aleksandr Zhuikov
 
Code Review
Tu Hoang
 
Mobile security part 2
Romansh Yadav
 
Dynamic Security Analysis & Static Security Analysis for Android Apps.
VodqaBLR
 
Scrum Events and Artifacts in Action
Lemi Orhan Ergin
 
Code Coverage Revised : EclEmma on JaCoCo
Evgeny Mandrikov
 
Mobile Application Security Testing (Static Code Analysis) of Android App
Abhilash Venkata
 
Static Analysis For Security and DevOps Happiness w/ Justin Collins
Sonatype
 
C# Cookware - presented at CukeUp! 2014
Manuel Pais
 
Effective code reviews
Sebastian Marek
 
Learning by hacking - android application hacking tutorial
Landice Fu
 
Drozer - An Android Application Security Tool
nullowaspmumbai
 
Mobile security part 1(Android Apps Pentesting)- Romansh yadav
Romansh Yadav
 
Top 5 Features To Look for in a Codeless Automation Solution -- Presentation ...
Applitools
 
Wrong Tool, Wrong Time: Re-Thinking Test Automation -- w/ State of Visual Tes...
Applitools
 
Authentication Without Authentication
Soluto
 
Android voice skill sprint
Jim McKeeth
 
Continuous Integration: Live Static Analysis with Puma Scan
Cypress Data Defense
 

Viewers also liked (12)

PDF
Voxxed days Vilnius 2015 - Android Reverse Engineering Lab
Ron Munitz
 
PPTX
short film analysis
jaymelouisehu
 
PDF
X86 ROM Cooking 101 (Android Builders Summit 2014)
Ron Munitz
 
PPT
Topic 7 Heating, Ventilating and Air Conditioning System
Laura Law
 
DOCX
Ăn gì để ngừa chứng xơ cứng động mạch
kraig723
 
PDF
Building android for the Cloud: Android as a Server (AnDevConBoston 2014)
Ron Munitz
 
PDF
Android ROM cooking: A practical Tutorial (DroidCon Torino 2014)
Ron Munitz
 
DOCX
chỗ nào bán đồng hồ casio tốt giá rẻ nhất
mathew840
 
PDF
Welcome to MobModCon #1
Ron Munitz
 
PPT
2016 DHT2563 Topic 11 building, structure, finishes and sites
Laura Law
 
PPT
Chapter 7 Controlling
Laura Law
 
PPTX
Sahabat sejati
naylissaadah
 
Voxxed days Vilnius 2015 - Android Reverse Engineering Lab
Ron Munitz
 
short film analysis
jaymelouisehu
 
X86 ROM Cooking 101 (Android Builders Summit 2014)
Ron Munitz
 
Topic 7 Heating, Ventilating and Air Conditioning System
Laura Law
 
Ăn gì để ngừa chứng xơ cứng động mạch
kraig723
 
Building android for the Cloud: Android as a Server (AnDevConBoston 2014)
Ron Munitz
 
Android ROM cooking: A practical Tutorial (DroidCon Torino 2014)
Ron Munitz
 
chỗ nào bán đồng hồ casio tốt giá rẻ nhất
mathew840
 
Welcome to MobModCon #1
Ron Munitz
 
2016 DHT2563 Topic 11 building, structure, finishes and sites
Laura Law
 
Chapter 7 Controlling
Laura Law
 
Sahabat sejati
naylissaadah
 
Ad

Similar to MobSecCon 2015 - Dynamic Analysis of Android Apps (20)

PDF
Null Mumbai Meet_Android Reverse Engineering by Samrat Das
nullowaspmumbai
 
PDF
NanoSec Conference 2019: Code Execution Analysis in Mobile Apps - Abdullah Jo...
Hafez Kamal
 
PDF
Android_Malware_IOAsis_2014_Analysis.pdf
jjb117343
 
PDF
Null Dubai Humla_Romansh_Yadav_Android_app_pentesting
Romansh Yadav
 
PDF
Pwning mobile apps without root or jailbreak
Abraham Aranguren
 
PPTX
Making Security Agile
Oleg Gryb
 
PPTX
Android Penetration testing - Day 2
Mohammed Adam
 
PPTX
Hacking & Securing of iOS Apps by Saurabh Mishra
OWASP Delhi
 
PDF
Android Patching & Client-Side CyberSecurity
Ariel Tubul
 
PDF
Building Custom Android Malware BruCON 2013
Stephan Chenette
 
PPTX
From Reversing to Exploitation
Satria Ady Pradana
 
PPT
.NET Debugging Tips and Techniques
Bala Subra
 
PPT
.Net Debugging Techniques
Bala Subra
 
PPTX
Codename one
Software Infrastructure
 
PDF
Droidcon Greece '15 - Reverse Engineering in Android: Countermeasures and Tools
Dario Incalza
 
PPTX
Code Obfuscation for Android & WP7
Jeff Bollinger
 
PDF
2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing
Stephan Chenette
 
PPTX
Module-I_Introduction-to-Android.pptx
lancelotlaytan1996
 
PPTX
From Reversing to Exploitation: Android Application Security in Essence
Satria Ady Pradana
 
PPTX
Dev{sec}ops
Steven Carlson
 
Null Mumbai Meet_Android Reverse Engineering by Samrat Das
nullowaspmumbai
 
NanoSec Conference 2019: Code Execution Analysis in Mobile Apps - Abdullah Jo...
Hafez Kamal
 
Android_Malware_IOAsis_2014_Analysis.pdf
jjb117343
 
Null Dubai Humla_Romansh_Yadav_Android_app_pentesting
Romansh Yadav
 
Pwning mobile apps without root or jailbreak
Abraham Aranguren
 
Making Security Agile
Oleg Gryb
 
Android Penetration testing - Day 2
Mohammed Adam
 
Hacking & Securing of iOS Apps by Saurabh Mishra
OWASP Delhi
 
Android Patching & Client-Side CyberSecurity
Ariel Tubul
 
Building Custom Android Malware BruCON 2013
Stephan Chenette
 
From Reversing to Exploitation
Satria Ady Pradana
 
.NET Debugging Tips and Techniques
Bala Subra
 
.Net Debugging Techniques
Bala Subra
 
Droidcon Greece '15 - Reverse Engineering in Android: Countermeasures and Tools
Dario Incalza
 
Code Obfuscation for Android & WP7
Jeff Bollinger
 
2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing
Stephan Chenette
 
Module-I_Introduction-to-Android.pptx
lancelotlaytan1996
 
From Reversing to Exploitation: Android Application Security in Essence
Satria Ady Pradana
 
Dev{sec}ops
Steven Carlson
 
Ad

Recently uploaded (6)

PDF
Call For Papers - International Journal on Natural Language Computing (IJNLC)
kevig
 
PDF
💡 Digital Marketing Decoded: Mastering Online Growth Strategies for 2025 🚀
marketingaura24
 
PPTX
The Intersection of Emoji and NFT. What can be the Consequences?
Refit Global
 
PPTX
Mobile Apps Helping Business Grow in 2025
Infylo Techsolutions
 
PDF
Building Smart, Scalable Solutions with Android App Development
Brancosoft Private Limited
 
PDF
INTERLINGUAL SYNTACTIC PARSING: AN OPTIMIZED HEAD-DRIVEN PARSING FOR ENGLISH ...
kevig
 
Call For Papers - International Journal on Natural Language Computing (IJNLC)
kevig
 
💡 Digital Marketing Decoded: Mastering Online Growth Strategies for 2025 🚀
marketingaura24
 
The Intersection of Emoji and NFT. What can be the Consequences?
Refit Global
 
Mobile Apps Helping Business Grow in 2025
Infylo Techsolutions
 
Building Smart, Scalable Solutions with Android App Development
Brancosoft Private Limited
 
INTERLINGUAL SYNTACTIC PARSING: AN OPTIMIZED HEAD-DRIVEN PARSING FOR ENGLISH ...
kevig
 

MobSecCon 2015 - Dynamic Analysis of Android Apps

  • 1. Dynamic Analysis of Android Apps MobSecCon 2015 Erez Metula , Application Security Expert AppSec Labs (Chairman & Founder) [email protected]
  • 2. About me Founder of AppSec Labs Application security expert Book author Managed Code Rootkits (Syngress) Speaker & Trainer Presented at BlackHat, Defcon, RSA, OWASP USA, OWASP IL, etc.. Secure Coding / Hacking trainer
  • 3. AppSec Labs The leading Application Security Company A bunch of Application Security Experts Ninja Pentesters of Web & Mobile Apps Elite Trainers for Hacking & Secure coding courses
  • 4. Agenda Why dynamic analysis? Memory dumps and analysis Smali debugging Setting breakpoints Native debugging with IDA (building signatures, types etc.) Runtime instrumentation and manipulation using ReFrameworker
  • 5. Why dynamic analysis? Pentesing the app “from the inside”
  • 6. Some examples – real world scenarios encountered in the wild Requests to the server side are encrypted , signed, or just cannot be MiTMed for some reason Your proxy is useless. Dynamic values stored in memory - created while the app runs, received from network, etc. Decompiling is useless. The value is not in the code Strings are obfuscated Decompiling is hard The app is using some hard coded values such as URLS, encryption keys Patching is time consuming
  • 7. Example – requests with signed data Cannot manipulate with requests since they are signed
  • 8. Example – requests with encrypted data Cannot view/manipulate with requests since they contain encrypted data
  • 9. Example – obfuscated code/values Cannot read values from decompiled code since it is obfuscated
  • 10. What to do? We must “work from the inside” Let’s start with direct memory analysis Exposure of Code sections Sensitive data – application data, passwords, encryption keys, network traffic, calculations, etc. Interactions with OS – files, processes, etc.
  • 11. Memory Analysis Eclipse’s MAT (Memory Analyzer Tool) Dump the application’s current memory to disk Go to the “DDMS” Perspective, select the app and click “Dump HPROF file”
  • 12. Query
  • 13. Debugging Debugging allows us to analyze the app in real time Setting breakpoints Bypassing restrictions Jump into specific code sections Expose secrets from memory
  • 14. Debugging With Source Debugging with the source is easy Just load the project in eclipse Place your breakpoint And click debug
  • 15. Debugging Without Source (“smali debugging”) Most often you will not have the source Extracting the java code using dex2jar and creating an eclipse project is a bit tricky Rebuilding the project dependencies Decompiled code not always recompiles Alternatively, we can remote debug smali code
  • 16. Major Steps Decode apk in debug (-d) mode: apktool d -d app.apk out Make it debuggable at the AndroidManifest.xml <application> tag <application …. android:debuggable="true“ …> Build new apk in debug (-d) mode: apktool b -d out Sign, install and run new apk signapk input.apk
  • 17. Major Steps - Continued create Netbeans project add new Java Project with Existing Sources, select "out" directory as project root and "smali" subdirectory as sources dir. Find application port using DDMS it should be something like "86xx / 8700". Attached debugger in Netbeans Debug -> Attach Debugger -> select JPDA and set Port to 8700 (or whatever you saw in previous step). Set breakpoint. NOTE – Officially, not all versions works, you need to use: netbeans 6.8 and apktool 1.4.1 Currently, you can also use NetBeans 7.2 with Apktool v2.0.0-Beta9
  • 19. Tip - Wait for Debugger Programmatically – by calling android.os.Debug.waitForDebugger() or boolean debuggerAttached = false; while(!debuggerAttached ) { ; } Another option – DEV tools
  • 20. JNI Debugging Suppose our target code is inside native .so files. We can use IDA to analyze it, and GDB to remotely debug it
  • 21. Using IDA You can use existing static binary analysis (such IDA) to better understand the code It will give you the idea where to start, where to set breakpoints, etc.
  • 22. JNI Debugging - Main Steps Find the process id, attach to it and create a listener port inside the device. Then remotely debug the app ps gdbserver :5050 --attach 1234 //pid=1234, port=5050 adb forward tcp:5050 tcp:5050 ndk-gdb target remote :5050 Then use regular GDB commands such as break, continue, finish, etc.
  • 23. The ReFrameworker Platform Changing App Behavior Without Patching Any Code Runtime manipulation framework by AppSec Labs Integrated as part of AppUse Released at BlackHat USA 2013 Presented at OWASP IL 2013 – look for the slides from last year for more info!!
  • 24. How it Works The Android runtime was compiled with many hooks placed into key placed inside its code. The hooks look for a file called "Reframeworker.xml", located inside /data/system. So each time an application is executed, whenever a hooked runtime method is called, it loads the ReFrameworker configuration along with the contained rules ("items") and acts accordingly.
  • 26. Enabling / Disabling ReFrameworker Replacing the original device jars with our modified version
  • 27. DEMO – ReFrameworker (if time permits)
  • 28. Summary Runtime analysis provide us with the means to observe the behavior of an app during its execution It allows us to inspect issues such as communication, memory, file access, etc. We can detect problems that are hard to see using just static methods ReFreameworker is a great platform for that
  • 30. THANK YOU ! Erez Metula , Application Security Expert AppSec Labs (Founder) [email protected] …and last thing: we’re hiring !!!