Downloaded 34 times
![5
Dynamic Binary Instrumentation ?
1. #include<stdio.h>
2. #include<string.h>
3.
4. int main(int argc, char *argv[]){
5. if (strcmp(argv[1], "adminx0a")){
6. printf("Access Granted");
7. }else{
8. printf("Access Denied");
9. }
10. }](https://image.slidesharecdn.com/dbi-assistedandroidapplicationreverseengineering-190802192026/85/DBI-Assisted-Android-Application-Reverse-Engineering-5-320.jpg)
![6
Dynamic Binary Instrumentation ?
1. #include<stdio.h>
2. #include<string.h>
3.
4. int main(int argc, char *argv[]){
5. printf("Inside main function");
6. if (strcmp(argv[1], "adminx0a")){
7. printf("comparison successful");
8. printf("Access Granted");
9. }else{
10. printf("comparison failed");
11. printf("Access Denied");
12. }
13. }](https://image.slidesharecdn.com/dbi-assistedandroidapplicationreverseengineering-190802192026/85/DBI-Assisted-Android-Application-Reverse-Engineering-6-320.jpg)
![18
Java
● Java.Perform(fn): fn will execute after the application class loader is initialized.
● Java.PerformNow(fn): Very useful for early instrumentation i.e. hooking the implementation of system classes and
functions.
● Java.use(className): Get wrapper for className which can be initialized by calling $new() on it.
● Java.enumerateLoadedClasses(callback): Enumerate all the classes loaded and execute callback functions on each of
them.
● Java.enumerateLoadedClassesSync(): Similar to enumerateLoadedClasses but returns an array of all of the loaded
classes
● Java.scheduleOnMainThread(fn): Run fn on main thread, useful for tinkering around the objects that must execute in
the main thread. Hint: UI
● Java.choose (classname, callbacks): Search for initialized instances of classname and execute the functions defined
in the callbacks.
● Java.array(dataType, []): useful when dealing with java arrays.](https://image.slidesharecdn.com/dbi-assistedandroidapplicationreverseengineering-190802192026/85/DBI-Assisted-Android-Application-Reverse-Engineering-18-320.jpg)
![5
Dynamic Binary Instrumentation ?
1. #include<stdio.h>
2. #include<string.h>
3.
4. int main(int argc, char *argv[]){
5. if (strcmp(argv[1], "adminx0a")){
6. printf("Access Granted");
7. }else{
8. printf("Access Denied");
9. }
10. }](/p?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fdbi-assistedandroidapplicationreverseengineering-190802192026%2F85%2FDBI-Assisted-Android-Application-Reverse-Engineering-5-320.jpg&__src=https%3A%2F%2Fwww.slideshare.net%2Fslideshow%2Fdbiassisted-android-application-reverse-engineering%2F160412684%23&__type=image)
![6
Dynamic Binary Instrumentation ?
1. #include<stdio.h>
2. #include<string.h>
3.
4. int main(int argc, char *argv[]){
5. printf("Inside main function");
6. if (strcmp(argv[1], "adminx0a")){
7. printf("comparison successful");
8. printf("Access Granted");
9. }else{
10. printf("comparison failed");
11. printf("Access Denied");
12. }
13. }](/p?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fdbi-assistedandroidapplicationreverseengineering-190802192026%2F85%2FDBI-Assisted-Android-Application-Reverse-Engineering-6-320.jpg&__src=https%3A%2F%2Fwww.slideshare.net%2Fslideshow%2Fdbiassisted-android-application-reverse-engineering%2F160412684%23&__type=image)
![18
Java
● Java.Perform(fn): fn will execute after the application class loader is initialized.
● Java.PerformNow(fn): Very useful for early instrumentation i.e. hooking the implementation of system classes and
functions.
● Java.use(className): Get wrapper for className which can be initialized by calling $new() on it.
● Java.enumerateLoadedClasses(callback): Enumerate all the classes loaded and execute callback functions on each of
them.
● Java.enumerateLoadedClassesSync(): Similar to enumerateLoadedClasses but returns an array of all of the loaded
classes
● Java.scheduleOnMainThread(fn): Run fn on main thread, useful for tinkering around the objects that must execute in
the main thread. Hint: UI
● Java.choose (classname, callbacks): Search for initialized instances of classname and execute the functions defined
in the callbacks.
● Java.array(dataType, []): useful when dealing with java arrays.](/p?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fdbi-assistedandroidapplicationreverseengineering-190802192026%2F85%2FDBI-Assisted-Android-Application-Reverse-Engineering-18-320.jpg&__src=https%3A%2F%2Fwww.slideshare.net%2Fslideshow%2Fdbiassisted-android-application-reverse-engineering%2F160412684%23&__type=image)
![23
Hooking Class Constructors
1.Java.perform(function () {
2. var mainactivity = Java.use("com.pragyan.circle.a");
3. mainactivity.$init.overloads[0].implementation = function(a,b,c,d,e) {
4. console.log(d);
5. return mainactivity.$init.overloads[0].apply(this,arguments);
6. };
7.
8. send("Hooks installed.");
9.});](/p?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fdbi-assistedandroidapplicationreverseengineering-190802192026%2F85%2FDBI-Assisted-Android-Application-Reverse-Engineering-23-320.jpg&__src=https%3A%2F%2Fwww.slideshare.net%2Fslideshow%2Fdbiassisted-android-application-reverse-engineering%2F160412684%23&__type=image)
![25
● Java Reflection API(s)
● Iterating over returned [Object Object] array.
Making sense out of [Object ----]
1. Java.cast(obj.getClass(), Java.use("java.lang.Class")).getDeclaredFields();
1. function getObjectDetails(obj){
2. for (var k in obj){
3. console.log(obj[k]);
4. }
5. console.log("done");
6. }](/p?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fdbi-assistedandroidapplicationreverseengineering-190802192026%2F85%2FDBI-Assisted-Android-Application-Reverse-Engineering-25-320.jpg&__src=https%3A%2F%2Fwww.slideshare.net%2Fslideshow%2Fdbiassisted-android-application-reverse-engineering%2F160412684%23&__type=image)
![26
Interceptor
1. Java.perform(function(){
2. var checkfopen = Module.findExportByName("libnative2.so", "Java_com_devadvance_rootins
pector_Root_checkfopen");
3. if(checkfopen){
4. console.log("checkfopen is at: "+checkfopen)
5. Interceptor.attach(checkfopen,{
6. onEnter: function(args){
7. //casting jstring object to String
8. console.log(Java.cast(ptr(args[2]), Java.use("java.lang.String")));
9. console.log("checkfopen called");
10. },
11. onLeave: function(retval){
12. // returning false for the check
13. retval.replace(ptr(0));
14. }
15. });
16. }
17. });](/p?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fdbi-assistedandroidapplicationreverseengineering-190802192026%2F85%2FDBI-Assisted-Android-Application-Reverse-Engineering-26-320.jpg&__src=https%3A%2F%2Fwww.slideshare.net%2Fslideshow%2Fdbiassisted-android-application-reverse-engineering%2F160412684%23&__type=image)
![29
SQL Cipher – Find and Decrypt
1. Java.choose("net.sqlcipher.database.SQLiteDatabase",{
2. onMatch: function(ins){
3. var path_parts = ins.getPath().split("/");
4. var db_name = path_parts[(path_parts.length -1)].split(".")[0]
5. console.log("DB Name: "+ db_name)
6. var rnd_db_name = db_name + "_" +random_name(5);
7. var sql1 = String.$new("ATTACH DATABASE '/data/user/0/com.test.production/databases/"+rnd
_db_name+".sql.plaintext' as "+rnd_db_name+" KEY '';");
8. var sql2 = String.$new("SELECT sqlcipher_export('"+rnd_db_name+"');");
9. var sql3 = String.$new("DETACH DATABASE "+rnd_db_name);
10. ins.rawExecSQL(sql1);
11. ins.rawExecSQL(sql2);
12. ins.rawExecSQL(sql3);
13. console.log("Found SqlCipherDatabaseProvider instance");
14. },
15. onComplete: function(ins){}
16. });](/p?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fdbi-assistedandroidapplicationreverseengineering-190802192026%2F85%2FDBI-Assisted-Android-Application-Reverse-Engineering-29-320.jpg&__src=https%3A%2F%2Fwww.slideshare.net%2Fslideshow%2Fdbiassisted-android-application-reverse-engineering%2F160412684%23&__type=image)
SD
Uploaded bySahil Dhar
2,147 views
DBI-Assisted Android Application Reverse Engineering
This document provides an overview of dynamic binary instrumentation (DBI) with a focus on the Frida framework for reverse engineering Android applications. It explains the installation process, command line tools, and various APIs available in Frida, along with example use cases such as root detection bypass and SQLCipher decryption. Additionally, it includes resources for further exploration of Frida frameworks and related references.
Related topics:
