Reverse engineering of apk called Process Manager - Security Discussion

Can someone help me to understand how to build the server of this apk https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/ ?
I tried to disassemble the apk but it is obfuscated and I don’t know how can proceed.

Related

[Q] app decompiling/compiling tool for Windows

Like the title says i need a decompiling/compiling ..apktool is just not working for me!
All the other tools I know of are just wrappers around apktool, if it doesn't work nothing will. Instead of trying to find something else, troubleshoot what isn't working about apktool. Does it give some error? At what point in the process? Give as much detail as you can.
SifJar said:
All the other tools I know of are just wrappers around apktool, if it doesn't work nothing will. Instead of trying to find something else, troubleshoot what isn't working about apktool. Does it give some error? At what point in the process? Give as much detail as you can.
Click to expand...
Click to collapse
I placed two apktool files in windows folder.. Installed jre... I navigate to c/windows in cmd.. And I give command apktool if you (file direcory) without quotes...
And it just says that apktool command was not recognised..! These instructions I saw in a tutorial in xda only.. Don't remember where!!
"two apktool files" - did you download these two packages: http://android-apktool.googlecode.com/files/apktool-install-windows-r04-brut1.tar.bz2 and http://android-apktool.googlecode.com/files/apktool1.5.0.tar.bz2 and then unpack both and copy all the contents of both into C:\windows? If so, the "apktool" command WILL be recognised in the command line (from anywhere, not just in C:\Windows).

[Q] How to create odex from apk?

I've done a lot of searching for how to odex an apk and the only way I could find involves downloading a binary called "dexopt-wrapper" from a file host or attachment. I don't think it's a really good idea to run unverified binaries downloaded from the internet as root ...
Does anyone know where this program comes from, if the source code is available or how to build it?
Is there any way to create an odex using AOSP tools? I know there is a file in AOSP called /system/bin/dexopt but I can't figure out how to use it.

Source code from apk file error on opening

Hi, I am a noob
I downloaded an apk file.
I extracted the source code from it by the methods provided on the net.
I want ot learn the coding of the app..
On extracting and importing into the adt it does not shows errors but when i upload the same app on the phone it crashes "unfortunatly the app stopped working"
I am a newbie and i want to learn the code and so if i get the correct code i will be learn it faster..
Is there any reason why the app doesnt start.
Is it because we cannot extract the code properly from the app??
Thanks..
I want to kwon how this app is coded
https://play.google.com/store/apps/details?id=com.iter.falldetector&hl=en
for that i want to check the source code files

help with apktool

hi
apktool works 100% with any apk i use it with only the following.
Pocket AMC Reader_1.9.1.apk
when i decompile and rebuild and sign the apk wont work at all. (even if i dont make any changes to it)
any help would be great.
i have included this apk as an attachemnt to see if anyone can help.
try to copy over original signature.

Help to find a "clean" SystemUI file

Hi. I own a Uniwa A19S phone which runs Android 6. I just found out it came out of the factory with an infected SystemUI.apk file (a trojan is injected into the file).
Since the trojan can NOT be removed I badly need a clean copy of this file.
The version I'm looking for is: 6.0-1602570800 code 23 (about 5 Mb in size, other versions won't work). I searched around the net with no luck so far, therefore any help is greatly appreciated.
Thank you
Mike
1) how do you know it's infected?
2) why do you think there exist clean version of it?
Thanks alecxs for taking the time to reply.
My Eset antivirus detected this malware. I sent the file for further inspection to the ESET Malware Response Team which promptly replied with this:
Detection is correct. This malware is serving advertisements.
It has ability to download another applications and install them directly into the phone
In fact I found other applications and my phone was even hijacked and 6 calls were made to Tunisia and Morocco (but the phone company reimbursed me).
Luckily I was able to remove SystemUI.apk from the phone but as a result the phone is now crippled although functional. I was hoping to find someone with the same version of my systmeUI.apk file to restore the full functionality. Because, as you may imagine, a factory reset restores the trojan.
Mike
wallace108 said:
Hi. I own a Uniwa A19S phone which runs Android 6. I just found out it came out of the factory with an infected SystemUI.apk file (a trojan is injected into the file).
Since the trojan can NOT be removed I badly need a clean copy of this file.
The version I'm looking for is: 6.0-1602570800 code 23 (about 5 Mb in size, other versions won't work). I searched around the net with no luck so far, therefore any help is greatly appreciated.
Thank you
Mike
Click to expand...
Click to collapse
Use APKtool to unsign and decompile the apk then remove the trojan from the apk then recompile and re-sign the apk. Then replace the infected apk with your modified apk then reboot the device.
Droidriven said:
Use APKtool to unsign and decompile the apk then remove the trojan from the apk then recompile and re-sign the apk. Then replace the infected apk with your modified apk then reboot the device.
Click to expand...
Click to collapse
Thanks Droidriven for the instructions. I've never decompiled an apk file, this is new territory for me. But I'll look into it and will do my best.
Cheers
Mike
So I installed APKtool, and managed to decompile the apk. However, since I'm no expert here, I really don't know how to go about locating the viral payload and properly remove it without affecting the legitimate code during the process .... hmmmm ... I'm winging it here ....
wallace108 said:
So I installed APKtool, and managed to decompile the apk. However, since I'm no expert here, I really don't know how to go about locating the viral payload and properly remove it without affecting the legitimate code during the process .... hmmmm ... I'm winging it here ....
Click to expand...
Click to collapse
check the META-INF for permissions and apk data
Please bear with me because I'm confused. I really don't know what to look for.

Categories

Resources