Apktool

All posts tagged Apktool

Reverse Engineering: 5.Python script to automate “search-text” in decompiled files

Posted by Kulani Mahadewa on August 6, 2016

Posted in: Mobile Security. Tagged: Android, Apktool, automate, decomipiled source, grep, python, script, search term. Leave a comment

Hi :), In the previous post, I discussed automation of decompiling apks. Now, let’s have a look on how to check the availability of some text or term in the decompiled files.

So let’s continue our python script

decompileApk.py

#---------------------------filter for any term-------------------------------

#Create a new folder to include output files
if not os.path.exists(walk_dir + "_Decompiled/Outputs"):
 os.makedirs(walk_dir + "_Decompiled/Outputs")

primary_path = os.path.dirname(os.path.abspath("decompileApk.py"))
root_output = ''

# Create output file for each apk file
for dirs in os.walk(walk_dir+ "_Decompiled").next()[1]:
 root_output = os.path.join(walk_dir+ "_Decompiled/Outputs", dirs+'_output_paypal.txt')
 with open(root_output, 'a') as f:
 f.close

for root, subdirs, files in os.walk(walk_dir+ "_Decompiled"):

# exclude the files with .py
if 'Outputs' in subdirs:
 subdirs.remove('Outputs') 
 files = [ fi for fi in files if not fi.endswith(".py") ]

parent_directory = os.path.split(os.path.abspath(os.path.join(root, os.pardir)))[1]
if os.path.exists('./Outputs/'+parent_directory+'_output_paypal.txt'):
 root_output = os.path.join(walk_dir+ "_Decompiled/Outputs", parent_directory+'_output_paypal.txt') 
 
 with open(root_output, 'a') as f:
 for filename in files: 
    file_path = os.path.join(root, filename) 
 (out,err) = subprocess.Popen(['grep', '-rinIe', 'okhttp',file_path],stdout=f,stderr=f).communicate()
    print('--\nfile_path = ' + file_path)
    print out 
 f.close;

decompileApk

Cheers ! 🙂

Reverse Engineering: 4.Python script to automate decompiling Android apk files

Posted by Kulani Mahadewa on August 6, 2016

Posted in: Mobile Security. Tagged: Android, apk, Apktool, automate, python, python script. 5 Comments

Hi 🙂 , here I will explain how to write a simple python script to automate the process of decompiling Android APK files using apktool .jar.

First, you need to have apktool.jar installed at location “/usr/local/bin/”.
Then, put all the apk files in a directory: “/home/Documents/Project/APKS”.
Now, you can simply traverse inside this directory using os.walk (path_to_dir) and decompile each apk using the commands available with apktool.jar
Run the python script with this command

python decompileApk.py '/home/kulani/Documents/Project/APKS'

decompileApk.py

import os
import sys
import subprocess

walk_dir = sys.argv[1]
#-------------------------------------decompile----------------------------

i = 0

apktool = "/usr/local/bin/apktool.jar"

for root, subdirs, files in os.walk(walk_dir):
 list_file_path = os.path.join(root, 'my-directory-list.txt') 
 
 with open(list_file_path, 'wb') as list_file:
 for file in files:
 if file.endswith(".apk"):
 i=i+1
 print str(i)+"-"+file 
 os.system("java -jar " + apktool + " d " + root+"/"+file)

Cheers ! 🙂

Reverse Engineering: 2. Disassembling and Rebuilding with ‘Apktool’

Posted by Kulani Mahadewa on May 1, 2015

Posted in: Reverse Engineering. Tagged: apk, Apktool, decode, decompile, desasseble apk, framework-res, Linux, rebuild, reverse engineering, smali, Ubuntu, v.2.0. Leave a comment

Hi ! 🙂 “Apktool” is another reverse engineering tool specifically designed to decode, edit, analyse and rebuild android apk files. Here I will state the steps to installing Apktool version 2.0 on ubuntu 14.0. With the migration of Apktool to its version 2.0, some settings have reduced. According to the documentation of “Apktool” now it doesn’t required to add aapt separately, since it is included in the the apktool itself.

The default framework included in the Apktool is enough to decode most apk files except the manufacture apks, since they require additional framework-res specific for the manufacture.

Setting up APKTool

Download apktool.jar and apktool wrapper script for Linux environment from their official web site -> http://ibotpeaches.github.io/Apktool/install/ .

Change the owner of the files to your username of home directory.

This is required to allow access to the files.

Command $ chown -R username:username apktool.jar

Command $ chown -R username:username apktool

Change permission to allow executing the files

Command $ sudo chmod +x apktool.jar

Command $ sudo chmod +x apktool

Move the files to usr/local/bin

Command $ sudo mv apktool.jar /usr/local/bin

Command $ sudo mv apktool /usr/local/bin

Now you can run apktool commands from any directory.

Open a new terminal and execute apktool, you can see the help menu. Confirms the installation.

Command $ apktool

Now the environment is ready. So let’s try decompiling and rebuilding an random apk.

Decompiling …

Command $: apktool d <any.apk>

Ex.

Command $: apktool d PlayStore_v5.3.5.apk

The playstore apk is decompiled in to a new folder in the same directory.

The decompiled files include all the source files and resource files. The resource files are suffixed with .smali.

Rebuilding…

When you rebuild the resulted decompiled source files, two new folders will be created at the same location.

dist foler –> contains the rebuild apk file

Getting Framework-res

Before start decompiling any apk, find the available framework-res for the decompile to be properly happend.

Ex.

If your device is rooted, then you can pull out the available framework-res files.

Check for the available res files with following command.

Command $ adb shell

Command $ pm list packages -f

Pull out any available framework res files.

Command $ adb pull /system/framework/framework-res.apk

Note:

When your are trying to disassemble manufacture apks for instance Settings.apk, Contacts.apk, Maps.apk etc. you need to have proper framework resource. If that is not then you won’t be able to do the decoding properly.

Ex: When trying to decompile Maps.apk it says “Can’f find framework resources for package of id:2”