classes.dex

Hi! 🙂 Here another way of decompiling an android apk file. This method does not directly decompile the source. First uses the tool “Dex2jar” to convert the classes.dex file in to a compressed jar file containing the .class files . Later the “jd-gui” decompiler can be used to decompile the jar file content to the original source. Following figure shows the process of compiling android source into an apk and the reverse engineering flow.

Convert the dex file to a jar with “dex2jar”

Download the latest “dex2jar” from –> (https://sourceforge.net/projects/dex2jar/files)

Unzip the file . The d2j-dex2jar.sh file in the dex2jar-2.0 diectory is used to generate the jar file.

Make the .d2j-invoke.sh file executable. Otherwise you will get permission denied message.

Command $ sudo chmod +x d2j-invoke.sh

Goto the dex2-jar foler –>Execute the following command to generate the jar file. This will create something like classes-dex.jar

This is the classes.dex file that I am using in the example.

Command $ sh d2j-dex2jar.sh <path to classes.dex file>

you can simply drag and drop the classes.dex file to the terminal so that it will take the path automatically.

The resulted classes-dex2jar.jar file will be generated in the same location.

You can unzip the jar file and see that it contains .class files

Decompile the original source with “JD-GUI” decompiler

Download the “jd-gui” for linux from -> (http://jd.benow.ca/)

Unzip the file and you will see “jd-gui” executable file.

If you are having 64 bit Ubuntu 14.0 then install following libs

Command $ sudo apt-get install libgtk2.0-0:i386 libxxf86vm1:i386 libsm6:i386 lib32stdc++6

Now run the “jd-gui”. It will open the decompiler

Open the generated classes-dex2jar.jar file from the decompiler. You will be able to view the original source from this.

Cheers ! 🙂

Hi ! 🙂 ‘Radare2’ is a reverse engineering framework which comes with an advanced command line interface which allows moving around the file, analyzing data, disassembling, binary patching, data comparison, searching, replacing, and scripting with a variety of languages, including Ruby, Python, Lua, and Perl. According to the documentation of ‘Radare2’ project, it supports on several platforms including GNU/Linux, Windows, FreeBSD, NetBSD, and OpenBSD etc. (Read more : http://maijin.github.io/radare2book/index.html)

Here I will be helping you to get familiar with the basic ‘radare2’ commands with simple examples. I am working on a LinuxVM with Ubuntu 14.0.

1. Getting source of radare2 from Github

Command :~$ git clone https://github.com/radare/radare2.git

Command :~$ git pull

Installing radare2

2. Installing radare2

Executing the install.sh file at sys folder.

Open the terminal at “android/reverse-engineering/radare2-0.9.8/sys” folder and execute the following command.

radare2-0.9.8/sys:~$ sys/install.sh

Now “radare2” is installed on your Ubuntu environment and can proceed with getting familiar with the commands. Radare2 has a set of simple commands so it will be easy to handle with them.

3. Getting familiar with commands

Creating a new document and start editing the doc.

To create a document with name “document-1”, execute the following command.

Command :~$ radare2 -w document-1

Re-sizing the file given the size in bytes.

To re-size the file to 1024 bytes, execute the following command. When you open the document in gedit, the allocated space is highlighted in red.

Command [0x00000000]> r 1024

Write a ‘string’ to the document at current address

To write a string to the document at the current address, just pass the string with the command ‘w’.

Command [0x00000000]> w hello

– To print the string at current address

Command [0x00000000]>  ps

Write a ‘string’ at a given address

To write a string to a given address, pass the new location address join with a ‘@ ‘ .

Command [0x00000000]> w dear @ 0x00000008

– To print the string at a given address

Command [0x00000000]>  ps@0x00000008

Seeking another address

– To seek into another address, give the location address with the command ‘s’.

Command [0x00000000]>  s 0x00000008

        [0x00000008]>

– To print the content in user-friendly hexadecimal way

Command [0x00000000]>  px

Disassemble code

– To disassemble code

Command [0x00000000]>  pd

– To disassemble code with a given no of opcodes.

Command [0x00000000]>  pd 5

Copy/Paste strings

– To copy the content to the clipboard use yank commands given the no of bytes to be copied.

Command [0x00000000]>  y 16

– To print the content that copied to the clipboard .

Command [0x00000000]>  yp

– To paste the content at to the clipboard at a given address. Use the ‘px’ command to see the changes at file.

Command [0x00000000]>  yy 0x00000016

……

Now lets see how it looks like when an android classes.dex file is open with ‘radare2’ for analyzing.

In the context of reverse engineering you will get an android ‘apk’ file fore analyzing. So first you need to extract the apk file. The extracted apk will contain following fles.