> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/mobile/reverse-android-apks/android-dinamic-analysis.md). # Android Dynamic Analysis ## **Emulator 1:** Genymotion ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-Mcmpu1yLdJo70UggXy2%2F-Mco4Hdl2P_UQip8wXqF%2Fimage.png?alt=media\&token=2aec8085-2f2a-4c70-b034-8956ced5a988) {% hint style="success" %} **If you need to execute ARM APK on Genymotion:** {% endhint %} ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-Mcmpu1yLdJo70UggXy2%2F-Mco4NOGOGavKKgvXrBg%2Fimage.png?alt=media\&token=951a0aa4-86b7-4874-af41-b29d38ddf223) ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-Mcmpu1yLdJo70UggXy2%2F-Mco4Y3tTe-otYx4kcj7%2Fimage.png?alt=media\&token=8099d1b5-7d45-43b0-8e0f-1ad32d7ff0dc) Click **import/export CA certificate** --> **Export** --> **Certificate in DER format** --> Choose a path and name it anything with a **.cer** extension --> **Next** ``` cd C:\Program Files\Genymobile\Genymotion\tools .\adb.exe root .\adb.exe remount .\adb.exe push C:\Users\sirpe\Downloads\burp.cer /mnt/sdcard/ .\adb.exe shell root@vbox86p:/ # cd /mnt/sdcard root@vbox86p:/mnt/sdcard # ls Alarms Android DCIM Download Movies Music Notifications Pictures Podcasts Ringtones burp.cer --using adb standard-- .\adb.exe connect localhost:21503 .\adb.exe remount .\adb.exe push C:\Users\sirpe\Downloads\burp.cer /mnt/sdcard/ .\adb.exe shell ``` **Security > Install from SD Card** ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-McoLnlrwJKF6MxgJaof%2Fimage.png?alt=media\&token=d5b20f95-0fc9-4349-9f04-275bc459bbd8) After that, **install the certificate also inside the SYSTEM trusted certificates.** Export the .der certificate from burp. ``` --- PREPARE the CERT to import---- openssl x509 -inform DER -in burp -out burp_cert.pem openssl x509 -inform PEM -subject_hash_old -in burp_cert.pem openssl x509 -inform PEM -subject_hash_old -in burp_cert.pem | head -n 1 9a5ba575 mv burp_cert.pem 9a5ba575.0 -- Import it-- .\adb.exe connect localhost:21503 .\adb.exe remount .\adb.exe push 9a5ba575.0 /system/etc/security/cacerts/ C:\Users\sirpe\Downloads\9a5ba575.0: 1 file pushed, 0 skipped. 3.4 MB/s (1375 bytes in 0.000s) ``` Confirmation: ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-Mcp_9V1F50GjWvXdhQH%2F-Mcpd0iUp8CeO5n-0cn5%2Fimage.png?alt=media\&token=d9953831-ce05-4247-9cfe-bbbb416a6af1) Configure also the proxy settings in the emulator: ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-Mcmpu1yLdJo70UggXy2%2F-Mco9AiacaDf8fNroo8G%2Fimage.png?alt=media\&token=8b0562ed-9869-4c49-a01c-915d79fa1728) Now, on the Wi-Fi settings: ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-Mcmpu1yLdJo70UggXy2%2F-Mco9FKhq5QbYneyj7pp%2Fimage.png?alt=media\&token=e5df6935-18bb-4c58-bed5-c3601943badf) ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-Mcmpu1yLdJo70UggXy2%2F-Mco9Ixw_dranrdfFYlt%2Fimage.png?alt=media\&token=e0a4b1bc-8c47-4b0c-8afc-e151b5fb529e) Finally, install the target apk. ``` .\adb.exe install C:\Users\sirpe\Downloads\app.apk ``` ## Emulator 2: Memu Play ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-McozSHIdQC0eDmdplVv%2Fimage.png?alt=media\&token=25d8deeb-e39d-47fe-812e-212450d3abe6) To configure it with burpsuite, use the same steps above. **ProxyDroid** is also a good option to bypass some restrictions and filtering all the traffic via burp. ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcozr0ntydHQTPMOCoH%2Fimage.png?alt=media\&token=c665bbd6-a170-4280-b3d0-fe8086c23d1a) Don't forget of putting the Memu VM as "**root**". ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcp-37xMhO3CfaEWBgg%2Fimage.png?alt=media\&token=3130a282-f910-4b17-8169-bebc6f768f55) ## Install python3 - Windows 10 1\. Go to the website and download the latest version of Python\ \ 2\. After downloading the file, run the installation file.\ \ 3\. Put a checkmark on Add Python to PATH and then on Customize Installation ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcp-c9Gp7TdHoo27wdE%2Fimage.png?alt=media\&token=62c8df37-7cea-42f4-bc7e-71ee4df848ae) 4\. At this step, make sure that there are checkmarks everywhere. ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcp-kP_yiY5TjjbcF1d%2Fimage.png?alt=media\&token=4b8ab603-e039-4abc-a842-bebd5e701cae) 5\. Here is the same thing, pay attention to the checkbox **Add Python to environment variables** and change the default folder, for example, to **C: \ Python** ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcp-oqAeKoo22cgoVFy%2Fimage.png?alt=media\&token=f4f362d1-0bcc-4735-a8c5-b75c36403de9) 6\. We are waiting for the installer to do its job.\ \ 7\. Removes restrictions on the length of the file name.\ \ 8\. Further, in order for Python to work normally, go to **Options-> Applications and Features-> Application Execution Aliases (App execution aliases)** and remove the toggle switches
![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcp0-UlVeLfg-0A7qGI%2Fimage.png?alt=media\&token=066b71dc-bb33-4f05-a60e-df5f9bed3e10) 9\. Next, open cmd as administrator and enter these two commands: ``` msiexec /unreg msiexec /regserver python --version ``` ## Python3 venv + Frida Open a cmd.exe terminal with **Administration privileges**. ``` PS Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned python -m venv . PS C:\Tools\frida\frida_venv\Scripts> .\Activate.ps1 ``` Open cmd with administrator rights and enter: ``` pip install frida pip install objection pip install frida-tools ``` ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcp0tT2r0Kw3-ZQTpSo%2Fimage.png?alt=media\&token=9d161e55-ce1d-4fa5-9d9c-eebc0eb2cd1b) Download adbtools and Frida-server + the rest 1. Download the latest version of adbtools on the site here and unpack it into a convenient folder, in my case it is C:\Tools\adb ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcp17MoDwsrXXzjaR03%2Fimage.png?alt=media\&token=8289992e-d681-4b96-a1d3-1e23e36939a2) 2\. We save this script under the name **fridascript.js** in the adb folder ```javascript Java.perform(function() { var array_list = Java.use("java.util.ArrayList"); var ApiClient = Java.use('com.android.org.conscrypt.TrustManagerImpl'); ApiClient.checkTrustedRecursive.implementation = function(a1,a2,a3,a4,a5,a6) { // console.log('Bypassing SSL Pinning'); var k = array_list.$new(); return k; } },0); ``` ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcp1MMTTQI6PjoQvsfD%2Fimage.png?alt=media\&token=66f9ace4-d05a-4018-a127-a7ac10cbcadc) 3\. Go to the emulator **Settings-> About tablet** and click on the **"Build number"** tab a couple of times 4\. Open **cmd** in the folder with **adb** and connect the device ``` adb connect 127.0.0.1:21503 ``` ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcp1msFJ94AKMdUo2hU%2Fimage.png?alt=media\&token=4906060c-a5cd-4ec2-be61-50e80d54107b) 5\. Next, we need to download the **Frida-server** in accordance with the architecture of our device, so for this we will enter another command in cmd`adb shell getprop ro.product.cpu.abi` ``` PS C:\Tools\adb\platform-tools> .\adb.exe shell getprop ro.product.cpu.abi x86 ``` 6\. Go to the site and download, in my case it's **frida-server-xx.xx.xx-android-x86.xz** Unpack the contents of the archive in the folder with adb or 7zip Now, upload frida-server into the device, for this we launch cmd from the adb folder and enter ``` .\adb.exe push .\frida-server-14.2.18-android-x86\ /data/local/temp .\adb.exe shell chmod 777 /data/local/temp/frida-server-14.2.18-android-x86 ``` Start the frida server: ``` .\adb.exe shell '/data/local/temp/frida-server-14.2.18-android-x86 &' --or-- (physical device) .\adb.exe shell "su -c '/data/local/tmp/frida-server-14.2.18-android-arm &'" ``` 7\. There will be no output from this command, and do not close this cmd window, we need to keep frida-server running while we intercept requests, now we will try to see all running services on the device, for this we open a new command line and enter `frida-ps -U` ``` (frida_venv) PS C:\Tools\frida> frida-ps.exe -U ``` ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McoLjWrjY4wmmOZaVXj%2F-Mcp3A3l9N3m3HAY1s7m%2Fimage.png?alt=media\&token=2cf328d9-c588-4930-8d28-b35ec8d11c58) ``` (frida_venv) PS frida.exe -U -l C:\Tools\adb\platform-tools\frida.js --no-pause -f com.instagram.android ``` ### frida-trace ``` frida-trace.exe -U -f 'com.xx.xx.xxx' -j 'android.util.Log!*' frida-trace -U -f 'com.xx.xxx.xxxx' -i '*Pesa*' -S frida.js frida-trace -U -f 'com.xx.xxx.xxxx' -i '*Pesa*' frida-trace -U -f 'com.xx.xxx.xxxx' -i '*Pesa*' -T ``` After that, a folder named "**\_\_*****handlers\_\_***" is created where you executed the **frida-trace** command. You can add your code to intercept a specific call, and re-run the trace. ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McyfOhgbAQMLUzWzmkg%2F-McyfthzU9zn94YKvHnh%2Fimage.png?alt=media\&token=5c90009d-6686-4c45-ab74-13fbcc8a7f7c) After re-run it, you will get it :sunglasses: ![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-McyfOhgbAQMLUzWzmkg%2F-Mcyg9K162z6t7dA00pV%2Fimage.png?alt=media\&token=f3536553-e3d7-4650-ba2c-982d134aa9b8) ### fridump ``` frida-ps -U python .\fridump.py -U com.xx.xx.xxxx ``` {% embed url="" %} {% embed url="" %} ### adb logcat ``` adb.exe logcat ``` ## `References` {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %}