Abstract:

This video tutorial demonstrates an efficient method for decoding Java strings and analyzing dynamically loaded code within Android APKs, a technique valuable for rapid malware assessment without requiring a full Android emulator. The process leverages Jadx for initial decompilation and Visual Studio Code to execute the application's own obfuscation and decryption routines. The presenter guides viewers through identifying packed applications by cross-referencing AndroidManifest.xml entries with available classes, recognizing string obfuscation, and pinpointing dynamic code loading via DexClassLoader. The core of the technique involves extracting the application's decryption logic into a standalone Java project, feeding it the original classes.dex file (manually extracted from the APK), and then writing the newly unpacked Dalvik executable to disk, thereby revealing previously hidden malicious or obfuscated classes for further analysis.

Decoding Dynamic Android APKs Without an Emulator

• 0:00 Introduction to Quick Decoding: The video introduces techniques for rapidly decoding Java strings and analyzing dynamically loaded content in Android APKs, primarily for malware analysis, bypassing the need for an Android emulator or sandbox.
• 0:39 Analyzing the Sample with Jadx: A sample APK is opened in Jadx for decompilation. The APK's hash is provided for independent verification on platforms like VirusTotal.
• 1:11 Identifying the Application Entry Point: The entry point class is found within the AndroidManifest.xml file, specifically in the <application> tag's android:name attribute (e.g., com.ratgac).
• 2:49 Detecting a Packed Application: The presence of class references in the AndroidManifest.xml (e.g., cn.jpush) that are not visible in Jadx's decompiled source code confirms that the application is packed, indicating hidden code.
• 4:10 Initial Code Review: The attachBaseContext method is identified as the first to execute, followed by onCreate. String obfuscation methods and reflection calls (like getDeclaredField) are observed, suggesting dynamic code loading.
• 5:08 Recognizing Dynamic Code Loading: The DexClassLoader import in the code explicitly signals that the application dynamically loads a DEX file from disk, as opposed to in-memory loading with InMemoryDexClassLoader.
• 6:40 Understanding DexClassLoader Parameters: Consulting Android documentation for DexClassLoader helps in understanding the arguments required for its constructor: the Dex file path, an optimized directory, and a parent class loader.
• 7:35 Leveraging VS Code for Live Decryption: The method exploits the fact that the Android framework is built on Java. By isolating and copying non-Android-specific Java code from the decompiled APK, it can be executed in a standard Java environment using VS Code.
• 8:18 Decrypting Obfuscated Strings: The video demonstrates copying an obfuscated string literal and the corresponding decryption method from Jadx into a VS Code Java class. Executing this code reveals the cleartext string (e.g., android.app.LoadedApk).
• 10:34 Pinpointing File Write Operations: Searching for FileOutputStream within the decompiled code helps identify where the application writes files to disk, which is crucial for locating the dynamically generated DEX file.
• 11:41 Identifying the Core Decryption Function: A key function is found that takes a byte array (the encrypted data) and a filename string, then performs decryption and writes the decoded bytes to the specified file.
• 12:19 Reconstructing Decryption Logic: Essential Java imports are copied from Jadx, and the application's decryption methods (including AES decryption) are pasted into the VS Code project, often made static for direct execution.
• 15:10 Tracing Encrypted Data Source: By analyzing the byte array passed to the decryption function, it's discovered that the application reads its own installed APK (treated as a zip file), extracts the classes.dex entry, and uses those bytes for decryption.
• 19:19 Manual classes.dex Extraction: Instead of programmatically replicating the APK's internal classes.dex extraction, the file is manually extracted from the APK using 7-Zip and placed in the VS Code project directory.
• 20:58 Executing the Unpacking Program: The Java program in VS Code is configured to read the manually extracted classes.dex file, pass its bytes to the reconstructed decryption method, and write the decrypted output to a new file named dump_output.
• 27:50 Verifying the Unpacked DEX: The dump_output file is loaded into a new Jadx instance, successfully revealing the cn.jpush classes that were previously hidden, thus confirming the dynamic code has been unpacked.
• 28:45 Key Takeaways: This method effectively unpacks packed Android APKs without an emulator, enabling detailed analysis of dynamically loaded and obfuscated code. It's noted that while packing/obfuscation indicates hidden code, it doesn't automatically imply malicious intent, as it can also be used for intellectual property protection.