So in the previous lesson we saw that by using APKtool we were able to obtain smali code of an 1
application in which we did not have the actual source code. 2
In an ideal situation you would get the actual source code but that is not possible however there are 3
tools called Decompilers that are able to provide almost Java source code. 4
There are a number of different compilers available popular ones include JDGUI and Jad. 5
However there is one tool that contains a different number of compilers. 6
This tool is called byte code viewer. 7
So we downloaded this in the previous section. 8
Let's go to our downloads folder. 9
Now we run it using Java dash jar byte code viewer dot jar this tool is also available on Windows. 10
In that case you would just click on the jar file. 11
Now let's open the user interface of byte code viewer. 12
What we want to do here is add our APK so home flip cortex and here we have the APK so when you import 13
the APK byte code viewer which is an excellent tool is going to decompile the app and provide you with 14
the Decompiled source as well as the byte code and Smali. You have your packages on the left and when 15
you click on say main activity you can see that we've got what looks like Java code. 16
Now it is important to note that this is not compilable code. 17
Usually there will be errors because the Decompilation doesn't work perfectly. 18
But from here you can see a more human readable picture when compared to Smali. Now bytecodeviewer 19
has different panes. 20
The first pane is the Java Decompiler which is decompiled using Fernflour. 21
And here under the second pane you can see the actual byte code but we can change these. 22
So for example what if we don't want to use fernflour, 23
but instead we want to use Jadx, Change the pane close it and open it again and here you see that the 24
same code Decompiled using jadX, so sometimes you find that certain decompilers work while others give 25
you errors. 26
That is why a tool like byte code viewer is great. 27
Another thing you can do is set a pain to show Smalley. 28
So again go to the pane and choose smali code let's close this again and again here you can see we 29
now have jadx decompiled code on the left and the Smali code on the right. The Smali is the same code 30
as we saw before using APK tool. 31
So this is very good for seeing a side by side comparison. 32
For example here we have request permission method in Java. 33
And here we have it in Smali so all of this method over here which is request permission translates 34
to this code over here in Smali. So Java is more human readable but Smali is more reliable. The smali 35
code is compilable meaning you can technically change some values in the Smali and recompile it. 36
This is not the case with the Decompiled. Java so this takes some getting used to. At least if you have a 37
preference of seeing Java 38
and maybe you hate Smali. 39
You can use this view to follow the smali code and understand what it is doing in its corresponding 40
Java code. 41
OK so let's consider the challenge we presented earlier where the network security analyst told us that 42
they saw data being exfiltrated to postman dash echo. Now by code viewer has a search utility over here. 43
We can search strings regex method calls and field calls so based on this suspicion that the network 44
security analysts told us. Let's search postman and yes here we can see that there are two instances 45
of postman dash echo and we can see one instance inside sms receiver. Let's dig a little deeper into 46
SMS receiver and try to figure out what's happening over here. So OK here we have a broadcast receiver. 47
In a broadcast receiver, 48
we're going to tap on the on receive now in on receive. 49
He's checking the S M S that we received OK. 50
They're creating the SMS defining a string called SB2 so SB2 is the SMS that we just received. 51
And here we can see that they are starting a new network task and passing the SMS as an input to the 52
network test. 53
We don't have the task over here but we have it as SMS receiver dollar net task so net task is pointing 54
to access 0 0 0. 55
But we do not have decompiled code of access. 56
0 0 0. 57
So this is a good example for us. 58
Here we have a case where we can try different Decompilers to make better sense out of the code. 59
So maybe JADX wasn't good enough to give us information what we could do in that case is change the 60
Decompiler let's choose for example Fernflour which was the default one. OK close and open again. 61
Now if we go to that task we can see it accessing access 0 0 0. 62
Then if we go back to s m s receiver we can see what access 0 0 0 is doing so what it is doing here 63
is calling HTTP post and passing in the SMS data as a parameter then if we look in HTTP post we 64
can see the postman dash echo url. So here we have some suspicious activity where we have an app 65
that is meant to be just a shopping list and for some reason it created a broadcast receiver to receive 66
sms and it sent the SMS to a server so just like that by using the DEcompilers we've managed to 67
go through the flow of the code and we understood that this malware is actually doing something quite 68
malicious. 69
Also it was a good example to show the need for different compilers some are better than others and 70
sometimes it is best to use them in combination. the most trustworthy source however is always Smali 71
since it is compilable. 72
However as we saw here it is less human readable.