So now we're going to use objection for dynamic analysis before we go into this. 1
There's one thing we need to mention. Earlier on, 2
we saw how to extract an APK from our phone. 3
But the APK we were working with was actually a development app. 4
This means that the app was not signed on the other hand when you download an APK from an app store 5
you'll find that the developer signed the app when the app is not signed, 6
you may encounter a few problems particularly with dynamic analysis so let's go through the signing 7
process. What you're going to do is go to Android Studio and you're going to click on build here you're 8
going to have an option to say generate signed bundle slash apk. OK. 9
So click here follow the wizard. 10
You're going to click next if this is your first time signing an app you're probably not going to have 11
a key store. So in that case just create a key store here where you fill in password and you confirm 12
password, give it the name and the password validity by default it is twenty five years. If you want to 13
increase it because of what happened with the millennium bug... 14
Go ahead and increase it, then you can give information about the certificate. Here we'll just use one 15
created earlier, when you click Next make sure version 1 and version 2 are both clicked. Choose debug 16
or release depending on whether you're going to release or not. 17
OK let's do release, choose the path and just like this you'll be able to see... let's open the file where 18
this is located. Go to the path you specified when signing. 19
In our case it's this and here you have the signed apk. So the APK release is your signed version of 20
the application we were working with. 21
Now this should work with our online sandboxes or dynamic analysis tools. 22
That's your signed apk 23
We sign it because we're going to install it to the emulator. 24
So what we're going to do is start the emulator and in this case we actually use an emulator which is 25
version 24, this lab machine is a bit slow and sometimes newer emulators tend to have higher requirements. 26
In your environment 27
you can run your preferred version if need be. 28
Just go to the emulator or ADB part of the course. 29
Earlier on in case you need to revise how to set up an emulator. OK. 30
So before we continue let's recall the part of the static analysis, if you remember in download we had 31
the bytecodeviewer depending where you saved your byte code viewer. Let's run that again and have a 32
look at the code through some analysis we can try to identify some points of interest so just find your 33
APK. So it's under release and you just drag it onto the window just like that. 34
So if you remember the app was receiving an S M S and ex-filtrating it. 35
So it was stealing the S M S and sending it to some 36
URL 37
Now we kind of managed to understand what was happening but maybe we want to confirm even further also 38
in certain cases the statically Decompiled code may not have been so clear and maybe you're unable to 39
see in code what is happening exactly at some specific methods. 40
That's where dynamic analysis is extremely handy. 41
Consider this case here. 42
Remember we had an HTTP post but assume we couldn't trace exactly what was being exfiltrated. Maybe 43
we suspect it's the SMSs but we're not sure. Through dynamic analysis 44
we can try to understand what is happening over here at particular points within the class during execution. 45
OK so let's have a look at objection now. 46
We're going to go where the signed apk is and we want to run objection patchapk. 47
source and the path to our signed APK. Actually let's move the APK from the Android Studio path to 48
the flipcortex directory we created earlier OK. 49
So we moved the APK so now run objection patch APK source and the path to our assigned apk and we 50
can pass the gadget version. 51
I had some issues with some versions and this one worked. 52
So just to be safe let's use this. 53
Now this is going to instrument the APK meaning it's going to decompile the app, inject code and recompile 54
and sign the app all of this is done automatically while also using another tool called Frida for instrumentation. 55
This will allow us to hook into specific functions of the app dynamically. 56
OK so we give it some time and we can see it is signing the new APK and if we look into our folder now 57
we can see that instrumented version of our APK over here it appended objection to the name. 58
OK. 59
Now we can go ahead and install. 60
If you remember we can use ADB install, so ADB install and the name of the APK to install. 61
Now we can see that we can run the app but nothing will happen. 62
This is because it's waiting for us to run objection against the app. 63
So. 64
Objection. 65
Explore. 66
Then it will run the app. 67
Now we want to hook onto the HTTP post to do this. 68
We're going to run Android hooking watch class method pass the name of the method including the entire 69
package and class before, so com dot flipcortex dot Hello World dot SMSreceiver dot HTTP post, then 70
we're going to dump the arguments using dump dash args dump back trace using dump dash back trace and 71
finally dump the return values using dump dash return. 72
Great. 73
So now we're going to run this by pressing enter. 74
Now what this does is it hooks onto the instance of the HTTP post method and if it sees that this method 75
is invoked then it dumps all the info we specified in the console. So if you remember when we developed 76
the app we were able to do debugging inside Android Studio by adding breakpoints. 77
Here we sort of have a similar behavior where we can hook onto specific points in the code and obtain 78
info about the variables at runtime. 79
So this is quite useful. 80
OK. 81
Let's open the emulator here. 82
Go to send an S M S and let's see what happens when we receive an S M S. So click on phone changed the 83
text write something like Hey receiver then we click on send .. in the console we can see all the dumps. 84
This tells us that HTTP post was invoked as soon as the SM S was received which is what we expected. 85
Now also if we look at the arguments we can confirm that it actually was the S M S that was passed as 86
an argument similarly if we look at the return value we can see the U R L with the HTTP parameters, 87
that are being exfiltrated, so we can see post man dash echo and we can see the contents of our sms. 88
So here we are 100 percent sure that the S M S is being stolen. Through static analysis 89
we got a clear picture but it's not always so black and white. 90
Here we have 100 percent confirmation that as soon as we receive an S M S that S M S is being sent over 91
HTTP post to post-man dash echo so we can go to our network analysts and say yes your assumption was 92
correct. 93
We're seeing data being exfiltrated to this server and the data being sent is SMS's