Android Break The Limits Reverse Engineering

Posted by Security is just an illusion at Friday, January 25, 2013 Read our previous post

Android Reverse Engineering by cr4shyyy
Taget : os.devwom.usbsharereval  sry devwom
Taget version ; os.devwom.usbsharereval-2_1.6.1.3.apk

ROOTED DEVICE IS MANDATORY!!
7 days evaluation version.
Share only selected files or usb virtual, LUKS encrypted or unencrypted, disks via usb with PC/Radio car/Player ...
Also mount virtual Un/encrypted images in your device.
* Share only selected folder/directory.
* Share only desired files, preventing visibility of undesired files on your SD card.
To do this, select desired files with your favorite application and use "Usb Sharer" to this job.
* Create virtual USB encrypted or unencrypted disks and share only files inside it, rejecting access to other files in your sdcard.
Also you will encrypt all files and data if your disk is selected as encrypted. By default encryption is AES, and uses LUKS standard.

Its a very cool App,i have buy it too.
Now i want to test to reverse the the eval version.apk.
7 days evaluation version hmmm ?
Time to Reverse it !!!
Get some Decompiler i used apktool to Decompile it.

apktool d <file.apk> <directory to output to>

apktool b <directory of decoded apk>

After decompile we can see the smalicode and other files.
Here some sample code

.class public Los/devwom/usbsharereval/usbShare;
.super Los/devwom/usbsharereval/usbEventsHandler;
.source "usbShare.java"

# interfaces
.implements Landroid/view/View$OnClickListener;
.implements Landroid/widget/CompoundButton$OnCheckedChangeListener;
.implements Los/devwom/usbsharereval/actionManager$ActionDoneListener;


# static fields
.field private static final ACTIVATE_DATE:Ljava/lang/String; = "2013-01-13"

.field private static final ELATIME:J = 0x2932e000L

.field private static final FINAL_DATE:Ljava/lang/String; = "2013-03-13"

.field private static final LOG_TAG:Ljava/lang/String;

.field private static expDays:J

.field private static haVencido:Z

.field private static final imageExtensions:[Ljava/lang/String;

.field private static proChecked:Z

Cool now we can read some smali code Cool things we can read

ACTIVATE_DATE:Ljava/lang/String; = "2013-01-13"

.field private static final FINAL_DATE:Ljava/lang/String; = "2013-03-13"

Now we start the App on your Android Device.And we see this screen i hope .


Yeah i got 8 days with a simple trick pull the date back
After the 8 days we will see this screen.


hmmm now its over  we need to buy the Full version or Uninstall it  ……
No … Now its time to get dirty

We can read some string “Do you want buy full version?" Its a good Point to Start.
Now we search for “Do you want buy full version“ on the smaili code.

This is what i found.

<string name="wantbuy">Do you want buy full version?</string>

Now we search for “wantbuy” Next found

.field public static final virtualimage:I = 0x7f070029
.field public static final wantbuy:I = 0x7f07005b
.field public static final wantinstallscriptmanager:I = 0x7f070040

wantbuy got the Offset wantbuy:I = 0x7f07005b
Now lets search for the Offset 0x7f07005b

    .line 672
    invoke-static {p0}, Los/devwom/usbsharereval/usbShare;->vencido(Landroid/app/Activity;)Z

    move-result v3

    if-eqz v3, :cond_0

    .line 673
    new-instance v1, Landroid/app/AlertDialog$Builder;

    invoke-direct {v1, p0}, Landroid/app/AlertDialog$Builder;-><init>(Landroid/content/Context;)V

    .line 674
    .local v1, dlg:Landroid/app/AlertDialog$Builder;
    const v3, 0x7f07005a

    invoke-virtual {v1, v3}, Landroid/app/AlertDialog$Builder;->setTitle(I)Landroid/app/AlertDialog$Builder;

    .line 675
    const v3, 0x7f07005b

    invoke-virtual {v1, v3}, Landroid/app/AlertDialog$Builder;->setMessage(I)Landroid/app/AlertDialog$Builder;

This is what i found.

Landroid/app/AlertDialog$Builder;->setMessage(I)Landroid/app/AlertDialog$Builder

It tell us thats he built a AlertDialog with a Msgbox from the offset from wantbuy.
Here is the pic for this sample code

Now we can control the smali code and have Reverse Engineering it.
We need now to search for a If Statements like

if my penis bigger than yours do anything to become a bigger one.

In smaili code its looks like this.

 if-eqz v3, :cond_0

Now we change the “if-eqz v3, :cond_0” to “if-eqz v1, :cond_0”  and we will never see again the AlertDialogBox ;)

and now we skipped the hole AlertDialog Really ? Yeahhhh
Lets test it

apktool b Reverse unsecure.apk
Sign the new apk with any apk sign tool Like auto-sign apk google it.

The Results are :



Thats all we are done with Reverse Engineering and got a full working copy of usbsharereval.
Sry devwom i hope you read my blog and learn anything

Used for Personal use or study purposes.