PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Android Application Diffing: Analysis of Modded Version

blog.quarkslab.com | research | #android | #obfuscation | #apk | #binary-diffing | #repackaging | #redex
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Third part of the Android diffing series: combining the diff engine with Redex to inspect a modded, ad-stripped music-streaming app and locate injected or altered code despite obfuscation.
Published
Collected

Related coverage

research · blog.quarkslab.com
Android Application Diffing: Engine Overview
First of the Android diffing series: challenges of similarity detection in Dalvik/APK code versus native binaries, and the design and benchmarks of Quarkslab's diff engine.
research · blog.quarkslab.com
Defeating AI-Assisted Reverse Engineering (or at Least Trying To)
This coverage gives security teams current context for monitoring, validation, and remediation.
research · blog.quarkslab.com
Smali the Parseltongue Language
A practical guide to reading and writing Smali, Android's DEX intermediate representation: why analysts patch apps at the Smali level, and how to repackage an APK cleanly.
research · blog.quarkslab.com
Turning Regular Code Into Atrocities With LLVM: The Return
LLVM obfuscation tutorial, part two: a pass that hides XOR operations by converting operands from base 2 to base 3 before adding them, turning a simple xor into a much harder-to-recognise sequence.
research · blog.quarkslab.com
Turning Regular Code Into Atrocities With LLVM
Hands-on introduction to LLVM bytecode obfuscation: an out-of-tree pass that replaces null literals with a provably-false boolean expression, teaching LLVM pass development basics along the way.
research · blog.quarkslab.com
Deobfuscation: recovering an OLLVM-protected program
Quarkslab breaks the protections of Obfuscator-LLVM (LLVM 3.5) on a sample function, stripping control-flow flattening and the other layers one by one with the Miasm reverse-engineering framework.
Back