Welcome back.
In this section, we take a look at the compiling and reader application and we directly move on where
we stopped in the video before.
So now let's inside the APK tool that we can start compiling this Android application.
The first step is done.
We have downloaded this file, but now we want to decompile this.
So I open up Google Chrome and I simply say apk to download.
And the first one is the correct one.
The iPod pictures dot github i io.
And there we have the current version.
And after clicking this, it will be directly downloaded, as you can see here and now it says, oh,
this might be a dangerous file because the char file is treated like a binary file.
And yeah, this file is not trusted for the system.
I do trust this application.
So I say, okay, keep this.
And now we have in the downloads directory this APK tool right here we can open a new terminal and simply
say Java dash char and running this APK tool and then we get this prompt.
But now we want to put this APK tool into a tool directory that we have a clean set up and we also want
to generate an alias name.
I will come to this in a second.
So let's clean this system up a little bit.
We copy paste this into tunes.
We create a new directory named APK Tool and we paste it in right here.
So now if we want to run this APK tool, we have to provide this whole path.
I'm open a new terminal and show this to you.
So I would have to type in every time home app tools epic tool apk tool top and char.
If I if we want to run this and I really way too lazy to type this all the time.
So what we are doing is we are creating a shortcut in alias name which when we type in this alias name
right here and this prompt here, this whole command gets executed and this alias name needs to be known
to our bash.
RC or set is HRC because those are the configuration files for our terminal.
It depends on what you're running.
So I will show you how to do this for both.
Because then you should.
Because then you should be fine with this.
I'm open this in, she added, because this is more convenient for some graphical users.
Therefore I run bash RC this one right here.
And then we type in Alias and we name this alias APK tool.
So this is our variable, let's say in this way or our name.
When we type in APK Tool, we can say execute this whole command right here and then we simply save
this.
And now I'm going to open the service HRC because I'm using the city's age the same.
And we save this.
You can also click save right here.
Or simply hit control.
Let.
Now we want to execute this APK tool.
But the command is not found.
Why?
Because this configuration file gets loaded when the terminal is being started.
So therefore we have edited this file afterwards.
We could close this terminal and open a new one.
Or we can use source.
But it set us HRC and now this configuration file gets updated in our terminal.
So now we have this APK tool available.
Look at the options of the APK tool.
So the main options are EPC to leave for Decode.
I will also say from time to time the compiled, but I mean exactly the same and we can decode or decompile
an APK file there.
This is like unzipping but with additional features.
The other option is APK to be for build and we can build back an app path.
So after the compiling application we get a new directory structure and we can build this directory
structure back again to a mobile application.
Therefore, we can also modify this directory structure, of course.
Alright.
Some other useful options.
More useful options.
Useful options.
Sorry is the dash dash advance because this list even more opportunities of the APK tool.
Here we have now a bunch of options and this is what the APK tool is capability of.
So we now focus only on the most important ones because there's a lot of stuff and from time to time
you need additional options.
But we will learn this through the course.
So yeah, let's focus on the main part.
One important option is this one right here, the dash.
Ah, which means do not decode resources.
Well, resources are, for example, the resources AC that contains some strings, collars and stuff
like this, but also the Android manifest example count as resource.
Now you might think, Wait, why should I not decompile or decode this Android manifest example?
Because afterwards we get some nice XML plain text file.
The answer to this is there are some kind of compiling mechanism, for example, and the developer can
put some really strange characters into into those resources and the functionality of the app does not
get affected.
So the app works perfectly fine.
But if an APK tool, for example, tries to decompile those strange resource files, it fails because
the parser gets overwhelmed or confused and the whole process starts.
In this case, the attacker might be only interested in changing the source code.
This modified, for example, and even doesn't care about those resources.
Therefore it's this parameter.
So with the dash parameter we do not decompile those resource files, but not decoding the android manifest
xml might be really bad because this file is an important configuration file and we need to modify this
in case of adding some permissions or making this possible, setting the backup parameter or things
like this.
And therefore the developer of this APK tool have also an answer for this.
So we have here the dash.
Ah, do not decode resources, but we also have this false manifest parameter right here.
And this means even if the APK tool is not decoding those resources, it still tries to decode the Android
manifest XML that we can modify and view it.
We also have the counterpart regarding to the sources right here.
So if we are just interested in modifying the Android manifest and we face some problems with the source
code, the class store text file in this case, then we can say, okay, simply just decode the resources
and do not care about these sources.
Okay?
So these three options are pretty important.
And yeah, these are the main options which are used most of the time and that saved my day a lot of
times.
So let's start by compiling this application right now and then we compare those to the onset version
and compiled with the APK.
Therefore I go into Epps Space Pang and Decompile.
Yeah.
This is where the base epic store.
So now I run a PK two DD for Decode.
Well, as I said, Decompile and I provide the base apk.
Here we can see decoding Android Manifest XML with resources and some other stuff.
And now we have a new directory right here.
Namespace.
I open this now in a file browser.
And this structure looks pretty similar to the ones we have seen by unzipping an application.
So let's put them side by side and compare them against each other.
Let's have a look at what is identical, and then we can only focus on the difference between Unzipping
and the APK tool.
All right.
Identical is the assets directory and also the lip directory.
There's nothing different between those two.
The compiling and unzipping mechanism.
The original directory contains the meta INF and the original Android manifest XML.
So these are also identical but just in a different structure.
Then we have the rest directory and the rest directory is also identical.
Beside the case that the resources RC gets, they compiled into a new directory named values.
This one right here.
Here we have the plaintext XML files, we've got this tied strings and yeah.
Public XML.
So these are the resources, AC.
And then we've got become directory and become directory is within the unknown directory right here.
So also identical.
And now there isn't much left.
We've cut those classes to text file.
And what does the corresponding part of this file?
We have now a new directory named Smiley.
And if you open this one, we have a lot of subdirectories.
And this new directory, Smiley contains the classes, the text and the classes.
The text contains the Java source code.
So here we have now our Java source code.
But in what kind of format?
Well, you even might guess that based on the name.
We have some smiley files right here.
And let me open one to show you.
Here, for example, we have the alien behavior, Todd Smiley, and here we can see, oh, well, this
still doesn't look that good.
It looks like assembly crap.
Yeah, it does.
But we do not have those bad references as we did have in those classes, that text file.
And we also have only one single class here.
So the alien behavior system Dot Smiley is one single Java class.
This makes it a lot easier for us to reverse engineer this whole application because we do not have
to dig into a whole bunch of binary files.
We can simply pick in what we are interested in.
And if I scroll down, yeah, we can see the smiley part.
And at the end of this course you will be understanding what's inside here.
You can directly read what's going on right here, and you can also modify this, which is super amazing.
And if you don't believe me, just hang on to this course and we will make this together.
For now, we stick to this part that the class text gets compiled into single smiley files, which are
single classifieds.
Well, there's only one file left, which is the Android Manifest XML, this one right here.
And now we can see what we've got, plain text XML, so we can directly read this.
We can modify this here, for example, we can see it uses the Android permission vibrate.
So if you are installing this on a real device, the smartphone will vibrate when the player gets hit.
Now we are able to edit this Android manifest example and what we are going to do now is we add an additional
permission, we add the context permission into the Android manifest example because every application
needs access to the contacts, even if it's just a flashlight, a passing game or what else.
So also this game should have the ability to access the contacts.
How do we do this?
Well, we learn about the permissions of the Android manifest example in the next section.
But yeah, let me show this quick to you because it's not that hard.
I open this in graphical editor.
Let me choose one.
This one here.
All right.
And here we have users permission and then the Android name.
Now we are no developers.
We do not have a clue about what's the context permission.
Therefore we open Google.
I search for Android, read contacts, manifest XML permission and the official documentation would
be more reliable.
But I stick to StackOverflow.
And then we scroll down and this one looks good.
So I copy paste this one.
And we add this right here.
All right.
We have edited a new permission.
Of course, we can also insert our own code to access those contacts and send them to our server.
We will learn how to do this, but not now.
Now we are just focusing on the day, compiling and building part.
Okay.
We need to build back this app again.
Therefore, I go into our terminal.
And here we are in the directory space being decompile where we have the base apk and the decompile
version or decoded version.
Now I run APK tool B for build and now I made this mistake so often.
So often you get this error and this is the case because we need to build back this app path, this
directory, not the APK.
So therefore please provide here the path and maybe with the slash then you are good to go.
Now we are building back all those files which are stored in the directory and also our modified Android
manifest XML to a new APK and it says okay, the build has done.
We have new APK.
Let's check.
Here we have a new directory named list, and here we have our new APK.
This is our new built our first built APK.
We cannot install this right now.
I'm going to show this to you.
So I'm going to connect to the machinery quick and run ADB install and we get this error that this application
has not been signed yet.
We will learn about signing later on, but for now we have built back this APK and it's also a modified
version.
We will check this out after we have signed this app in a section here in two or three sections.
All right.
Okay.
I've missed one file, which I still want you to show.
And it's this one.
It's the APK tool.
Output.
So this provides some output.
What a tool which options has been used and what a BC tool does.
It doesn't contain a lot of useful information.
It's just some bunch of meta information we can see.
Unknown Files has been put into this directory and some tech version and stuff like this, but I want
to make sure that we have discussed everything in this directory here.
Okay.
Let's switch back to the presentation.
Wrap this up real quick and then we go into the next section, which is the Android manifest XML.
Okay.
In this section we have learned how to recompile and build an application.
We have learned the most important features of the APK tool which are already listed here.
We've also seen the most important options of the APK tool, and there's an additional option, which
is the dash key.
You can make this app automatically being debug able by setting this flag, but you have to decode the
Android manifest XML to do this.
So we have to decode those resources to provide this parameter.
But we can also do this manually, which you will see in the next section, but it's a handy option.
So I listed also here and then we have also taken a look at the unset version and compiled version.
So here we can see what's white is.
Those directories are identical and the year, let's say green highlight means okay these directories
are identical but within a different structure.
And the only different regarding to the APK tool and unzipping is those classes that text file gets
compiled into single smiley files, single Java class files, and the Android manifest XML gets they
compiled or decoded into a nice readable XML structure.
All right, that's all about the APK tool right now.
We will learn more about during this course when we need some certain options, because I don't want
to make or spend a lot of time on this topic right now.
You also have a nice overview in your PDF Cheat sheet, so please have a look there.
You'll find additional options, parameters and stuff like this if you want to look up some things real
quick.
That's all for now and I'll see you in the next section.