In this video, we take a look at Chad and Trey, the school.
Both of them are able to handle a whole APK file and they can also recompile those resources, which
means we get access to the Android Manifest, XML and Java source code.
They have, of course, their disadvantages and we will compare them against the text to char approach,
which we have done before.
But overall these two tools are amazing and should be definitely in your toolbox.
Now let's start installing them.
And afterwards we take a look at the parameter they provide because some of them come super handy during
our reverse engineering process.
So I would say let's go, let's switch to the Ubuntu VM.
All right, here we are, our Ubuntu VM.
Now let's start downloading and installing them and therefore I open my web browser and I search for
ADCs and GitHub because this isn't GitHub project.
Then we use this from skylight over there.
And then we can use those releases or we can simply clone the repository, which I do.
So I copy paste this one, and then I go into tools and to simply say, get clone, and then we clone
the whole repository.
If you do not have installed git, you can simply sorry.
You can simply install it via suru.
Get install git.
And afterwards, you can clone this repository.
Then we get this directory over here.
This one.
Sorry, Shade.
It's going to enlarge this a little bit.
And then we say, Gradle, this is the build system.
And we say this, and now it's fetching all those necessary binaries and also compiling those code which
are stored inside there.
Let's take a while and I will come back after this process has been finished.
Right here we can see build successful.
So the build process has now been finished and we've got a new directory over there which is called
Build.
And we go into this one, into the X, into BIM and here we have no trade and trade school and also
the Windows version with the bat extension.
Now we add this directory to the path variable that we can simply run shade x and shade x from here
wherever terminal location we like to.
Therefore, I get the directory over here and I simply extend the path variable which we have done in
the past with the Android setup or for other tools.
So I opened this.
And then.
And here we simply append this directory, we add this colon, and now we are good to go.
If we go back and then we can run the X Command not found because we need to refresh our set h environment
and now we can use the X.
We have to provide an input file.
All right.
It's working so far.
So the installation process is now finished.
Now let's have a look at the options of trade X.
We've got two tools.
We've got the x and say the x, chui, j8x is the command line version and the X provides an graphical
user interface.
But we start with the command line version, so we type H for help.
So the first line tells us Child X seems to stand for next to Java compiler.
Then we use check X by providing options and an input file which can be an APK and x, a char class
and smiley zip and some other files we can define output directory that stores our resources and our
Java sources and as in the APK tool, we can also define do not decode resources or sources.
And this might come handy.
If there are some errors within decoding resources or sources we might skip, then the x part.
We can also say Decompile is in a class name or class file, which is also nice.
Alrighty.
What else do we have?
And then the nice feature is the obfuscation part.
So what isn't the obfuscation?
And let's assume we've got the class name which is main class, and this class name now gets reduced
to a single letter.
For example, a class.
And this class name now contains methods like B, C, D and E, and this happens to all class files,
and yet the algorithm needs to take care that it does not overwrite.
For example.
Yeah, rename both classes to the same.
But if this does not happen then we end up with a bunch of chars at the end of the whole source code.
So then we've got methods like 8.3.3. A, B, C, and yet this is not easy to reverse engineer.
Therefore, JD X tries to give this a little bit a better name.
Of course, Radix cannot do some magic and restore the original name, but it can tries to make some
recognizable patterns.
And this is what Radix does, and this approach helps a little bit.
But if you have to deal with a highly obfuscated app, the only thing I can imagine is debugging this
application.
We have a section about this later on in yeah, where we talk about debugging application.
The next two parameters are reacting to the min and max length of this, the obfuscation technique.
And this also has some side effect, which I'm going to show you later on also.
All right.
The last useful option might be this dot file, but here I will show you a different application that
handles this task, in my opinion, a little bit better.
And what does parameter does it?
It saves a call graph into a dot file, and a call graph is simply a graph of a view about the calling
hierarchy of this application.
So this class opens this method and this method calls this class and this class calls this method.
It shows this in a nice overview, and this is super handy because I used this once to solve a very
hard, reverse engineering challenge of an Android app.
I'm also going to show you this approach later on in the special section.
All right, then we've got the verbosity and some log level.
For example, arrow is really useful to include because KDE fails a little more often than text to try
in my opinion.
And by providing this error we can see where it fails, at which class name or the tree source, for
example.
And by having this information we can make the decision for ourself.
If we need this now, decompile it or if you do not need to stay compiled.
If you do not need this to compile, we can simply move on.
But if this is the most important piece then I to try different tools.
For example, text to char or the special tool which I'm going to show you afterwards.
And finally, we've got the thread count over here and this one is also super nice and in Radix because
radix is able to multi thread this whole day compiling process and this comes super handy if you have
to do or decompile a lots of apk or if you have to decompile a huge apk multithreading means we can
distribute our task to third and CPU cores.
And I've also provided you with in the cheat sheet a basic calculation how you can figure out how many
costs you can provide to radix for this multithreading part.
All right, now let's yeah, they compile our space ping application and take a look at the result.
So I'm going into EPS.
And we create a new directory and we name this space pang Jade.
Then be copy paste this out from here.
Okay.
Then I open the terminal over here and we say child x, then the name and we say LOC level is arrow.
I'm going to enlarge this.
Now, let's see.
Now, Lady X is creating a new directory and also processing those files.
And we've got our first error.
But in this class here, the Jason Reader pass seems not to be compiled correctly.
And we've also got this one over here, which is regarding to a compression class name can also not
be compiled.
We get this at the end with two arrows.
All right.
Two arrows is not that bad, to be honest, for this application.
Now, let's have a look into these single files here.
We've got those resources and sources.
If you click into the resources, we are familiar with this.
This is our application structure.
We've got this class store tax, but we've got also this Android manifest example which is now decoded.
So Child X is able to handle those resource files.
So there's nothing special in here right now.
We are pretty familiar with this, but we are more interested in the Java code and this one is over
here and now we've got the structure regarding to the package name of the Java classes, for example.
We've got this one here, the E, then the name of the other space ping and here we've got now the Java
source code.
Let's have a look into a system's alien behavior system and here we can see, yes, this is the Decompile
Java code and this looks pretty good so far.
Okay.
Let's have a look at the class name that cannot be compiled.
And here we can see this one.
So this one should be the class name.
And it's easier to search for the class name to get this file instead of browsing through all these
directories because we have to replace those dots with slashes.
Well, I've closed this one, but it doesn't matter.
So within sources we have now to go into com and so on.
But I search for this class over here.
Then I'm going to open it.
And here we can see yes, we have seen this with text which are also so text to have was able to handle
this class and also this method.
But it might fail on other classes and therefore we can do this approach for both.
So we decompile our app with trade x and next to char and then we can merge those results and see who
did a better job in which function and then we can merge the results afterwards.
So this is how trade X works.
Now let's have a look at trade exclusive.
Go on to the apps directory.
Back again.
Space ping.
Oops.
And then we use trade zui and we can also provide an h.
But these are the same parameters.
So we can use for example, the error method over here can do lock level error.
Then we can see there trade.
We also could not decompile those files, but JD excluded that's the same lags, but afterwards provides
a go way for this.
So that's our and then we use the exclusion on this file.
And here we have now our editor and this looks here pretty similar to the trade part, but we've got
now those resource files over here and also this APK signature.
So Radix is also able to decode those resource files over here.
Okay.
We can now open the Android manifest XML and we can browse through this over here.
And yeah, the one thing I want to show you right here is the obfuscation technique.
So let's see now we've got those last name.
And this one is an interface with the capital I over here.
You can see this here.
And if you click on the symbol here, which is the de obfuscation, it tries to de obfuscate here this
application.
But we can see this app has not been obfuscated.
But I still hit this button right now.
And now we can see something has been changed.
We can see the cut to let us.
And if you hit the obfuscation button, the program thinks this one is obfuscated and tries to.
Yeah, they obfuscated by appending p005 in front of this.
So it makes this a little bit a recognizable pedal.
And it also happens for the R, which I do not found anymore.
So I'm not sure where the R is right now.
Therefore yeah, if the app is not obfuscated, then you should also use this option because you make
it, I guess worse.
By doing this.
I now hit this button again and we can see right now, okay, this one, I do not know that this class
has been compiled or renamed into, but I couldn't find it.
Maybe I didn't extend the directory there.
Oh yeah, I didn't extend it directory.
Therefore I couldn't find it.
Sorry.
Here we can see this r now gets this recognizable pattern.
c0256r All right.
And this is what the D obfuscation option does.
The only thing I want to mention right here is this one.
If you search for classes, variables, attributes, whatever, please use this instead of this search
option, because this is only a class search and this is a text search.
And here we can also define all those parameters.
And at the bottom, you can see that the indexing takes a while, but now we can search and now we can
see we get those fragments, which is a little bit wired in my case, or in my opinion, the best way
is to store those Java classes.
You can do this with the compiling or you can hit this button here, save all, and then you can provide
a directory name and then use Eclipse to import them again.
So I'm going to show you this real quick.
So with Taye Diggs, we have to compile this one with the client version over here, the sources, and
now we download, install, eclipse and then create a new project and import them.
So I speed this up a little bit.
Okay.
Here we have now the project and we simply drag and drop our directories into the source directory over
there.
We can also remove this one because it's not necessary.
So we go into EPS space and trade sources and we drag and drop them over here.
Copy files and folders.
And now they will be all available.
And we can see also a bunch of errors.
This is also the reason why we cannot simply decompile this application, put them into this one and
compile this app back again because we will end up with we are now at 6000 errors and this value may
even increase after they have been imported.
We can simply go to a search, we click on file, we can here search for Java, but we can also use
this file, search over here and provide this sheet parameter now right here.
And then it will go through all the files.
And if we do this, we can enlarge this and here we go.
We can now double, double click on this.
And yeah, we get all those classes over there where she appears.
So I also like this approach.
They compiling this app with CD X and then loading those sources into Eclipse to reverse engineer this
application.
Alrighty, let's get back to the presentation.
So here we have the command line interface version of CD and this comes super handy.
If you want to master compile Android apps, we can use this to load a bunch of applications into g
x and automatically decompile them.
This approach would look like this.
For example, if you use an API or if you have fetched a lot of apks, then we can use CD X to decompile
them and store them into single directories over there.
And afterwards we can browse through this.
And for example, searching the Android manifest for exported content providers or exported activities,
static keys, API endpoints and things like this.
And to automate this whole process, you can use find which is shown in this command above.
So you can use find that name to find all apks on your system or in this directory.
And then you can use x, egg CD X and you can provide those brackets, which is the APK name, and then
simply use an output directory and they compile them all into this output directory.
I'm going to show you this real quick because this is a super nice feature.
All right, here we are back at our Ubuntu VM and let's see, I forget with sorry.
I guess within our downloads directory.
Yes, we've got some APK files over here and now we create an output directory and then we use this
find.
And what find does is it takes now all apks in this directory and it would also go deeper into those
directories to find those apks and they compiling them into this old directory over here.
Yes.
And now we're done.
Let's look into the output directory.
And here we have now all those source files.
Yes.
So we can now browse or grab through these files and search for some vulnerabilities or other stuff.
Then we've got the exclusion which can be used on a single application file, and yet we end up with
the compiled resources and also with the compiled source files which is shown over here.
Finally, he has an overview about the most important parameters, but we already talked about them.
All right.
Finally, the yeah, the battle between shady gooey and shady gooey.
In this case, it's more like text to chat and then shady gooey because shady goo is not decompile in
this application.
But here on the left we can see, okay, shady x fades a little bit more often in my opinion than Dexter
char and therefore I like to use text to char more than shady x, but this is my personal preference.
In case of text to drafts, you can of course try it out with shady exclusions and see if this might
work better and afterwards you can merge those results.
And yeah and yeah, you might have got a more complete Java source code over there.
All right.
That's all for now.
I'm looking forward to see you in the next section where you get your task on here.
Reverse engineer this application.