All right, guys, are you ready to find out what our mysterious reverse engineering tool is?
You absolutely are.
And the secret weapon I'm talking about is Android guard.
So Android got its reverse engineering framework, and you might think, wait, what makes it that special?
So, Andrew, God has a lot of underrated features and those features can come super handy if you have
to deal with highly obfuscated applications.
But before we dive too deep into this, let's get back to the beginning.
So what is Andrew God?
Andrew God is a framework and it's written in Python, so there are several modules you can use of Andrew
God.
And to be honest, I do not use most of them.
I only use two special modules.
But to make a nice layout I have to include three terminals.
So now we also talk about the Analyze module.
Then we've got the core draft module, which is extremely nice if you have to deal with obfuscated apps.
And we've got the Decompile module, which is also amazing as you will find out in a few minutes or
within the next section where we finally take a look at the CTF challenge.
All right.
Beside those modules and regard is able to handle more, but let's focus only on these three right now.
The Analyze module is some kind of static analysis of a binary.
So we can use this binary and load it up into our analyze module.
And this analyze module now provides us an AI python shell.
And with a python we are now able to browse around through this application.
We can do a lot of tasks, but we are familiar with all of them because we have done this manually.
We can, for example, get all those activities.
We can inspect the application based on the app itself, we can browse through the classes, the methods
and further stuff.
All right.
So this was not that exciting, I guess.
But now now we come to the point.
Now let's talk about the more exciting features of Android.
And one of them is called graph and coal graph is super amazing.
If you have to deal with obfuscated binaries, what is in choreograph?
So let's assume we've got a function that is deep buried in this application code and call graph is
the way to this function.
In this case we have this username and password field and if we hit the login button which is not available
there, but on the real world application, it would be, then these parameters are going to be inserted
into a function which calls another function.
This code's another function and this called another function.
And finally there's this last method which loads this encrypted file into the memory and starts decrypting
it.
Afterwards, it compares those hashes and figures out if the password we have entered is correct or
not.
So we get a graphical overview that shows us how we can reach this point, which methods we have to
call, and also which parameters we have to provide to end up there.
And this is what I call graph does and it's already mentioned if you have to deal with obfuscated binaries,
this comes super handy.
Let's imagine we've got this obfuscated app and the application code we are interested in is deeper
in this application code.
And now we stare at the methods and class name which consists of a, B, a, B, a CD, A, B, D and
so on.
You would go crazy if you try to analyze this by staring at this obfuscated code.
Therefore, we have to split it up, and by splitting it up we make single pieces and we can follow
them.
And yeah, this leads us to the final function that we need to call, and now we also know which parameters
we have to provide.
This is also super handy if you have to deal with a routing detection certificate pinning strange obfuscation
or decryption encryption methods and other kind of stuff.
So the call graph I'm going to show you an example afterwards is super amazing.
And if you have to deal with really hard binaries, this comes handy and should be definitely in your
toolbox.
And finally we have this flow graph.
Flow graph sounds similar to call graph, but these are different.
A call graph is regarding to the method name.
So method one called method two called method three and so on.
We get a graphical overview about this.
Super nice.
A flow graph is now regarding to a single function.
Let's assume we've got a function that contains tons of if statements and clauses and also some Trump
instruction go to switch cases and all this stuff.
Let's assume there are about 40 in there and there is only one specific path to a solution where we
have to get staring at this binary and trying to solve this would drive you crazy.
Therefore we can provide an call graph but only for this single function flow.
And this is our flow graph.
And let me draw this here real quick.
So we've got this username and password and we now focus only on a single function code and this username
and password is going to yeah, some really strange control flow in this application.
Therefore we start with an if case and this f k is also got some really strange branch instruction.
And finally we reach out the point where we know, okay, this is our solution.
We need to get to this point.
And now let's imagine we have this graph multiplied by 20 or 30.
Trying to solve this by staring at the code will be pretty hard, at least.
Maybe not possible because you have tons of curly brackets and it would be super hard to solve it in
this way.
You also do not know which parameters you have to provide at a certain point to get to the solution.
So you have to do it, yeah, from top to bottom and you have to go into every branch until you finally
find your solution.
Therefore, we do this approach backwards.
So we go into our solution and then we trace back and by tracing it back we know which path we have
to take and therefore we can only focus on these signal instructions and provide the correct solution.
If this sounds not complicated, don't worry.
I'm going to show you how you can do this.
And it's super easy.
And you will also see the benefit of this by solving this really hard capture deflection.
And by the way, I'm not going to spoil any solution.
I just want to show you my approach on how to solve this.
You have to solve this challenge on your own, but after this course, you will be definitely able to
solve all challenges in there.
Not because I did provide you this solution, because I provide you the knowledge and the skills on
how to do this.
In the next section, we take a look at the installation process of this tool, which is also super
easy, and then we create our first call graph and our flow graph regarding to this very hard capture
the flag challenge.
So I'm looking forward to see you in the next section.