Speaking about reverse engineering one can say that Android applications can be easily compiled using
lots of available tools.
This opens the door for many forms of abuse such as intellectual property theft data leakage and data
theft credentials harvesting and on top of that you can kill the application temper it and then publish
it online again so that people can use it first of all we need the DOT HBK file usually you install
applications on your mobile phone but you can extract the EPA using lots of available applications such
as this AP extractor so download this API extractor and open the application it will automatically load
all the applications that are installed on your mobile phone you can just browse and will just click
of a button you can select an application that you want to extract to dot AP K and then
convert it for example to spark or a scanner can just press on it and it will extract the files to the
local storage.
You should go to the local storage and you will be able to see these extracted API is under the extracted
AP KS folder.
So I have extracted a couple of files for the purpose of moving them to my collie machine.
No I've moved the AP case files from my mobile to the Collie machine under the extract the AP case data.
Now let's try to decode the what's happened with HBK file for this purpose.
I will use the AP key tool available with Kali which actually decodes resources from the original file
and rebuilds them after making some changes.
You can use the D parameter to decode and the B to build.
So let's try the WhatsApp thing minus f lines or WhatsApp a K and it has started.
So let's go directly to the directory here and see the resultant file and OK
and it's over as you can see it has organized the extracted files similar to the like an Android project
where you have the assets you have the resources and you have the code the assets usually are files
that are not compiled within the source files of the project.
Meanwhile resources are compiled within the codes of the within the Android code.
And here you can find the Java code itself.
Let's drill down into the assets.
Here you can see strains compilation Some jumped on this.
I think let's start let's go there just some list of values and the fonts that are being used.
You can see as well the graphics here used within the WhatsApp application
emojis
and if you could write to the code the extension is as am I.
This is how it's set in the AP case tool.
And here you will be able to see all the Java code which is extracted from the WhatsApp application
you can do this to your own application just to make sure that the extracted files they don't contain
any sensitive or confidential information.
Let's select any file here and open it just to show you the Java code lots of files so this is just
an example for your own application.
Just try to make sure that it doesn't have any important information that might fall into the hands
of hackers.
Suppose that you did some changes to this application.
What's up with a picture.
Now we want to build these files into a new AP case file for this purpose you can use a barricade tool
again B for builds and select the file the directory name.
Exactly is what's up uppercase
and then use the old parameter.
Call it my whatsapp.
It's a bouquet.
And now we're building yet again
and let's go here to see the results.
It will take some time and the end will create the new AP game file.
And here we go.
This is my new version of the WhatsApp called my whatsapp dot a decade.
Can we prevent hackers from compiling our applications.
Well generally speaking we can make their life harder and the harder we make it the fewer will remain.
But actually it takes a lot of time and effort to make our code difficult to crack.
But we can't make it impossible to crack.
So here are some of the tips that we can use in order to make the life of the hacker is difficult.
We can use code obfuscation.
This is the usual word that is used.
Actually it means we can mystify our code or we can complicate our code.
We can use a couple of applications such as Pro guard and discard these applications actually does a
good job and can make reverse engineering difficult.
It can encrypts through strings and detect code tampering pro guard is an open source application while
this code is a commercial and paid application and it does a job actually better than the program.
You can as well use SDK which is the native development kit for Android to write libraries in C and
then you can import them to your Java code which actually makes it difficult to compile.
So regardless of the code complication that you do always try to encrypt and send messages and make
sure that messages cannot be repeated so use some timing or some kind of sequence to assure the integrity
of the communication between the application and the server and always authenticate your client.