‫Instructor: Hi. Within this lecture,
‫we are going to see
‫how we can use JADX
‫in order to complete our reverse engineering process.
‫We have already used APK tool,
‫in order to see the Dalvik byte codes,
‫and manipulate the app
‫in a way that we want,
‫and then rebuild it
‫to create a new APK,
‫and then sign it to use in our emulator.
‫But sometimes it's not sufficient for us.
‫For example,
‫in big projects,
‫in big apps,
‫we may want to see the source codes
‫if we are able to.
‫And in order to do that,
‫we are going to use JDAX.
‫As I've told you before
‫APK tool is used
‫in order to
‫get the Dalvik Byte codes.
‫And then rebuild the app afterwards.
‫But sometimes,
‫it's fairly easy to
‫see source codes
‫in order to define any vulnerabilities,
‫or any cling that we want,
‫we're using JDAX.
‫So I'm going to delete this MyReverseApp,
‫or I'm just going to close it down,
‫and then delete it.
‫Okay?
‫Like this.
‫And,
‫I'm going to close this down
‫because we don't needed anymore.
‫In fact, I'm going to delete everything from here
‫because we don't want to use manipulated APK.
‫So I'm going to open my "App",
‫"build",
‫"outputs",
‫and APK.
‫Like this, okay?
‫And find the original APK that we have generated,
‫and copied in my Desktop.
‫So, if you don't have those,
‫if you deleted it for some reason,
‫you're more than welcome to regenerate it again
‫within inside of Android studio.
‫Then,
‫I'm going to decompile this using JDAX.
‫So, we haven't done this yet, right?
‫And using JDAX is as easy as using APK tool.
‫So, all we have to do is run JDAX and
‫yive appropriate parameters
‫in order to decompile this APK
‫so that we can see the source code.
‫And, there are sometimes
‫that we see the source code,
‫and there are sometimes we don't see the source code.
‫We're going to have a look into that as well.
‫Make sure, you're on Desktop,
‫or you're on your folder that your APK is in,
‫and then run this.
‫jadx -d,
‫and d stands for decompile one more time.
‫Okay?
‫Like in the APK tool,
‫but this time we have only dash
‫in front of "d" as a difference, okay?
‫And another difference will be the output folder
‫for our decompiled app,
‫as like this, okay?
‫Here.
‫And then the app name itself.
‫So, it will create an app debug folder,
‫and it will decompile app-debug.apk for us.
‫As you can see, once I hit enter
‫app debug folder is created over here.
‫Of course, you can name it anything you want.
‫So, this is done for being
‫Right now, I have decompiled
‫app over here.
‫If I double click on that
‫I can see the contents.
‫And it's very similar to APK tool in a way.
‫Like, we see the same folders,
‫we see most of the same files
‫one more time like
‫AndroidManifest over here. Okay?
‫And I can open the manifest with
‫anything that I want that I can see the exact same result
‫over here,
‫and of course if you cannot get anything out of APK tool,
‫you can try to get it with JDAX tool, and vice versa
‫in order to see the Android manifest,
‫and drawables and resources.
‫Okay?
‫But, there is a big difference
‫which is the source code,
‫and we're going to have a look into that.
‫So,
‫Android manifest is the same,
‫and over here,
‫I'm opening everything with text editor,
‫and I'm not using Android Studio.
‫But most of the time,
‫it would be a good idea to use
‫any kind of ID or script editor
‫in order to see the content in a better way.
‫I will show you how to do that.
‫Just have a look at these resources,
‫and you can see the values,
‫and the
‫layouts
‫as we have seen in APK tool.
‫Okay?
‫For example, in these values folder
‫we have
‫some important files
‫like strings,
‫XML styles,
‫XML. For example, if you're trying to
‫really decompile an app,
‫one of the first things that you should look at
‫is this string.xml in which
‫you can find some values,
‫and even maybe passwords depending on
‫the developer him or herself.
‫Okay?
‫The values folder is an important folder,
‫and we get the same result in APK tool as well by the way.
‫But if we come over here to sources folder,
‫okay?
‫You will see the Android,
‫and AndroidX libraries one more time
‫but if you come to your package name like this,
‫you'll see your MainActivity.java.
‫So, over here we used to get smalley
‫which is Dalvik byte code files
‫but this time we get the java files.
‫Right?
‫Like this.
‫So, what we want to do is
‫open this MainActivity.java
‫in an editor.
‫So, we can open this in an text edit,
‫or anything that can read a text really
‫but it's a good idea to open this
‫in an Android Studio environment,
‫or any script editor so that
‫we can actually see them in a better way.
‫So, if you're on Kali Linux
‫doing all of these things in a Kali Linux,
‫then if it would be a little bit unpleasant for you
‫to email everything
‫to your host every time.
‫So, I suggest you run this command,
‫apt-get install geany,
‫which is an installer for geany script editor, okay?
‫And you can use geany in order to open
‫activities,
‫like java classes,
‫kotlin classes,
‫a Python files.
‫Anything that comes to your mind.
‫So, you can actually use geany by
‫calling geany like this and hitting enter,
‫it will pop open for you.
‫Or you can just double-click on the java files,
‫all right. Click on the java files,
‫and say
‫open with geany.
‫So, let me show you what I mean.
‫I'm gonna close this down,
‫and I'm going to close this terminal down as well.
‫And let me find this java file
‫that I've have been talking about.
‫Okay?
‫In order to do that,
‫I'm going to
‫open my file system
‫from here,
‫and
‫let's go to documents or downloads
‫where I have stored it.
‫Let me try to find it for a second.
‫I believe it was under downloads.
‫Yep, here we go.
‫So, I see the MainActivitiy.java, okay?
‫If I right-click, I will see the selection of
‫"Open with Geany"
‫from here,
‫Okay?
‫I will just click on this,
‫and open up
‫in geany editor.
‫So, as you can see,
‫it's the same view that we get
‫in Android Studio
‫so that we can see it in a better way.
‫Now, I can actually
‫try to understand what's going on
‫inside of this app looking at the source code.
‫And, now you can use geany anytime you want to open
‫like Android manifests,
‫or any XML file,
‫or any java or kotlin or
‫any other code file.
‫So, I'm gonna close this down,
‫and continue with inside of
‫my own MacBook.
‫And I believe I have geany over here,
‫so I can open it with geany in MacBook as well,
‫like this.
‫So, here you go.
‫It's a little bit small,
‫let me try to zoom in.
‫Okay?
‫So, we can see it in a better way.
‫So, here you go.
‫Now we see the source code.
‫So, as you can see,
‫we got the activity,
‫we got the class name,
‫we even get
‫the
‫source code of this java file.
‫And, since this is a very small file
‫like a
‫maybe four or five lines of code or
‫here
‫it's little bit dull
‫but we get to see what's going on like
‫setting text to Hello World,
‫and as you can see,
‫it's not exactly the same thing.
‫It's a little bit different than our
‫original source code but
‫we get the idea.
‫Okay?
‫So, it's like
‫doing the same thing but
‫in a different way.
‫Maybe lines will be
‫complicated like
‫not will be the same thing.
‫But you will still see the source code anyhow.
‫And, I can actually copy and paste this
‫into a new Android Studio project
‫to create exact same app.
‫And, this is
‫one of the advantages of using JDAX as well.
‫So, let's stop here,
‫and continue within the next lecture.