OK so we saw how to develop an app, if you follow the part of how to develop an app but whether or not 1
you follow the previous part. 2
We're going to start off with the following scenario. 3
We have a suspicious app installed on our device which is the one we developed in the previous section. 4
So you suspects this application is malicious and you want to start reverse engineering it and understand 5
what it's doing by having a look at the underlying code. 6
How can we do this firstly we're going to use an important tool that we introduced previously ADB 7
or Android debug bridge so Android debug bridge as it is named is a bridge between the host machine 8
we're going to be doing analysis on and the Android device or emulator. ADB is the tool that you will use 9
to connect your Windows or Linux machine over to the Android device. The location of your SDK folder 10
is usually user folder slash app data slash local slash Android slash SDK on windows and home folder 11
slash Android slash SDK on Linux. Now in the SDK directory, 12
you will find a directory called Platform dash tools and within the platform tools directory is where 13
you will find your ADB tool. 14
This is a very important tool. 15
There are quite a few commands you can run with ADB. 16
Here we'll just show you some of the main ones. 17
So for example one command is ADB devices. 18
In this case you will see one device and that is the emulator so at this point in time there's one emulator 19
that we can connect to, if you had more devices you would be able to specify which device you want to 20
work with by using the dash -s parameter followed by the device name. 21
Another thing we can do with ADB is pull and push files. 22
What does this mean. 23
Push means that we can send a file to the device and pull means we can retrieve a file from the device. 24
So in the case of push try something like this: push local path dest path so let's create a local file 25
here called my file dot txt, let's push this file to the device by typing adb push the path to my file 26
.txt and the destination path say slash SD card slash and that will push the file from your host 27
machine onto the android device. 28
Similarly if you pull you can run pull and the path of the file you want to download and this will pull 29
the file onto your analysis machine. 30
We will actually be using this to download the target app. 31
OK. 32
Another important command is adb install. 33
So if you have an APK file on your host machine and you want to push it and install it on your device 34
or emulator you can either push it onto the device and then go onto the device and install it. 35
Or you can just run ADB. install and it will be installed directly onto the android device. Similarly 36
you can do uninstall by running adb uninstall and the package name you can easily uninstall the app 37
but you might be asking how do we get the package name of an application. 38
We will see how we can obtain the package name in the next step before we do that. 39
Let's look at a very important command ADB shell. 40
So this is used to enter the shell of your Android device. 41
Here you can see the standard Linux environment where we are in the shell of our Android device. 42
Now here we can run several commands using System utilities. 43
So for example pm list package and this will give us the package names of the applications that are 44
on the device and so these packages are currently installed. Now given that we're running in a Linux 45
environment, 46
we can even run utilities like grep in order to help us filter through the results so say we know that 47
the app has flip cortex and its name. 48
We can run Pm list package | grep flipcortex and here we can see the filtered results. 49
So in the case that we want to remove flip cortex we would just exit the shell run ADB uninstall and 50
our package name press enter and it will uninstall. 51
But right now we don't want to do that. 52
Let's go back to ADB shell so the location of the APK files we would want to look at are in the data slash 53
app folder but we don't have permission because the device is not rooted. 54
Here you will see a few different approaches on how to obtain an APK from the device. 55
But we're going to opt for the lazy way we're going to use an app called APK extractor. 56
There are different tools. 57
Just search in the play store for the text APK extractor and you will see many results. 58
Find your favorite one and install it just search in the play store or an online store. 59
Here we are just googling APK extractor apk and it redirects us to apk pure downloads from 60
here we just download the file and drag and drop the APK onto our emulator. 61
This is a quick way of installing it. 62
This is a tool that just goes through your apps and allows you to extract and save their APK you can 63
see it's been installed click open 64
so you have a list of all your applications. 65
Let's search for our app. 66
It will ask you for permission to access the files and media 67
grant the permission. 68
So let's have a look at the shell again using ADB. 69
We're going to go to the path where the APK was extracted so storage slash emulated slash 0 slash 70
extracted APKs. List the files, we see that there is hello world flip cortex Hello World dot 71
Apk. okay. 72
So what we're going to do now is we're going to exit the shell and I'm going to use ADP pull so if we 73
exit the shell and run ADB pull storage slash emulated slash 0 slash extractedAPKS slash hello world 74
underscore com dot flip cortex dot Hello World dot APK 75
you can see over here one file is pulled and we're given the size of the file so now we have our APK 76
in our local directory. So to recap we have a suspicion that there is a potentially malicious app on 77
our device we use the ADB together with the help of an APK extractor to obtain the APK file and in the 78
next lesson we want to analyze this potentially malicious file.