Android App Analysis¶
JEB is a well-known industry tool used to reverse-engineer and audit Android applications.
Using JEB, you can:
- Analyze APK files and their contents, including DEX files, Certificates, Resources, Assets, Native Library code, etc.
- Examine encoded resource files and manifests: JEB ships with its own resource decoder, with support for obfuscated resource names and locations.
- Examine certificates data (legacy, v2, and v3)
- Decompile DEX bytecode, with full-support for multi-DEX reconstruction.
- Analyze native library (.so) code: more on the Native code analysis section
- Debug Android applications (Dalvik and Native - x86, arm, mips - code) and transition seamlessly from Dalvik to Native, and vice-versa.
- API support for client scripts in Python, back-end plugins in Java, and client contributions (UI overlays).
Section under construction. Please head over to our Blog to learn more about specific features of our Android modules.
Blogs¶
Link: All PNF Software blog posts tagged Android.
Using additional frameworks¶
When analyzing applications using resources located in other frameworks that the Android Framework (e.g. the Samsung framework), follow those steps:
- retrieve the framework archive, which is normally stored on the device; let's call it framework.zip
- run
aapt2 dump framework.zip
and retrieve the first line, which will be something like Package name=xxxxxxx id=N. Note the id, N - navigate to the folder listed in your
.parsers.apk.FrameworksDirectory
engines property. Typically, it will be theHOME_FOLDER/.jeb-android-frameworks
folder - copy framework.zip into this folder, and rename it to N.zip
- JEB should now be able to pick up that framework and use its resources when needed
Note: 1.zip in the FrameworksDirectory folder is the Android Framework itself, which has id 1