Owasp UnCrackable Level 1: Basic practice of Hooking functions with Frida and inserting smali code

Link to download apk file: UnCrackable-Level1.apk

UnCrackable Level 1 is the first lesson of reverse android apk in Owasp’s mobile reverse engineeing exercise series.

Original repo link: https://github.com/OWASP/owasp-mstg/tree/master/Crackmes

To be true for the purpose of practice, I will do this lesson by the method: Static and Dynamic.

Decompiled code structure

Structure of the decompiled code file by the bytecode viewer:

The file name and the function name are all abc so it can be confusing and confusing during the process.

Bypass root check

As soon as the application is opened, a message “Root detected” will appear. Click the “OK” button, the program will be off.

So the first step is to bypass the root check. If only to see the functionality of the app like, you can install the apk on a device that is not rooted. Of course we don’t do that, if detected, we bypass it immediately.

Code to check root:

The root test is done in three ways, the c class in package sg.vantagepoint.a will do this

Static: patch apk

Decompile with apktool: java -jar apktool_2.4.1.jar d UnCrackable-Level1.apk

Edit the code 3 functions ca () , cb () and cc () in smali / sg / vantagepoint / a. The fix is ​​very simple, just make sure these 3 functions always return false : fix the const / 4 segments before the return statement to declare all 0x0. For example: const/4 v0, 0x1 -> const/4 v0, 0x0

Rebuild using apktool: java -jar apktool_2.4.1.jar b UnCrackable-Level1

Generate key: keytool -genkeypair -v -keystore key.keystore -alias publishingdoc -keyalg RSA -keysize 2048 -validity 10000

Sign new apk: jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore ./key.keystore UnCrackable-Level1.apk publishingdoc

Reinstalled and no further notifications appeared.

Modified smali code: c.smali

Dynamic: hook by Frida

The first idea is that I will hook and fix the contents of 3 functions ca () , cb () and cc () return false all. That will pass the root check of the app:

But failed. I checked and thought that the code was not wrong. I guess the reason the hook failed was because these functions were called as soon as the program started (called right onCreate () ) so frida couldn’t prepare it.

=> Need to find a function that has not been called as soon as the program starts so that Frida can hook and fix the content.

Note that the app closes only when pressing OK button in root detection notification. So the second idea is to hook and change the function of that button. Here is the executable of the OK button:

New 1 (this) is the code in MainActivity $ 1.class:

When clicking the OK button, it will run the System.exit (0) function, if you want to prevent the program from closing, we can hook and edit the exit function content:

Success! We have bypassed the root check.

Actually, it is not really bypass root check because we only prevent the exit program when pressing OK button. But what we really need is access to the main functions of the app, and whether or not the root bypass is not important, because the remaining functions of the app are not affected depending on the root device or not.

Get flag

At MainActivity of the app has input function and test button. If the input is correct (enter the flag), it will say “Success”, otherwise “Nope”. This function is handled in the MainActivity.verify () function.

The input test is handled by class sg.vantagepoint.uncrackable1.a :

No matter what the code does, we just need to consider how the flow of the check input process works:

We will change this flow, the goal is to get the result of the function sg.vantagepoint.aaa () with the correct parameter is 2 array of bytes.

Dynamic: hook by Frida

When hooking with frida, I think of 2 directions of hook:

Method 1: After you have run the check input function once, use Java.choose () to search the heap and reuse that function with the correct input. So we will get the result of the – flag to find.

This method just stopped at my idea, but I have not done it. Because the parameter transmission is a byte array array I have not done. If you want to convert the hex string to a byte array using the sg.vantagepoint.uncrackable1.ab () function, there’s always a problem, because sg.vantagepoint.uncrackable1.ab () and sg.vantagepoint.aaa () are in two different classes. .

So I need to find another way to hook

Method 2: Use Java.use () to hook the sg.vantagepoint.aaa () function and fix the content of the function right before the function is run. The idea is that I will hook the sg.vantagepoint.aaa () function, fix the content for this function to call its own instance before being hooked. A little confusing huh, specifically as shown in the following picture:

Following that idea, we have the script:

Hook result:

Static: patch apk

In this get flag section, I show the following method to patch code smali, because for me this is harder, until I write this tutorial, I will succeed: <

By this method, I did not change the flow of the decrypt to a flag, but only inserted 1 step in that process. The way to do this is to add an extra step for the application to display the result after decrypt, before the sg.vantagepoint.aaa () function returns the result of comparing the input with the flag.

Here is the smali return code, which compares the two strings:

In order for the program to print a flag, I will add a command to print the log. Once the flag has been printed to the log, we can easily view it using adb logcat .

The structure of the print string command logs out with the smali code as follows:

Where v0 and v1 variables are log-tag and log-message respectively . These two variables can be replaced by two other variables already declared by the program. I avoid declaring new variables in smali code because I do not know much about Dalvik opcode and the Android system.

In the above smali code, the v1 variable is the flag we are trying to get. I also do not know how to log-tag, so keep printing the flag / flag at all:

The steps to build, sign apk and install are too basic, I will not write again. After installing and typing the input randomly to check, the flag has been printed in the log:

Edited smali code: a.smali