How it Works Dex-Oracle?
Oracle takes Android apps (APK), Dalvik executables (DEX), and Smali files as inputs. First, if the input is an APK or DEX, it is disassembled into Smali files. Then, the Smali files are passed to various plugins which perform analysis and modifications. Plugins search for patterns which can be transformed into something easier to read. In order to understand what the code is doing, some Dalvik methods are actually executed with and the output is collected. This way, some method calls can be replaced with constants. After that, all of the Smali files are updated. Finally, if the input was an APK or a DEX file, the modified Smali files are recompiled and an updated APK or DEX is created.
Method execution is performed by the Driver. The input APK, DEX, or Smali is combined with the Driver into a single DEX using dexmerge and is pushed onto a device or emulator. Plugins can then use Driver which uses Java reflection to execute methods from the input DEX. The return values can be used to improve semantic analysis beyond mere pattern recognition. This is especially useful for many string decryption methods, which usually take an encrypted string or some byte array. One limitation is that execution is limited to static methods.
dex-oracle
Dependencies:
– ruby-2.3.0
– apktools, smali and baksmali.
Install Latest apktools and Smali / Baksmali:
sudo -E sh -c 'wget https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.3.0.jar -O /usr/local/bin/apktool.jar' sudo chmod +r /usr/local/bin/apktool.jar sudo sh -c 'wget https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool -O /usr/local/bin/apktool' sudo chmod +x /usr/local/bin/apktool Install Latest Smali / Baksmali: sudo -E sh -c 'wget https://bitbucket.org/JesusFreke/smali/downloads/smali-2.2.1.jar -O /usr/local/bin/smali.jar' sudo -E sh -c 'wget https://bitbucket.org/JesusFreke/smali/downloads/baksmali-2.2.1.jar -O /usr/local/bin/baksmali.jar' sudo chmod +r /usr/local/bin/smali.jar sudo chmod +r /usr/local/bin/baksmali.jar sudo -E sh -c 'wget https://bitbucket.org/JesusFreke/smali/downloads/smali -O /usr/local/bin/smali' sudo -E sh -c 'wget https://bitbucket.org/JesusFreke/smali/downloads/baksmali -O /usr/local/bin/baksmali' sudo chmod +r /usr/local/bin/smali sudo chmod +r /usr/local/bin/baksmali
Usage:
git clone https://github.com/CalebFenton/dex-oracle && cd dex-oracle gem install bundler bundle install cd bin Connect a Device or Emulator android avd ./dex-oracle -i com/android/system/admin/CCOIoll sample.apk
Source: https://github.com/CalebFenton