Reverse Engineering Android APK Applications: A Security Challenge Analysis
File Formats in Application Development
Various file formats serve distinct purposes in software development and deployment across different platforms:
APK (Android Package)
APK files represent the standard distribution format for Android applications. This compressed archive contains all necessary components for an Android app to function, including compiled code, resources, assets, and digital certificates. APKs enable seamless installation and execution of applications on Android devices, either through official marketplaces like Google Play or via direct sideloading.
JAR (Java Archive)
JAR files provide a packaging mechanism for Java-based software, bundling compiled classes, associated resources, and metadata into a single archive based on the ZIP format. This standardized container simplifies the distribution and deployment of Java applications and libraries by consolidating all required components into one portable file, commonly used for both desktop applications and reusable libraries.
WAR (Web Application Archive)
WAR files represent a specialized variant of JAR archives designed specifically for Java web applications. These archives encapsulate all components necessary for web deployment, including JavaServer Pages (JSPs), servlets, compiled classes, configuration files, and static web content such as HTML, CSS, and JavaScript assets. WAR files facilitate standardized deployment to Jakarta EE (formerly Java EE) compatible servers like Apache Tomcat and JBoss.
RAR (Roshal Archive)
RAR files implement a compressed archive format developed by Eugene Roshal, offering advanced compression algorithms and additional features beyond standard ZIP compression. The format supports multi-volume archives, strong encryption, and recovery capabilities, making it suitable for compressing large files or sensitive data where higher compression ratios and enhanced security are required.
Setting Up the Analysis Environment
For Android application reverse engineering, we utilize specialized tools and environments. The Mumu emulator provides a virtual Android device where we can install and analyze the target application. This emulator offers advantages over physical devices, including snapshot capabilities, easy debugging setup, and a controlled environment for security research.
JADX serves as our primary decompilation tool, converting compiled Android application packages (APKs) into readable Java source code. This powerful tool reconstructs the original code structure, making it feasible to analyze application logic, identify vulnerabilities, and understand the implementation details without direct access to the original source code.
Application Analysis with JADX
Begin the analysis process by extracting and decompiling the APK file using JADX. Once the decompiled code is available, perform a global search for relevant keywords such as "username" to locate critical functions. In this case, we discovered the authentication logic within an onClick method, which likely handles user input validation.
Two primary approaches emerge for solving this challenge:
- Direct flag extraction
- Bypassing authentication through credential validation
Username Validation Function
The following function implements username validation:
public boolean validateUsername(String input) {
if (input != null) {
try {
if (input.length() != 0 && input != null) {
MessageDigest digest = MessageDigest.getInstance("MD5");
digest.reset();
digest.update("secretkey".getBytes());
String hexValue = convertToHex(digest.digest(), "");
StringBuilder result = new StringBuilder();
for (int i = 0; i < hexValue.length(); i += 2) {
result.append(hexValue.charAt(i));
}
return (result.toString()).equals(input);
}
return false;
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
}
}
return false;
}
The validateUsername method first verifies that the input string is not null. If valid, it proceeds to calculate the MD5 hash of a predefined string ("secretkey"), converts this hash to a hexadecimal representation, and constructs a new string by extracting every other character from the hexadecimal value. This constructed string is then compared against the input for validation.
Password Validation Function
The password validation function demonstrates a more complex transformation process:
public boolean validatePassword(String input) {
if (input == null) {
return false;
}
char[] charArray = input.toCharArray();
if (charArray.length != 15) {
return false;
}
for (int i = 0; i < charArray.length; i++) {
charArray[i] = (char) ((((255 - i) + 2) - 98) - charArray[i]);
if (charArray[i] != '0' || i >= 15) {
return false;
}
}
return true;
}
This function first checks for null input and verifies the password length is exactly 15 characters. It then processes each character through a mathematical transformation involving its position in the string. The transformed character must equal '0' for the password to be considered valid. This implementation suggests a specific character sequence that would satisfy the validation criteria.
Developing the Solution
To successfully authenticate and extract the flag, we need to implement functions that reverse-engineer the validation logic:
package com.security;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
public class ChallengeSolver {
public static void main(String[] args) {
generateValidCredentials();
}
public static void generateValidCredentials() {
// Generate valid username
String validUsername = createValidUsername();
System.out.println("Valid Username: " + validUsername);
// Generate valid password
String validPassword = createValidPassword();
System.out.println("Valid Password: " + validPassword);
}
public static String createValidUsername() {
try {
MessageDigest digest = MessageDigest.getInstance("MD5");
digest.reset();
digest.update("secretkey".getBytes());
String hexValue = bytesToHex(digest.digest(), "");
StringBuilder result = new StringBuilder();
for (int i = 0; i < hexValue.length(); i += 2) {
result.append(hexValue.charAt(i));
}
return result.toString();
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
return "";
}
}
public static String createValidPassword() {
StringBuilder password = new StringBuilder();
for (int i = 111; i >= 97; i--) {
password.append((char) i);
}
return password.toString();
}
private static String bytesToHex(byte[] byteArr, String separator) {
StringBuilder hexBuilder = new StringBuilder();
for (byte b : byteArr) {
String hexString = Integer.toHexString(b & 255);
if (hexString.length() == 1) {
hexBuilder.append('0');
}
hexBuilder.append(hexString);
hexBuilder.append(separator);
}
return hexBuilder.toString();
}
}
Obtaining the Flag
By executing the solution code, we generate valid credentials that satisfy both the username and password validation functions. The resulting flag provides the solution to this security challenge:
flag{7afc4fcefc616ebdonmlkjihgfedcba}
Key Takeaways
- Understanding APK file structures and their components is essential for Android application analysis
- JADX provides powerful capabilities for decompiling and analyzing Android applications
- Authentication mechanisms may contain logical flaws that can be exploited through careful analysis
- Reverse engineering validation functions requires understanding both the implemented logic and the expected input formats