NullException0

There are many techniques out there for Android Application code obfuscation. Most popular and easy to be applied is using ProGuard in Android Studio. What it usually does is it will shorten your app's class name, optimize your code, remove unnecessary resources and code. The main goal of it is to make your app harder to be reverse engineered. Obfuscation in Android Application has been applied extensively by malware author to hide their malicious code and give security researcher like us a bad day. As developer, you can applied ProGuard in your Android App project by implement this additional rule in your project level build.grade(Module:app)  file. buildTypes { release { minifyEnabled true shrinkResources true proguardFiles getDefaultProguardFile ( 'proguard-android-optimize.txt' ), 'proguard-rules.pro' } debug { minifyEnabled false shrinkResources false proguardFiles getDefaultProguardFile ( 'proguard-and...

Hi everyone, this time I would like to share my experiences on Android application analysis and reverse engineering preparation. Like every other processes when we need to do something in the world, we have to consider and prepare basic things to have everything executed in a structured and efficient manner. Prior to our analysis for any mobile application, we have to consider a few things to prepare which is: Workstation. Tools and software. Skills require. Considering and preparing these components will significantly improve your readiness and response time when the sample is acquired and needs to be examined. WORKSTATION For a workstation, this is the specification that at least you should have: Minimum Quad core  processor and support Virtualization . Currently I have 4 cores with 8 threads processor. Malware analysis and reverse engineering process is resource intensive, more is better to support virtualization and heavy processing. During my a...

Hi everyone, I would like to share my way of doing Android malware analysis and investigation, definitely not the best methodology but sharing is caring. Dynamic Analysis Usually, I start with dynamic analysis (usually but most of the time I do it concurrently with static analysis) to understand the behavior of the malware & it easier to understand what is going on and it help me creating my mind map on how the malware execute and data I/O. Meanwhile, I use Burp Suite, ADB Logcat and interaction in emulator running concurrently and monitor the output the application generated and printed on the logcat. Why I do this? To observe its network activity, every HTTP connection it make to command and control  (C2) server. Any log created and behavior of the malware. Tracing functionality of the malware, what logcat and system react to the application. I screenshot everything what is happening on the screen. Extract data generated by application. Running processes (p...