Tips
Helpful commands for Android reversing
ic
to enumerate classes and methods from a .dex fileicq
to enumerate classesiiq
show external methodsizq
list all strings contained in the program
Helpful commands for arm reversing
e asm.describe = true
# show description of each ARM instructione asm.pseudo = true
# show pseudo instruction instead of assemblye asm.emu = true
# emulate code using ESILe asm.emustr = true
# show string and method referenced in the emu commentse anal.hasnext=true
# assume a new function is found after the last one
General
- Use
V_
to seach through strings (including classes and methods) in the visual mode HUD mode. - r2pm supports installation of dex2jar. dex2jar can be used to convert dex files into jar files.
r2pm -i dex2jar
Resources
Android malware analysis with Radare: Dissecting the Triada Trojan Oneplus backdoor analysis Android/Linux vmlinux loader Android Crackme and Structure offset propagation
Complimentary tools
Installing
Installing from pre built
- Download the latest from
http://radare.mikelloc.com/get/[version]/[android-arch]
- Push to android device with
adb push data/ /
- From
adb shell
launch/data/data/org.radare.radare2installer/radare2/bin/r2[or any other r2 binaries]
Documentation for building
Documents around installing r2 on android
Install using Termux
- radare2 can be installed right from Termux. Inside termux terminal, run the following commands
pkg update
pkg install radare2