Tips

Helpful commands for Android reversing

• ic to enumerate classes and methods from a .dex file
• icq to enumerate classes
• iiq show external methods
• izq list all strings contained in the program

Helpful commands for arm reversing

• e asm.describe = true # show description of each ARM instruction
• e asm.pseudo = true # show pseudo instruction instead of assembly
• e asm.emu = true # emulate code using ESIL
• e asm.emustr = true # show string and method referenced in the emu comments
• e anal.hasnext=true # assume a new function is found after the last one

General

• Use V_ to seach through strings (including classes and methods) in the visual mode HUD mode.
• r2pm supports installation of dex2jar. dex2jar can be used to convert dex files into jar files. r2pm -i dex2jar

Resources

Android malware analysis with Radare: Dissecting the Triada Trojan Oneplus backdoor analysis Android/Linux vmlinux loader Android Crackme and Structure offset propagation

Complimentary tools

termux r2frida for android

Installing

Installing from pre built

• Download the latest from http://radare.mikelloc.com/get/[version]/[android-arch]
• Push to android device with adb push data/ /
• From adb shell launch /data/data/org.radare.radare2installer/radare2/bin/r2[or any other r2 binaries]

Documentation for building

Documents around installing r2 on android

Install using Termux

• radare2 can be installed right from Termux. Inside termux terminal, run the following commands
  • pkg update
  • pkg install radare2