Unfortunately I deleted my Android source code. Tried to get jar using dex2jar and baksmali and used jd-gui to get java source files using my .apk file. Yes I got the files but the problem I have is, in more places in the java file, the code is in byte format. Need to get that to readable format to get myself to move forward.
Decompiling is not a perfect science, and you rarely get back the exact Java code you typed.
When you compile your code, a bunch of optimizations are done on it, which make decompiling more difficult if you're aiming to get the original code.
At best, you'll get a lot of decently decompiled code, along with some byte code. You should be able to figure out what Java code to substitue for that byte code based on where in the program it is, seeing as you wrote the original code.
For most simple apps, it is easier to rewrite from scratch than it is to decompile and try to fix that decompiled code.
tl;dr: Don't forget to backup your code. Ever.
Generally if your goal is to get readable source back, then something like JD-Gui is your best bet. But for cases where it fails, you could try Krakatau, a decompiler I've written.
Krakatau is designed to be able to decompile classfiles, even if they're obfuscated or not compiled from Java. However, the result is less readable then something like JD-Gui because it doesn't take advantage of the patterns left by the Java compiler. It's not perfect, but I think it's definitely worth a try.
P.S. Krakatau only supports JVM bytecode. You'll need a way to convert it from Android back into Java bytecode before you can decompile it.
Related
I'm currently working on analyzing some android malwares and i need to decompile APK files. Reading an answer and many other answers like it, i know that we can extract java source code and other resources, create a new project and put those files in, make some modifications and compile the project. Is this approach applicable to every APK file ? If we aim to make very little or no modifications in the java source code, does this approach work for every APK file? If not, what is the main reason?
As another question, i remember i read somewhere (can not find it now) that said converting dex to jar (with tools such as dex2jar) or decompiling dex to java (with tools such as JADX) is somehow lossy and causes information loss. Is there any such concept?
I ask this questions for educational purposes and i'm not aiming to do anything illegal.
I want to encrypt .jar file of my android application so that it can't be decoded by any one to view the source code.
How can I achieve this?
It will always be possible to decompile it.
You can only obfuscate your code to make it harder to understand for humans. If your project insists of more than a few classes the effort to understand it will be higher than any one is willing to invest.
One tool to achieve this, which also reduces the size of your class-files is
ProGuard: http://proguard.sourceforge.net/
But there are quite some similar tools out there.
Firstly - you can exclude source code from jar files. It is not required at runtime. Class files are sufficient.
Encrypting will not help you, if you encrypt the files JVM will not be able to understand it.
As responded in the earlier answer, there will always be tools to decompile the byte codes, you can make it harder for the attacker to read so that it is not worth his time
Generally we can get source code from the android installation package as shown in this reference link.
But, is it possible to secure the actual program code (source code) from a reverse engineer ?
The code that you write is converted into class files then dex files, so directly viewing the code is not possible. but however dex compilers can be used to de-compile the source code but that requires some good knowledge so for that you have to obfuscate the code. Google by default provides proguard so that you can protect the code
you can read about proguard from here
In simple words you cannot hide the source code, but just add this line proguard.config=proguard.cfg to your project.properties file so making it difficult to be decoded . You can check here for an example
No, because the android system has to be able to read it in order to run it. You can obfuscate it with tools like Proguard to make it harder to decompile, but there's no way to make it completely impossible.
I have download an apk from the internet and decpress it using dex2jarf tool so its gives compiled,.classes files which i convert into .java file through decompiler but it gives me classes toa proper way like it gives a.java,b.java c.java which is difficult to me read.Can i get proper classes name through apk file same as it is used in project.plz help
Thanks
What you are trying to achieve is called deobfuscation.
Programmers who wish to protect their intellectual property obfuscate their code to make it more difficult to read for those who might want to steal/copy/plagiarise their hard work.
Obfuscators replace these names with short, machine generated alternatives. Rather than seeing a call to dontAllow(), an attacker would see a call to a(). This makes it more difficult to intuit the purpose of these functions without access to the original source code.
Src: http://android-developers.blogspot.ie/2010/09/securing-android-lvl-applications.html
There is no way to recover identifiers if they have been stripped out. Compilation is a lossy process, like converting a RAW image to a low quality JPEG. There's no way to go from JPEG back to RAW.
However, there are tools like jeb and ida that allow you to rename the classes yourself. When renamed, all references to that class also get renamed. This feature is sometimes called "refactoring". This is about the best way to do it, but it takes more time.
Also, there are plugins for jeb that help automate the refactoring by generating new, more descriptive names than 'a', 'b', etc. Here's an example from jcase, which you can modify to suit your needs: https://github.com/CunningLogic/myJEBPlugins/blob/master/DeCluster.java
I am trying to prevent the app from being de-compiled and thus getting exposed. I know there is proguard which I can use to convert the java files to .smali files. But my question is, how secure are these .smali files?
When I did R&D on that, I got some results that .smali files can be converted back to java files. Is that true? Or else what is the best way to prevent the apk from decompiling? My app includes lot of financial details, so at any cost I should not be able to reveal them to the outside world or at least I am trying to make it very difficult to decompile it.
Note: I have already did lot of work on getting the working of proguard
Your answer would be greatly appreciated
Proguard is built in to later versions of the Android SDK. You just point to proguard.cfg and it will be used during release. I assume you know this bit.
Proguard is not related to smali. In the end all these tools output working bytecode and you can always recompile bytecode. Can't stop that. What proguard can do is rename all the symbols in your code so that the result is very hard to understand.
If you mean you are storing sensitive info in string literals in your app then don't do that. These can't be obfuscated or else your app wouldn't work. They are always visible as literals in the byte code.