Android Reversing Workbench

Some tools for manual Android app analysis

What's in this docker image?

Current:

• apktool
• androguard
• dex2jar
• jd-gui
• jadx
• android-sdk
• mitmproxy

TODO:

• AVD-emulators - SDK is in, just nothing in README yet

Building

this will take a long time!
$ ./scripts/build_docker.sh

Basic Usage

$ ./scripts/vanilla_launch.sh

which is essentially:
$ docker run -v $PWD/samples:/tmp/samples --rm -it --network none android-reversing-workbench:latest

For the args above that aren't self-explanatory:

docker-argument	why
--rm	remove after run because these are teardowns
-it	interactive + tty
--network none	even though these are arm apps there's an AVD emulator in there, we don't want network requests going unless you say so
-v	volume mount the local samples dir for use inside the container

GUI Decompilation

Useful if you want to use use JD-GUI tool, for example.

Note: If you need this to work on MacOS then you'll need to do some extra work with Xquartz see here for details. Prior to running the below script XQuaertz will need to be running.

$ ./scripts/gui_launch.sh

Then you could do something like:

$ dex2jar /tmp/samples/yourfoo.apk
$ jd-gui

this will launch the GUI decompiler and you can open your yourfoo.jar file and read it almost like source code

mitmproxy

$ ./scripts/usb_launch.sh

# adb devices
List of devices attached
* daemon not running. starting it now on port 5037 *
ADB server didn't ACK
* failed to start daemon *
error: cannot connect to daemon
# adb kill-server
* server not running *
root@1e58ff8d2e79:/# adb devices
List of devices attached
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
063fb29ef0eaa207    unauthorized

# adb devices
List of devices attached
063fb29ef0eaa207    device

# adb reverse tcp:9850 tcp:8080
# mitmproxy

Then be sure to connect to wifi with the proxy of localhost:8080 on the device ;)