Xposed with shared library. - Android Q&A, Help & Troubleshooting

I was struggling not to make that kind of posts but as far I can see, I definitely need help in order to proceed.
I need help with hacking an app. The application in question utilizes AES encryption for some subset of web requests. As I understand, the key for encryption is generated by the app at native code level which then used for encrypting/decrypting internet traffic, using shared library. In addition to that, there is a method to fetch the encryption key, if my understanding of the process is correct.
Personally, I don't follow the whole sequence of actions it does to encode/decode data (app heavily utilizes both java, native arm code and server-obfuscated JS code so it'd a bit complicated to follow). So, I thought that it might be faster and more effective to go straight for the key, so the plan was writing xposed module which would fetch it.
I haven't developed for Android platform before so please bear with my ignorance. As I understand, if the method in shared library is called Java_<class>_<method> then it can be declared in that class and be called from there. If the library is checked using IDA Pro, you could see a bunch of method following that naming approach in Exports tab. The problem is that the key fetching method uses different naming/declaration - <ClassA>::<ClassB>::<Method> (and its export name is something like _ZN3ClassA6ClassB9MethodEv). While I have a vague idea of calling typical native class methods (Java_.... ones), I don't have a slightest idea if <Class1>::<Class2>::<method> could be called from Java code somehow.
Any help would be appreciated.

Related

[Q] User generated layouts

Hi all
I am developing an app in which I would like to allow user-generated content. Specifically, this will be a remote control application, and I would like people to be able to add custom layouts, capable of sending "events" through the app, but I am not sure how to do so.
There are a couple of ways I have been looking at. The first is using a WebView so that this content can be developed in HTML. This would be nice and easy from their point of view, but it does have it's downsides, especially where security is concerned. If I was to do this, I would want to bind a "send" Javascript interface to my app, but disallow any other Javascript (I do not, for example, want it to be able to relay the button presses to some other place). I'm not sure exactly how I could do this.
The second way I can see would be to use an XML file and build up the layout from that. Here, the only way I could see it to parse the XML file and programatically build the layout. This seems a lot of work, and I would rather avoid that.
A third way would be to import a layout purely as an image plus an XML file describing hot-spots for triggering events. This seems to have too many limitations.
The final option is to expose an interface to other apps, and allow users to build separate applications which hook in to provide these layouts. This seems a terrible approach for such a simple objective.
So, does anyone know of a simple way to do what I am after, or any comments on the options listed above? Has anyone done anything similar, or know of an open-source project which acheives something similar?
Thanks in advance

[Q] Application Development Help

Hi
I'm new to android dev and I'm trying to make an application for internal use among people in the company and partners. Its a very simple app, and I think I can cover most of the coding, but what I can't is connection to a remote mysql database. Its used to verify login credentials and edit certain columns (without it, app is useless).
From what I understand, its suppose to work like this: SQL > PHP > APP where the app pulls info from a php script located on the remote server. My issue with this is Java, which I'm very new to. I'm looking for someone to guide me through making that first bridge (I tend to make more, where I can pull sql data from app to show some stats or whatever)
Thank you
Loldawg said:
Hi
I'm new to android dev and I'm trying to make an application for internal use among people in the company and partners. Its a very simple app, and I think I can cover most of the coding, but what I can't is connection to a remote mysql database. Its used to verify login credentials and edit certain columns (without it, app is useless).
From what I understand, its suppose to work like this: SQL > PHP > APP where the app pulls info from a php script located on the remote server. My issue with this is Java, which I'm very new to. I'm looking for someone to guide me through making that first bridge (I tend to make more, where I can pull sql data from app to show some stats or whatever)
Thank you
Click to expand...
Click to collapse
If you're into web development and performance is not an issue, then you can try the webview instead of coding natively. At that time, you'll be using more html, javascript, jquery in which you may be more familiar with.
wcypierre said:
If you're into web development and performance is not an issue, then you can try the webview instead of coding natively. At that time, you'll be using more html, javascript, jquery in which you may be more familiar with.
Click to expand...
Click to collapse
Hi, thank for the swift reply =) I thought about it, but I'd like to make it right the first time. It would be nice to make the data available so I can do whatever with it. I did find a tutorial including examples and code on how to connect to sql and pull information, I'm just having a hard time actually implementing it into eclipse.. No idea where to type it in and stuff lol

Confused about how to evolve from (very) basic Android Development

Hello.
I followed all the New Boston Android videos, did everything, understood everything.
I tried to create a basic RSS feed reader, in order to better incorporate some concepts I learned in the New Boston videos (http processing, xml processing, adapting the content to lists, custom lists, etc). When I got to pass the information from the http processed data to xml parser and the list, that's when I got too much confused and knew I didn't have enough knowledge.
Then I tried to do some "Shopping List Manager" (just like OI Shopping, a bit adapted more to my taste), in order to learn.
However, again, when I neededto pass information to other objects in other classes or something like that, I get confused and don't know what to do.
So I bought CommonsWare book, "The Busy Coder's Guide to Android", which I have the latest version (5.1) and I'm reading, but I don't like to advance when I don't fully understand something. This time I'm stuck on the Action Bar part, more precisely this one:
Code:
private void configureActionItem(Menu menu) {
EditText add=
(EditText)menu.findItem(R.id.add).getActionView()
.findViewById(R.id.title);
add.setOnEditorActionListener(this);
}
I know this will seem very basic to many of you, but I get really confused on all this calls, returning results and more calls.
I don't have a background on OOP, except when I worked with PHP frameworks like Symfony, I work usually with direct task programming (scripting, automation, etc), as I am a Linux System Administrator, so my code is mainly scripting and web interface building (Python, Shell Script, PHP, Javascript, etc).
Can anybody explain what can I do to better understand this? It's just lack of practice and in time I'll understand better? Is it OOP lack of knowledge/practice? Or is it Java lack of knowledge/practice?
Thanks a lot for all your help.
Maybe the best approach is to get some face time with a person who is more experienced and have him explain to you the concept you have trouble with while focusing on the parts you don't grasp. A real human has this flexibility to do a "targeted strike" unlike a tutorial or a book that has no idea where in particular the student may get confused.
For this particular issue, the issue can be summarized as follows. Let's say you have an object call a function:
Code:
orange.peel();
This should be relatively straightforward. The next level of complexity is the fact that obj is just a variable representing an object, and in fact we can substitute anything else that evaluates to an object (i.e.: after it runs, you end up with an object). For example these all are legal ways to call the method as long as types match:
Code:
(new Orange()).peel();
(shouldEatSmallerOrange ? smallerOrange : largerOrange).peel();
retrieveOrangeFromBox().peel();
The last line illustrates calling some other function that returns the object, which is then used to call a second function. The final step from here is to recognize that instead of a single retrieveOrangeFromBox() we can have a chain of functions, each of which returns an object that is used to call the next function in line. For example:
Code:
findCar().accessCarTrunk().unloadBoxFromTrunk().retrieveOrangeFromBox().peel();
The names are unnecessarily verbose to illustrate how functions and their results relate to each other.
OOP + Android system
You're not that clear as to exactly what you are having a problem with, but in general, it sounds like you need to get a java book and learn the basic concepts of classes and interfaces. Since you say you have a background in PHP you could probably go pretty far just by following the Java tutorials on the Sun website. I say java because that's the target language here, any book on OOP in any language would be adequate but learning java would give you the added ability to read other people's android code examples more easily.
After that, you can learn the Android framework. You develop in the Java language but you work within the android framework. What that means is that here, for example, the action bar is provided to you by the android system, and this callback is called by the system, so it is all set up for you. But to understand what is happening, you need to understand when the system calls this method and what it does. That is the framework.
So more specifically, how can you understand this code? This method is called from another method, onCreateOptionsMenu(). OnCreateOptionsMenu() is a method in the Activity class that is called automatically by the system at a specific time. You need to read about the Activity class and the Activity lifecycle on the android developers site. If you want your activity to provide an options menu, you create it in OnCreateOptionsMenu and return it, the system will handle it from there. So back to configureActionItem(Menu menu), here you are passing in the menu object, which contains MenuItem objects, which the system uses to populate the menu (either on the action bar, or when you hit the menu button, depending on the android version). Each MenuItem object has a view that is associated with it (usually created in an XML file).
One thing that may be hard to understand is that all these calls are chained, so if you don't know what they are returning you don't know where to look for help. It's easier if you separate the calls out. Here, the documentation is your friend. If you look at the Menu class on the android dev site, you see that findItem() returns a MenuItem. So then you look up MenuItem, and you see that getActionView() returns a View. Look at the View class, and you can see findViewById() returns another view (a sub-view that is contained within this view). so when you look at it all together, unchained:
Code:
private void configureActionItem(Menu menu) {
MenuItem mi = menu.findItem(R.id.add);
View parentView = mi.getActionView();
EditText add = (EditText)parentView.findViewById(R.id.title);
}
findViewById returns a View, but you know that the view known by the id R.id.title is an EditText view, and you want to use it as an EditText, so you have to cast the View to an EditText (which is a subclass of View) so that the compiler knows that it is an EditText type of view. That's what the (EditText) is doing in front of the findViewById call. To understand that you need to read about subclassing and strongly-typed programming languages. PHP is weakly-typed, so that might be new to you.
finally, you call setOnEditActionListener on the EditText. OnEditActionListener is an interface that you have implemented in this class. An interface defines a common set of methods that are guaranteed to be present in whichever class has implemented it. So when you set the OnEditActionListener to this, (this means the current instance of this class), the EditText will hold on to the "this" object and it knows that it can call a certain set of methods on it. What are those methods? look up the OnEditActionListener interface in the docs:
it only has one method,
Code:
public abstract boolean onEditorAction (TextView v, int actionId, KeyEvent event);
so somewhere in this class, you will have this method defined and this is where you put code that you want to run when the EditText triggers this action. I assume this get called when the user touches the EditText.
It's really not going to be easy to work with android if you don't have a basic knowledge of OOP, specifically classes, inheritance, and interfaces. Also, knowing how java implements these concepts will help a lot. Then you can use your book to learn the Android framework.
GreenTuxer said:
Hello.
I followed all the New Boston Android videos, did everything, understood everything.
I tried to create a basic RSS feed reader, in order to better incorporate some concepts I learned in the New Boston videos (http processing, xml processing, adapting the content to lists, custom lists, etc). When I got to pass the information from the http processed data to xml parser and the list, that's when I got too much confused and knew I didn't have enough knowledge.
Then I tried to do some "Shopping List Manager" (just like OI Shopping, a bit adapted more to my taste), in order to learn.
However, again, when I neededto pass information to other objects in other classes or something like that, I get confused and don't know what to do.
So I bought CommonsWare book, "The Busy Coder's Guide to Android", which I have the latest version (5.1) and I'm reading, but I don't like to advance when I don't fully understand something. This time I'm stuck on the Action Bar part, more precisely this one:
Code:
private void configureActionItem(Menu menu) {
EditText add=
(EditText)menu.findItem(R.id.add).getActionView()
.findViewById(R.id.title);
add.setOnEditorActionListener(this);
}
I know this will seem very basic to many of you, but I get really confused on all this calls, returning results and more calls.
I don't have a background on OOP, except when I worked with PHP frameworks like Symfony, I work usually with direct task programming (scripting, automation, etc), as I am a Linux System Administrator, so my code is mainly scripting and web interface building (Python, Shell Script, PHP, Javascript, etc).
Can anybody explain what can I do to better understand this? It's just lack of practice and in time I'll understand better? Is it OOP lack of knowledge/practice? Or is it Java lack of knowledge/practice?
Thanks a lot for all your help.
Click to expand...
Click to collapse
Thanks a lot for your help. I also think my issue is with OOP, but I needed the opinion of people with more knowledge.
I understand very well what you said about onCreateOptionsMenu(), why and when is called, Activity class, lifecycle, etc.
Those things I understand without any problem. I also understand the basics of OOP, but I don't know almost nothing about Interfaces and I don't have almost any experience with inheritance, although I understand it.
I think I'm just confused because I haven't worked very long with OOP. I just don't know if I should invest in something like reading and testing something like Thinking in Java, or just practice more and more Android Development.

Serve http URI locally

I have an idea to integrate the S-Note app with the rest of my Note 3 (Android 5.0 rooted) file system using its undocumented feature of auto-converting URL-like text into clickable links. In a nutshell, I want to click such a link (it recognizes http:// and ftp://) pointing to a local file on my device and have that file displayed in one of the apps supporting it. The obvious way to do that is installing a local http server.
That worked to some extent as expected. However, the webserver app I've found on the Play is in java, have a lot of advanced features I don't need, and thus consuming too much of resources to keep online 24/7...
My question is: what would be the best modern way to achieve what I want? E.g. a small native code single threaded daemon I can autostart on the system's restart to serve my files?
I saw the Native Android Web Server 1.1 but it's not working anymore (see that thread for details).

[Development] Discovering, reverse-engineering and using vendor HALs

Project Treble provides a great help in getting access to vendor-specific HALs, I'll try to explain how, and how to exploit it.
Presentation of vendor HIDLs
Thanks to Project Treble, all HALs must be defined through HIDL.
Standard AOSP HALs means that a generic AOSP system works with standard AOSP features.
But, vendor HALs are also going through HIDL!
APIs defined through HIDL are stable, versioned, hashed and easy to access.
Just plug the HIDL inside your build system, and you get easy access from your applications to the HAL behind the HIDL!
Also, APIs defined through HIDL are supposed to be clean, and mostly self-documented, so getting the HIDL can help understand how the HAL works.
To understand how easy it is, here is a real world client usage of an HIDL:
Code:
IExtBiometricsFingerprint service = IExtBiometricsFingerprint.getService();
service.sendCmdToHal(NAV_ON);
With the HIDL, enabling gestures on the fingerprint sensor on Huawei devices is a two liners! [1]
Browsing vendor HIDLs
Now, the problem is that HIDLs are part of the source code, not the firmware.
So if the vendor doesn't publish it, there is some additional work to do.
Android build system is capable of generating two client APIs for HALs using HIDL. Either a C++ library, or a java library. Not all firmwares will contain java libraries for all APIs, but C++ is almost always available.
Both languages make it fairly easy to reverse engineer the prototype of the functions, which is almost all of HIDL (c++ is missing function arguments)
So, I made a script to reverse engineer those HALs ( https://github.com/phhusson/treble_experimentations/blob/master/vendor-HAL/reverse-hal.sh ).
It is far from perfect, it can't generate a full-blown HIDL, but it makes discovery much easier!
Here are a few examples of APIs it is giving access to:
- Touch screen gives us access to Glove mode and cover mode
- Display gives us access to functions like setColorTemperature, or updateRgbGamma
- Infrared HAL gives us access to learning capability
- fingerprint sensor gives us access to sendCmdToHal
With the first three examples, we can see things can be easy, but the last one makes things trickier. With the last one, there is still a magic value to give to the sendCmdToHal function.
Anyway, that's still quite an improvement compared to before Treble.
Using vendor HALs
So, let's say we've discovered [email protected]::hwTsSetGloveMode(bool) function, and we want to call it.
As I mentioned in the first section, if we have the HIDL, it's a two liners.
But, we don't have it, so what do we do?
Android build system usually generates HIDL client code for C++ and Java, so we just need to piggy-back to this code to be able to call the functions!
Using vendor HALs from Java
For Java, the idea is fairly simple, we need to copy/paste the code from the original firmware (either from an app or framework), and copy it in our own environment.
It's a bit more complicated to realize, here is how I did it:
- grep -rF <name of the function> system # To find where to find the java symbols
This gave me system/system/framework/oat/arm64/hwServices.vdex
- deodex it
- Retrieve all symbols inside proper folder. In this case, vendor/huawei/hardware/tp
- Create a mock of the java class ( here is an example )
- Create the code to call this (here is an example)
- Build the mock and the caller (here is an example)
- Decompile the result into smali
- Replace the mock code by the actual classes from the original firmware
- Recompile the whole
- Run the resulting app/dex
Things to improve
First problem here, is this code is annoying to automate and put into a build system.
Them, we can only partially reverse-engineer the HIDL, which leads to two problems:
- We need to piggy-back previous firmware's APIs
- Calling C++ is much harder (because ABI behaviour when changing headers is tricky)
The cleanest solution would be to fully reverse-engineer the HIDLs.
Though current reverse engineering is so bad that it doesn't even list all the functions available, so a lot of work is needed.
Conclusion
Project Treble's HALs are fun to play with, look at it!
[1] I'm a bit lying here. This is enough to enable event reporting, but there are some additional changes needed to make sense of those events
Thanks for your great work here OP
BTW, on Honor 9 stock EMUI HwCamera2 can't take a photo ( checked on landscape or portrait mode on the both camera ), but video recording it's working like expected !
Also with your solution, home button it's working in this way : when I press home button it's open search with a "=" into it
surdu_petru said:
BTW, on Honor 9 stock EMUI HwCamera2 can't take a photo ( checked on landscape or portrait mode on the both camera ), but video recording it's working like expected !
Click to expand...
Click to collapse
This is fixed by https://github.com/phhusson/huawei_camera_aosp/commit/177459fdb76f0aa68fa4ffb869b633d9460a2fb0
Also with your solution, home button it's working in this way : when I press home button it's open search with a "=" into it
Click to expand...
Click to collapse
Yeah, that's what my footnote basically says
Huawei is defining the meaning of fingerprint evdev in /vendor/usr/keylayout/fingerprint.kl, but the KEYCODE_FINGERPRINT_* it uses doesn't exist in AOSP.
What I'm planning to do there is a daemon listening exclusively to /dev/input/eventX of fingerprint, and launch commands based on the events.
This could have performance issues (input keyevent KEYCODE_HOME takes half a second), so I might switch to creating an uinput.
phhusson said:
This is fixed by https://github.com/phhusson/huawei_camera_aosp/commit/177459fdb76f0aa68fa4ffb869b633d9460a2fb0
Yeah, that's what my footnote basically says
Huawei is defining the meaning of fingerprint evdev in /vendor/usr/keylayout/fingerprint.kl, but the KEYCODE_FINGERPRINT_* it uses doesn't exist in AOSP.
What I'm planning to do there is a daemon listening exclusively to /dev/input/eventX of fingerprint, and launch commands based on the events.
This could have performance issues (input keyevent KEYCODE_HOME takes half a second), so I might switch to creating an uinput.
Click to expand...
Click to collapse
Thank you very much, and good luck
surdu_petru said:
Thank you very much, and good luck
Click to expand...
Click to collapse
Does your fingerprint sensor mechanically click? Or is it just some capacitive sensor?
phhusson said:
Does your fingerprint sensor mechanically click? Or is it just some capacitive sensor?
Click to expand...
Click to collapse
No, the only one withe the click is into Honor 8 ... I already see it this : "key 28 ENTER" into fingerprint.kl ... maybe here we can defined as virtual or something like this if I'm not wrong, but sure need to be tested
EDIT :
I guess it's used only on Honor 8, as fingerprint.kl is almost the same for all devices
surdu_petru said:
No, the only one withe the click is into Honor 8 ... I already see it this : "key 28 ENTER" into fingerprint.kl ... maybe here we can defined as virtual or something like this if I'm not wrong, but sure need to be tested
EDIT :
I guess it's used only on Honor 8, as fingerprint.kl is almost the same for all devices
Click to expand...
Click to collapse
Well, my Device (Mate 9), which doesn't mechanically click, does trigger click event.
The way I'm doing it doesn't require changing vendor partition. But yes, changing vendor/usr/keylayout/fingerprint.kl would be much easier.
xx
Diggin on "my own"
Good evening out there!
First of all: Thank you very much for all of your afford till now.
I own a honor 9 lite and im investigating right now how oreo and treble works.
So i took your reverse_hal and tried to improve it a little bit (see attachment).
Maybe it can keep things easier?
Does it make sense to read out all classes in the so's?
I've uploaded the script (reverse-hal-grork.sh) and an example-output from vendor.huawei.hardware.biometrics.fingerprint.
Please, have a look at it.
greetings
vsrookie
PS: If there are any ideas to improve just tell. I thought about automatically create JavaClasses? Or Smali? Will it work?
vsrookie said:
Good evening out there!
First of all: Thank you very much for all of your afford till now.
I own a honor 9 lite and im investigating right now how oreo and treble works.
So i took your reverse_hal and tried to improve it a little bit (see attachment).
Maybe it can keep things easier?
Does it make sense to read out all classes in the so's?
I've uploaded the script (reverse-hal-grork.sh) and an example-output from vendor.huawei.hardware.biometrics.fingerprint.
Please, have a look at it.
greetings
vsrookie
PS: If there are any ideas to improve just tell. I thought about automatically create JavaClasses? Or Smali? Will it work?
Click to expand...
Click to collapse
Looks good
Could you make a pull-request to https://github.com/phhusson/treble_experimentations/ ?
The ideal target would be to generate the original .hal file, so that we can generate c++ and java code automatically with hidl-gen.
I don't know how big is the gap to be able to do that though...
Hi.
I dont think that it will be earlier then the weekend.
But i will do.
Also i go on with my investigation at weekend.
Greetings
Vsrookie
This is interesting... Going to see if I could extract something useful from the Nabi SE, as I'm curious if it can be Treble'd.
phhusson said:
Project Treble provides a great help in getting access to vendor-specific HALs, I'll try to explain how, and how to exploit it.
Presentation of vendor HIDLs
Thanks to Project Treble, all HALs must be defined through HIDL.
Standard AOSP HALs means that a generic AOSP system works with standard AOSP features.
But, vendor HALs are also going through HIDL!
APIs defined through HIDL are stable, versioned, hashed and easy to access.
Just plug the HIDL inside your build system, and you get easy access from your applications to the HAL behind the HIDL!
Also, APIs defined through HIDL are supposed to be clean, and mostly self-documented, so getting the HIDL can help understand how the HAL works.
To understand how easy it is, here is a real world client usage of an HIDL:
With the HIDL, enabling gestures on the fingerprint sensor on Huawei devices is a two liners! [1]
Browsing vendor HIDLs
Now, the problem is that HIDLs are part of the source code, not the firmware.
So if the vendor doesn't publish it, there is some additional work to do.
Android build system is capable of generating two client APIs for HALs using HIDL. Either a C++ library, or a java library. Not all firmwares will contain java libraries for all APIs, but C++ is almost always available.
Both languages make it fairly easy to reverse engineer the prototype of the functions, which is almost all of HIDL (c++ is missing function arguments)
So, I made a script to reverse engineer those HALs ( https://github.com/phhusson/treble_experimentations/blob/master/vendor-HAL/reverse-hal.sh ).
It is far from perfect, it can't generate a full-blown HIDL, but it makes discovery much easier!
Here are a few examples of APIs it is giving access to:
- Touch screen gives us access to Glove mode and cover mode
- Display gives us access to functions like setColorTemperature, or updateRgbGamma
- Infrared HAL gives us access to learning capability
- fingerprint sensor gives us access to sendCmdToHal
With the first three examples, we can see things can be easy, but the last one makes things trickier. With the last one, there is still a magic value to give to the sendCmdToHal function.
Anyway, that's still quite an improvement compared to before Treble.
Using vendor HALs
So, let's say we've discovered [email protected]::hwTsSetGloveMode(bool) function, and we want to call it.
As I mentioned in the first section, if we have the HIDL, it's a two liners.
But, we don't have it, so what do we do?
Android build system usually generates HIDL client code for C++ and Java, so we just need to piggy-back to this code to be able to call the functions!
Using vendor HALs from Java
For Java, the idea is fairly simple, we need to copy/paste the code from the original firmware (either from an app or framework), and copy it in our own environment.
It's a bit more complicated to realize, here is how I did it:
- grep -rF <name of the function> system # To find where to find the java symbols
This gave me system/system/framework/oat/arm64/hwServices.vdex
- deodex it
- Retrieve all symbols inside proper folder. In this case, vendor/huawei/hardware/tp
- Create a mock of the java class ( here is an example )
- Create the code to call this (here is an example)
- Build the mock and the caller (here is an example)
- Decompile the result into smali
- Replace the mock code by the actual classes from the original firmware
- Recompile the whole
- Run the resulting app/dex
Things to improve
First problem here, is this code is annoying to automate and put into a build system.
Them, we can only partially reverse-engineer the HIDL, which leads to two problems:
- We need to piggy-back previous firmware's APIs
- Calling C++ is much harder (because ABI behaviour when changing headers is tricky)
The cleanest solution would be to fully reverse-engineer the HIDLs.
Though current reverse engineering is so bad that it doesn't even list all the functions available, so a lot of work is needed.
Conclusion
Project Treble's HALs are fun to play with, look at it!
[1] I'm a bit lying here. This is enough to enable event reporting, but there are some additional changes needed to make sense of those events
Click to expand...
Click to collapse
So my theory is.
Trebel is a wrapper for closed source drivers ?
If so. Knowing the calls to the drivers give you the code to make any driver trebel ...

Categories

Resources