Going old fashion: debugging android with JDWP (ง ͡ʘ ͜ʖ ͡ʘ)ง (day 6)

Tampering and reverse engineering android application is always been my favorite activity when i try to do android application pentesting. Using reverse engineering we would able to understand the nature of the application code and tampering is when you try to change the value of the runtime(at debugging state) and capable of change the code flow.

in this blog post i will try to show how to use one of the old tool to do java debugging activity which is JDWP and for the testing app i will use insecurebankv2 application.

luckily JDWP has already been pre installed inside the adb utility. But In order to use jdwp for tampering application, we should do at least couple of things:

1. First we need to know where is the application PID is in order for us to attach into the process.

run ~# adb jdwp (don't execute your application first)

run it again ~# adb jdwp (execute your application)

as you can see from the the second picture the id 1309 is appear when we try to execute the application, this is the ID of the running application.

NOTE: THE RESULT YOU WILL GET MAY BE DIFFER FROM THE ABOVE PICTURED

so right now we found out what is the PID and proceed to attach the debugger at the PID by following this command:

~# adb forward tcp:12345 jdwp:<the PID>
~# jdb -attach localhost:12345

try to type "classes" inside the shell to list all of the class. At first you maybe overwhelm but you will get hang to it for a while.

JDWP is not equip with the same functionality in bash shell so you cannot try to use the previous code by press the up arrow(it suck bro! you have to type everything again and again).

login to the application notice that the application show that the device is rooted. So let's try to bypass the root detection.

go back to your shell again and put this command:

~# methods com.android.insecurebankv2.PostLogin

this command will help you to list all of the methods inside the class that you can put a breakpoint.

lets tamper the showRootStatus() methods ! place a breakpoint at the method:

~# stop in com.android.insecurebankv2.PostLogin.showRootStatus()

run the application again and we will get to the breakpoint:

(note: bci means bytecode index it tells you which bytecode instruction is executed)

you can use "step" command to move to the next method and "locals" command to show the variable.

notice that the application is check the root status by checking if the superuser.apk  is installed or not.

step through the code until it show  ", line=88 bci=16"

this is where we should tamper our code by change the "isrooted" variable into true.

to continue the execution of the code put command:

~#run

yeay! we successfully bypass the root detection.

IMPORTANT NOTE: THIS APPLICATION COULD BE DEBUG BECAUSE IT STILL SET AS DEBUGGING MODE. YOU CAN CHECK IT AT THE ANDROIDMANIFEST.XML FILE. IN ORDER TO DO IT IN THE REAL APPLICATION MAKE SURE THAT YOU ENABLE THE DEBUGGING MODE BY CHANGE THE "android:debuggable="false" "INTO TRUE AND REPACKAGE THE APPLICATION AGAIN.