apk.sh: makes reverse engineering Android apps easier

by ddos ·

apk.sh

apk.sh is a Bash script that makes reverse engineering Android apps easier, automating some repetitive tasks like pulling, decoding, rebuilding, and patching an APK.

Features

apk.sh basically uses apktool to disassemble, decode and rebuild resources and some bash to automate the frida gadget injection process. It also supports app bundles/split APKs.

  • 🍄 Patching APKs to load frida-gadget.so on start.
  • 🆕 Support for app bundles/split APKs.
  • 🔧 Disassembling resources to nearly original form with apktool.
  • 🔩 Rebuilding decoded resources back to binary APK/JAR with apktool.
  • 🗝️ Code signing the apk with apksigner.
  • 🖥️ Multiple arch support (arm, arm64, x86, x86_64).
  • 📵 No rooted Android device is needed.

apk.sh pull

apk.sh pull pull an APK from a device. It supports app bundles/split APKs, which means that split APKs will be joined in a single APK (this is useful for patching). If the package is an app bundle/split APK, apk.sh will combine the APKs into a single APK, fixing all public resource identifiers.

apk.sh patch

apk.sh patch patch an APK to load frida-gadget.so on start.

frida-gadget.so is a Frida’s shared library meant to be loaded by programs to be instrumented (when the Injected mode of operation isn’t suitable). By simply loading the library it will allow you to interact with it using existing Frida-based tools like frida-trace. It also supports a fully autonomous approach where it can run scripts off the filesystem without any outside communication.

Patching an APK is simple as running ./apk.sh patch <apk_name> –arch arm.

You can also specify a Frida gadget configuration in a json ./apk.sh patch <apk_name> –arch arm –gadget-conf <config.json>

Download

Copyright (C) 2022 ax

Tags: reverse engineering Android apps