Throw exception while apktool try to decompile/unarchive my apk

Question

I tried to harden my APK from reverse engineering. I know it's impossible preventing decompile APK but I saw some APKs used a trick to throw exception apktool in decompile process (Not just APK tool, all of decompiler like QARK can't return a classes.dex APK), so I decided to do that for take longer time in reverse engineering

Here you can see some result of result of hardened application : winrar:winrar.winrar2

apktool:

    sudo apktool d -f app/TTT.apk --keep-broken-res
    I: Using Apktool 2.3.1-dirty on TTT.apk
I: Loading resource table...
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
W: Multiple types detected!  ignored!
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /home/lab/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
Exception in thread "main" java.lang.NullPointerException
    at brut.androlib.res.data.value.ResEnumAttr.serializeBody(ResEnumAttr.java:56)
    at brut.androlib.res.data.value.ResAttr.serializeToResValuesXml(ResAttr.java:64)
    at brut.androlib.res.AndrolibResources.generateValuesFile(AndrolibResources.java:555)
    at brut.androlib.res.AndrolibResources.decode(AndrolibResources.java:269)
    at brut.androlib.Androlib.decodeResourcesFull(Androlib.java:132)
    at brut.androlib.ApkDecoder.decode(ApkDecoder.java:124)
    at brut.apktool.Main.cmdDecode(Main.java:163)
    at brut.apktool.Main.main(Main.java:72)

Please explain for me, how it's possible ?(I need detail of implementation)

Are you sure that's not just a corrupt APK you're looking at? I find it unlikely that you'd get the errors that you got if the APK actually worked when you tried to install it on Android. — Joseph Sible-Reinstate Monica, Oct 30 '18 at 00:28
hi @JosephSible , tanks for replying and Yes i'm pretty sure , look at the critical application like payment purpose (apktool work well on 98% of apk , 2% android application implemented that trick) — learner, Oct 30 '18 at 00:55
@JosephSible , that website restricted on ip address geo , i uploaded here for you ,download that ASAP before link expiration https://file.io/15kaKt — learner, Oct 30 '18 at 01:40
It's already 404, only three minutes after you posted the link. — Joseph Sible-Reinstate Monica, Oct 30 '18 at 01:43
@JosephSible :D Jesus christ , an other time with different service, https://ufile.io/eqsb3 ASAP Please — learner, Oct 30 '18 at 01:53
@JosephSible i'm pretty sure it's valid apk because i already installed on my phone — learner, Oct 30 '18 at 02:11
@JosephSible yes you right, i think that file damaged while transferring, but this time i checked out (i download from this link and installed that it's work !) ,sorry about that , please download it again please https://ufile.io/ewhz6 (Now You Can Test it) — learner, Oct 30 '18 at 02:28
Don't make edits to your question that substantially change its meaning after it's had answers posted. You completely changed the errors that you said you were receiving. — Joseph Sible-Reinstate Monica, Oct 30 '18 at 13:20

Joseph Sible-Reinstate Monica · Answer 1 · 2018-10-30T02:38:39.360

0

The first APK you linked to isn't a valid APK. It's just a plain text file, with the following text repeated over and over:

HTTP/1.1 200 OK
Date: Sat, 27 Oct 2018 17:35:36 GMT
Strict-Transport-Security: max-age=31536000;includeSubDomains; preload
Last-Modified: Sat, 28 Jul 2018 11:40:03 GMT
ETag: "23b1fe5-5720db0636ac0"
Accept-Ranges: bytes
Content-Length: 37429221
Keep-Alive: timeout=20
Connection: Keep-Alive

Obviously, just HTTP response headers repeated don't form a valid APK. The reason that your tools are failing on that file isn't that it's encrypted/obfuscated/hardened, but that it's not really an APK at all, and wouldn't work if you tried to install it.

The second APK you linked to extracts for me fine when I unzip it.

My conclusion is that the "hardening" you mention doesn't exist (it seemed to only due to mixing up valid and invalid APKs), and that any APK that successfully installs can also be successfully extracted.

edited Oct 30 '18 at 02:38

answered Oct 30 '18 at 02:01

Joseph Sible-Reinstate Monica

45,431
5
48
98

Then the file you installed isn't the one that you linked to. – Joseph Sible-Reinstate Monica Oct 30 '18 at 02:08
yes you right , i think that file damaged while transferring, but this time i checked out (i download from this link and installed that it's work !) ,sorry about that , please download it again please https://ufile.io/ewhz6 (Now You Can Test it) – learner Oct 30 '18 at 02:22
@learner That one is indeed valid, and it doesn't appear "hardened" to me. Answer updated. – Joseph Sible-Reinstate Monica Oct 30 '18 at 02:38
so why apktool throw exception or QARK dosent know that as APK file ? – learner Oct 30 '18 at 02:44
you go on wrong why because when you unpack that apk , you can saw classes.dex no res Directory you can saw just some files encrypted (I think) So its hardened and you dose not give me a True Answer ! – learner Oct 30 '18 at 08:23
an other way i ask **how** **throw** **exception** **apktool** **while** **decompile**; your answer is without ANY relation to my question ! – learner Oct 30 '18 at 08:26

learner · Answer 2 · 2018-10-30T09:48:20.923

-1

That's encryption java classes feature (Like dexgaurd or Bangcle kh); and also that's protected with Native Library Encryption (NLE) + JNI Obfuscation (JNI) From Something like dexprotector (i found that in dynamic analysis tools)

and many tanks to semanticscholar for This article and this

edited Oct 30 '18 at 09:48

answered Oct 30 '18 at 09:40

learner

61
1
7

Throw exception while apktool try to decompile/unarchive my apk

2 Answers2