WiP : Moving to dexcalibur 2.0 | codename : Reversense

Dexcalibur

Dexcalibur is an Android reverse engineering platform focus on instrumentation automation. Its particularity is to use dynamic analysis to improve static analysis heuristics. It aims automate boring tasks related to dynamic instrumentation, such as :

• Decompile/disass intercepted bytecode at runtime
• Write hook code and Manage lot of hook message
• Search interesting pattern / things to hook
• Process data gathered by hook (dex file, invoked method, class loader, ...)
• and so ... But not only that, because Dexcalibur has own static analysis engine and it is able to execute partial piece of smali.

Do you want share something or do you need some help ? Join our official chats :

Telegram - the quickiest way to give a response

Official documentation is available here (website - work in progress).

See the latest news here : http://docs.dexcalibur.org/News.html

Show Dexcalibur demo videos : Demo: Less than 1 minute to hook 61 methods ? Not a problem. (youtube)

How to support Dexcalibur ?

Contribute !

Don't hesitate ! There are several ways to contribute :

• Make a pull request related to a fix or a new feature
• Create an issue to help me to patch/involves tools
• Help me to develop UI
• Send me a mail with your feedback
• etc ...

A. Installation

A.1 New install

Go to Install doc

Alternative: use Docker

• on your host, install adb (and an Android emulator if appropriate)
• docker-compose build android-dexcalibur
• docker run --rm -it --net=host -v /tmp/dexcalibur:/shared -p 8000:8000 dexcalibur:2023.01 /bin/bash

A.2 Launch dexcalibur

For Linux and MacOS

NPM Install : If Dexcalibur has been installed globaly using NPM (-g option), then Dexcalibur can be launch from terminal by doing $ dexcalibur, else the location it can be launch by $ node $(node root -g dexcalibur)/dexcalibur/dexcalibur.js.

Install from source : from dexcalibur folder, run $ dexcalibur or $ node dexcalibur.js.

For Windows

NPM Install : Event if Dexcalibur is installed globaly using NPM (-g option), Dexcalibur must be launched from terminal by running the following command from a terminal node <NPM_ROOT>/dexcalibur/dexcalibur.js.

Install from source : from dexcalibur folder, into the terminal, run the command node dexcalibur.js.

A.3 Update

From version <= 0.6.x

You are using a previous version of Dexcalibur ?

Follow same steps than a new install, and when you should enter workspace path, enter your current workspace location.

From version >= 0.7

Just by doing:

$  npm install -g dexcalibur

Existing configuration and workspace will be detected automatically.

C. Screenshots

Following screenshots illustrate the automatic update of xrefs at runtime.

D. Features and limitations

Actually, the biggest limitation is Dexcalibur is not able to generate source code of hook targeting native function (into JNI library). However, you can declare manually a Frida's Interceptor by editing a hook.

Assuming Dexcalibur does not provide (for the moment) features to analyse native part such as JNI library or JNA, only features and limitations related to Java part have been detailled.

Analysis accuracy depends of the completeness of the Android API image used during early steps of the analysis. That means, if you use a DEX file generated from the Android.jar file from Android SDK, some references to internal methods, fields, or classes from Android java API could be missing. Better results are obtained when the analysis start from a "boot.oat" file extracted directly from a real device running the expected Android version.

D.1 Features

D.1.A Static analyzer

TODO : write text

D.1.B Hook manager

TODO : write text

D.1.C Dexcalibur's smali VM

Tracked behaviors

Static analyzer involved into "Run smali (VM)" action is able to discover and accept but track following behaviors :

• Out-of-bound destination register (register out of v0 - v255)
• Out-of-bound source register (register out of v0 - v65535)
• Detect invalid instruction throwing implicitely an internal exception
• Detect some piece of valid bytecode non-compliant with Android specification
• Compute length of undefined array
• Fill undefined array
• and more ...

Actually, handlers/listeners for such invalid instruction are not supported but events are tracked and rendered.

Dexcalibur IR

The VM produces a custom and simplified Intermediate Representation (IR) which is displayed only to help analyst to perform its analysis.

Depending of the value of the callstack depth and configuration, IR can include or not instruction executed into called function. If the execution enters into a try block and continues to return, but never excute catch, then the catch block will not be rendered. In fact the purpose of Dexcalibur IR is to render only "what is executed" or "what could be executed depending of some symbol's value" into VM context.

Dexcalibur IR helps to read a cleaned version of bytcode by removing useless goto and opaque predicate. Dexcalibur IR can be generated by the VM with 2 simplifying levels :

1st level IR, could be used if you don't trust 2th level IR :

• no CFG simplifying : conditions and incondtionnal jumps are rendered.
• every move into a register are rendered

2th level :

• Hide assign if the register is not modified with an unknown value before its use.
• Always TRUE/FALSE predicate are removed
• Inconditional jump such goto are removed under certain conditions : single predecessor of targeted basic block, etc ...
• Resolve & replace Method.inoke() call by called method if possible.
• Instructions into a Try block are not rendered if an exception is thrown before
• ...

Android API mock

TODO

Details

Smali VM follows steps :

1. Init VM : stack memory, heap, classloaders, method area, ...
2. The VM load class declaring the method.
3. (Optionnal) If the class has static blocks, clinit() is executed. It helps to solve concrete value stored into static properties
4. Load method metadata
5. Execute method's instructions, if PseudoCodeMaker is enable, Dexcalibur IR is generated.

How VM handles invoke-* instruction ?