2.1.

APK File decompilation

APK⁵ is the source code of Android application packaged into a kind of application package file format recognized by Android system through compilation, APK file includes compiled code files, file resources, native resource files, certificates, and manifest files. Therefore, in order to analyze the execution code of the original application, the APK file must be decompiled⁶. APK file decompilation means using decompilation tools such as Apktool to convert the code file in the APK file, i.e.. dex file, into the registered language of the Dalvik virtual machine, Smail language.

Apktool is a Java open source project by Google and can be downloaded from http://code.google.com/p/android-apktool/. The process requires the JRE (Java Runtime Evironment) to be installed. Using Apktool, you can disassemble the APK installation package into resources, configuration files, Smail code files, and so on. Among them, the AndroidManfifest.xml file contains some configuration information of the application, and the. so file stored in the lib directory is the dynamic library file written in C⁷.

2.2.

Static analysis techniques

Static analysis is a technique that uses lexical and syntactic analysis to scan executable program files to generate disassembly code without executing the program, and then read and understand the disassembly code to understand the implementation principle of the program⁸. For Android programs, the main purpose is to understand the operation mechanism of the program by analyzing three files, namely, AndroidManifest.xml, Smail code, and libxxx.so in the lib directory, which are obtained after decompiling the APK file.

From AndroidManifest.xml, you can get information about the entry class of the application, whether there is a custom Application class, the requested permission and the registered Activity, etc. The Smail code is a bit more difficult to read, usually you need to use jd-gui to analyze the jar converted from dex2jar. The most difficult to read is the dynamic library file in the lib directory, which is a native library file developed in C/C++ and compiled with the NDK⁹, and disassembled to obtain CPU-level assembly language. Because of the security of. so files, many Android applications currently use the NDK to put their core code such as registration verification, encryption and decryption into .so files, and then call it in Java layer as JNI. The analysis of .so files generally requires tools such as IDA and GDB.

2.3.

Dynamic binary instrumentation

Dynamic binary instrumentation (DBI)¹⁰ is one of the dynamic analysis techniques, which refers to the insertion of a specific analysis code during the execution of a program according to the user’s analysis requirements without affecting the dynamic execution results of the program to achieve the monitoring and analysis of the dynamic execution process of the program.

The key point of the dynamic binary instrumentation technique is the use of Hook, also known as hook function, the main principle is that the hook program can capture the message before the system calls the function, the hook function gets control first, then the hook function can both handle or change the execution behavior of the function, but also get information about the parameters of the function, and even force the end of the message delivery. At present, the widely used dynamic binary analysis platforms are Frida, Pin¹¹, DynamoRIO¹², and Valgrind¹³, among which Frida is a lightweight Hook framework that can run on Android, Linux, and Windows platforms, and the dynamic binary instrumentation of the Wangxin application in this paper mainly utilizes Frida.

4.1.

Wangxin data local storage

Different applications in Android have a specific file to store their application data, and the local storage path of the Wangxin application in Android is “/data/data/com.alibaba.moblileim”. The Wangxin app stores the user’s chat data in the “/data/data/com.alibaba.moblileim/database” folder, where the cipher data file is named “MD5(ID)-wx4”, as shown in Figure 2. MD5(ID) is the MD5 hash value, and the ID is the Wangxin user account, so if more than one Wangxin account has logged in before, there will be multiple files named “MD5(ID)-wx4” in the “database” folder.

Figure 2.

Wangxin application cipher data file.

4.2.

Encryption mechanism

By reverse analysis of the Wangxin application, the Wangxin database uses an encryption tool called “sqlcrypto” to encrypt the entire database file, making the resulting database a completely unreadable cipher file. An encrypted Wangxin database is shown in Figure 3, from which you can see that the file header is also encrypted.

Figure 3.

An encrypted Wangxin database file header.

By analyzing the “libdatabase_sqlcrypto.so” file of the Wangxin application, we can obtain the encryption mechanism of the Wangxin database.

Encryption mechanism: sqlcrypto specifically uses “sqlit3” related functions to encrypt the database file, where the encryption algorithm is AES, and the process of implementing this algorithm uses Electronic Codebook Book (ecb mode), and key of 128 bits length.

4.3.

Extracting the decryption key

Through detailed analysis, we can see that the key generation function is encapsulated in the dynamic library “libdatabase_sqlcrypto.so” by NDK, so it is impossible to get the key accurately by static analysis, so we need to use dynamic binary instrumentation technique to get the decryption key while the program is running. Therefore, we need to use the dynamic binary instrumentation technique to get the decryption key during the running of the program. The key extraction process is shown in Figure 4, and the steps are as follows.

Figure 4.

The decrypt key extraction process.

(1) Installed frida module in the cell phone and PC respectively, where the phone is installed server program, is through the injection process to achieve the hijacking of the application function, the PC side is mainly used for communication;

(2) Analysis to locate the need for binary staking functions: through analysis, “libdatabase_sqlcrypto.so” in the aes_encrypt_key128 () and aes_decrypt_key128 () function that is the Hook point; for the Hook point to write Frida scripts based on python and javascript for communication, where the python language is mainly sends the javascript code to the device, javascript code for the core code of the hook, including getting parameters and return values or modify the parameters and return values, etc.;

(3) In the cell phone side to run frida-server, and use adb to connect the phone to the PC side, and then execute the Wangxin application, at the same time need to run the python script file in the PC side, you can get the local database decryption key in the process of running the program.