{"action":"created","issue":{"url":"https://api.github.com/repos/radare/radare2/issues/5773","repository_url":"https://api.github.com/repos/radare/radare2","labels_url":"https://api.github.com/repos/radare/radare2/issues/5773/labels{/name}","comments_url":"https://api.github.com/repos/radare/radare2/issues/5773/comments","events_url":"https://api.github.com/repos/radare/radare2/issues/5773/events","html_url":"https://github.com/radare/radare2/issues/5773","id":177142055,"number":5773,"title":"Enhance support of Dalvik :)","user":{"login":"cryptax","id":2493690,"avatar_url":"https://avatars.githubusercontent.com/u/2493690?v=3","gravatar_id":"","url":"https://api.github.com/users/cryptax","html_url":"https://github.com/cryptax","followers_url":"https://api.github.com/users/cryptax/followers","following_url":"https://api.github.com/users/cryptax/following{/other_user}","gists_url":"https://api.github.com/users/cryptax/gists{/gist_id}","starred_url":"https://api.github.com/users/cryptax/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cryptax/subscriptions","organizations_url":"https://api.github.com/users/cryptax/orgs","repos_url":"https://api.github.com/users/cryptax/repos","events_url":"https://api.github.com/users/cryptax/events{/privacy}","received_events_url":"https://api.github.com/users/cryptax/received_events","type":"User","site_admin":false},"labels":[{"id":326500320,"url":"https://api.github.com/repos/radare/radare2/labels/android","name":"android","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2016-09-15T10:31:08Z","updated_at":"2017-01-24T22:46:03Z","closed_at":null,"body":"I am using _today's git (Sept 15)_.\n\nPlease get classes.dex from _[https://my.owndrive.com/index.php/s/uTrGVCtBh0ko09i](https://my.owndrive.com/index.php/s/uTrGVCtBh0ko09i)_ (it is taken from Android/Crosate malware, please beware ;) I do not believe this DEX is particularly advanced or tricky.\nRename the sample to classes.dex for instance.\n\n**Cross references for the string** controlcenter.com/teapotxxx is not showing:\n\n```\n$ r2 classes.dex\n0x0001deb8]> aa\n[x] Analyze all flags starting with sym. and entry0 (aa)\n[0x0001deb8]> f~http\n...\n0x00064fef 49 str.http:__verisign_controlcenter.com_teapot_gate.php\n..\n[0x0001deb8]> pd 1 @ str.http:__verisign_controlcenter.com_teapot_gate.php\n            ;-- str.http:__verisign_controlcenter.com_teapot_gate.php:\n            0x00064fef     .string \"http://verisign-controlcenter.com/teapot/gate.php\" ; len=49 ; compare long\n```\n\nActually, it is used here 0x00030d20, which is contained within the method: Lcom/adobe/flashplayer_/AFC.method.onCreate()V.\n\nNote that **axt** does not provide the xref either:\n\n```\naxt str.http:__verisign_controlcenter.com_teapot_gate.php\n[0x0001dfb8]> \n```\n\nThe method Lcom/adobe/flashplayer_/AFC.method.onCreate()V does not list with **afl**, though it does with **ic**. That's strange too.\n\n```\n> afl~Lcom_adobe_flashplayer__AFC\n0x00030b50    1 12           sym.Lcom_adobe_flashplayer__AFC_1.method._init__Lcom_adobe_flashplayer__AFC_JJ_V\n0x00030bc0    1 8            sym.Lcom_adobe_flashplayer__AFC.method._init___V\n0x00030bd8    1 34           sym.Lcom_adobe_flashplayer__AFC.method.writeConfig_Ljava_lang_String_Ljava_lang_String__V\n> ic~Lcom/adobe/flashplayer_/AFC\n0x00011ed4 class 232 Lcom/adobe/flashplayer_/AFC$1\n0x00030b50 method 0 Lcom/adobe/flashplayer_/AFC$1.method.<init>(Lcom/adobe/flashplayer_/AFC;JJ)V\n0x00030b5c method 1 Lcom/adobe/flashplayer_/AFC$1.method.onFinish()V\n0x00030b78 method 2 Lcom/adobe/flashplayer_/AFC$1.method.onTick(J)V\n0x00011ed5 class 233 Lcom/adobe/flashplayer_/AFC\n0x00030bc0 method 0 Lcom/adobe/flashplayer_/AFC.method.<init>()V\n0x00030bd8 method 1 Lcom/adobe/flashplayer_/AFC.method.writeConfig(Ljava/lang/String;Ljava/lang/String;)V\n0x00030c10 method 2 Lcom/adobe/flashplayer_/AFC.method.decrypt(Ljava/lang/String;I)Ljava/lang/String;\n0x00030c7c method 3 Lcom/adobe/flashplayer_/AFC.method.onBind(Landroid/content/Intent;)Landroid/os/IBinder;\n0x00030c90 method 4 Lcom/adobe/flashplayer_/AFC.method.onCreate()V\n0x00030e18 method 5 Lcom/adobe/flashplayer_/AFC.method.onDestroy()V\n```\n\nWeird too, the **method does not disassemble correctly**. The first commands of the method are:\n\n``` java\nObject v20 = this.getSystemService(\"phone\");\nString v18 = this.getSystemService(\"phone\").getLine1Number();\n```\n\nbut if we disassemble with r2, we see _strange calls_ (see invoke-..) and _no mention of getSystemService or getLine1Number_ (which are implemented by the Android system):\n\n```\npd 10 @ 0x00030c90\n            ;-- Lcom/adobe/flashplayer_/AFC.method.onCreate()V:\n            ;-- method.Lcom_adobe_flashplayer__AFC.Lcom_adobe_flashplayer__AFC.method.onCreate__V:\n            0x00030c90      16000100       const-wide/16 v0, 0x01      ; move literal into the specified register-pair\n            0x00030c94      06000000171a   move-wide/16 v0, v6679      ; move the contents of one register-pair to another\n            0x00030c9a      0700           move-object v0, v0          ; move the contents of one object-bearing register to anothe\n            0x00030c9c      bc00           sub-long/2addr v0, v0       ; subtraction\n            0x00030c9e      0000           nop                         ; no operation\n            0x00030ca0      750169001500   invoke-super/range {v21..v21}, 0x0 ; call method; CALL: 0x353330, 0x28f04aa6, 0x5b4d71a, 0x3fb920c4\n            0x00030ca6      1a02da0f       const-string v2, str.phone  ; str.phone ; move a reference to the string specified by the given index into the specified register\n            0x00030caa      08001500       move-object/from16 v0, v21  ; move the contents of one object-bearing register to anothe\n            0x00030cae      6e20b00d2000   invoke-virtual {v0, v2}, 0x0 ; 0xdb0 ; call method; CALL: 0x353330, 0x28f04aa6, 0x5b4d71a, 0x3fb920c4\n            0x00030cb4      0c14           move-result-object v20      ; move the object result of the most recent invoke-kind into the indicated registe\n```\n\nIf we try and do it the other way round and _search for the string getLine1Number_, we are _unable to see where it is used._ (well, I am not).\n\n```\n> f~getLine1Number\n0x00064444 14 str.getLine1Number\n[0x0001dfb8]> pd 1 @ str.getLine1Number\n            ;-- str.getLine1Number:\n            0x00064444     .string \"getLine1Number\" ; len=14           ; return from a void method\n```\n\nWe do see the function in the **imports** (which is good), but how do I know where this is used?\n\n```\n[0x0001dfb8]> ii~getLine\nordinal=000 plt=0x00000000 bind=NONE type=FUNC name=imp.Landroid/telephony/TelephonyManager.method.getLine1Number()Ljava/lang/String;\n```\n\nWe see **getLine1Number** in the **strings** as well, but it points to the address of the string, so we won't know who's using it:\n\n```\n[0x0001dfb8]> iz~getLine\nvaddr=0x00064444 paddr=0x00064444 ordinal=2847 sz=14 len=14 section=data type=ascii string=getLine1Number\n[0x0001dfb8]> pd 1 @ 0x00064444\n            ;-- str.getLine1Number:\n            0x00064444     .string \"getLine1Number\" ; len=14           ; return from a void method\n```\n\nFinally, the **entrypoint** in a Dalvik is shown in the Android manifest. In this case, it is _Lcom/adobe/flashplayer_/FA_. I don't know if you can manage to get that, but the command **ie** not does point to that.\n\n```\nie\n[Entrypoints]\nvaddr=0x0001deb8 paddr=0x0001deb8 baddr=0x00000000 laddr=0x00000000 type=program\n\n1 entrypoints\n```\n"},"comment":{"url":"https://api.github.com/repos/radare/radare2/issues/comments/274964054","html_url":"https://github.com/radare/radare2/issues/5773#issuecomment-274964054","issue_url":"https://api.github.com/repos/radare/radare2/issues/5773","id":274964054,"user":{"login":"h4ng3r","id":2039733,"avatar_url":"https://avatars.githubusercontent.com/u/2039733?v=3","gravatar_id":"","url":"https://api.github.com/users/h4ng3r","html_url":"https://github.com/h4ng3r","followers_url":"https://api.github.com/users/h4ng3r/followers","following_url":"https://api.github.com/users/h4ng3r/following{/other_user}","gists_url":"https://api.github.com/users/h4ng3r/gists{/gist_id}","starred_url":"https://api.github.com/users/h4ng3r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h4ng3r/subscriptions","organizations_url":"https://api.github.com/users/h4ng3r/orgs","repos_url":"https://api.github.com/users/h4ng3r/repos","events_url":"https://api.github.com/users/h4ng3r/events{/privacy}","received_events_url":"https://api.github.com/users/h4ng3r/received_events","type":"User","site_admin":false},"created_at":"2017-01-24T22:46:03Z","updated_at":"2017-01-24T22:46:03Z","body":"@cryptax, can we close the issue? Thanks\r\n"}}
{"actor":{"display_login":"h4ng3r"}}