I have an android apk and I deleted my source code and dont have the project again, I want to change the version code of the old apk. my question is how do I unzip and repack the apk so I can use the. am using a mac system. I saw so many things for windows but i couldnt find for mac.I need help please

How to unzip, edit and zip an android apk

I want to be able to display a normal YouTube video with overlaid annotations, consisting of coloured rectangles for each frame. The only requirement is that this should be done programmatically. 

YouTube has annotations now, but require you to use their front end to create them by hand. I want to be able to generate them. What&#39;s the best way of doing this?

Some ideas:

&gt; 1. Build your own Flash player (ew?)
&gt; 2. Somehow draw over the YouTube Flash player. Will this work?
&gt; 3. Reverse engineer &amp; hijack YouTube&#39;s annotation system. Either messing with the local files or redirecting its attempt to download
&gt; the annotations. (using Greasemonkey? Firefox plugin?)

Idea that doesn&#39;t count: 

&gt; download the video



Annotating YouTube videos programmatically

I am using Charles Proxy to see all of the traffic that is coming out of my iphone. I have the ssl certificate/profile installed on my iphone and I can see a lot of the traffic that is ssl encrypted. However, some applications seem to not finish the ssl handshake. 

The error is: &quot;SSLHandshake: Remote host closed connection during handshake&quot; and then Charles Proxy suggests to configure the application to trust the Charles Root Certificate. I thought I did when I installed the profile onto my iphone?

Any explanation of this/way to fix it?

Why some iphone apps won&#39;t finish ssl handshake with Charles Proxy?

Are there any good programs out there to compare to compile .NET assemblies?  

For example I have HelloWorld.dll (1.0.0.0) and HelloWorld.dll (2.0.0.0), and I want to compare differences how can I do this?

I know I can use .NET Reflector and use the Assembly Diff plugin.  Are there any other good tools out there to do this?

Compare compiled .NET assemblies?

I wrote a C# application for a client a couple of years ago, but I no longer have the source code.  All I have is the EXE that I deployed on the client&#39;s PC.  Is there a way I can generate C# source code from the EXE?

How do I decompile a .NET EXE into readable C# source code?

Is there a good tool that can help to reverse engineer Java classes to UML that will show an overview of how my classes are related to each other? It doesn&#39;t need to decompile from JAR file because I have the sources. I know there are quite a few out there but most of those can only generate individual class. I hope there is a tool that can generate class diagram that shows an overview of how all my current classes and packages work together, so that I can analyse my current architecture design. Of course, analysing is one thing. The other is for documentation purposes. 

I know of a few so far. But they cannot do an overview class diagram. Here&#39;s a list of Java UML tool that I have tried and is capable of doing reverse engineer but cannot do an overview class diagram of my whole project:

- StarUML (Really good &lt;s&gt;Opensource&lt;/s&gt; UML tool but cannot generate not overview class diagram)
- ArgoUML (It is slow and sluggish and it keeps crashing)
- UModel (This is a commerical software. I used before some time ago but found it difficult to use)
- MS Visio (It doesn&#39;t support Java UML reverse engineer. Only for VB)

Are there any other recommendations to add to this list? And hopefully, can generate an overview Java class diagram. I am using Eclipse, by the way.

Generate UML Class Diagram from Java Project

I am developing a **payment processing app** for Android, and I want to prevent a hacker from accessing any resources, assets or source code from the [APK][1] file.

If someone changes the .apk extension to .zip then they can unzip it and easily access all the app&#39;s resources and assets, and using [dex2jar][2] and a Java decompiler, they can also access the source code. It&#39;s very easy to reverse engineer an Android APK file - for more details see Stack Overflow question *[Reverse engineering from an APK file to a project][3]*.

I have used the Proguard tool provided with the Android SDK. When I reverse engineer an APK file generated using a signed keystore and Proguard, I get obfuscated code. 

However, the names of Android components remain unchanged and some code, like key-values used in the app, remains unchanged. As per Proguard documentation the tool can&#39;t obfuscate components mentioned in the Manifest file.

Now my questions are:

 1. How can I **completely prevent** reverse engineering of an Android APK? Is this possible?
 2. How can I protect all the app&#39;s resources, assets and source code so that hackers can&#39;t hack the APK file in any way?
 3. **Is there a way to make hacking more tough or even impossible?** What more can I do to protect the source code in my APK file?

  [1]: http://en.wikipedia.org/wiki/APK_%28file_format%29
  [2]: http://code.google.com/p/dex2jar/wiki/Faq
  [3]: https://stackoverflow.com/questions/12732882/reverse-engineering-from-apk-to-project



How to avoid reverse engineering of an APK file

How can one decompile Android DEX (VM bytecode) files into corresponding Java sourcecode?

decompiling DEX into Java sourcecode

Quite often I come across a nice looking or functional website, and wonder what technology was used to create it. What techniques are available to figure out what a
particular website was built with?

Few frameworks seem to include any kind of generator meta tag like web editors do. Are there any tell-tale signs of particular languages and/or frameworks?

----------

***Summary of answers***

Site URLs may betray the framework and/or programming language but cannot be relied upon (e.g. file extensions such as .asp). HTTP response headers, cookies, stylesheets and source comments may also give clues.

Some nice tools for querying site details (no doubt there are many more):

  - [BuiltWith][1]
  - [DomainTools][2]
  - [NetCraft][3]
  - [W3Techs][4]
  - [SimilarTech][9]

Firefox addons:

  - [Wappalyzer][8] - CMS, frameworks/libraries, e-commerce, message boards etc.
  - [Domain Details][5] - IP, country and webserver details
  - [Library Detector][6] - Javascript libraries in use

Chrome Extensions:

  - [Wappalyzer][8]
  - [SimilarTech][10]
  - [PageXray][11]

Bookmarklets:

  - [WTFramework][7] - shows Javascript framework in use


  [1]: http://builtwith.com/
  [2]: http://www.domaintools.com/
  [3]: http://news.netcraft.com/
  [4]: http://w3techs.com/sites
  [5]: https://addons.mozilla.org/en-US/firefox/addon/2166
  [6]: https://addons.mozilla.org/en-US/firefox/addon/10083
  [7]: http://blog.olicio.us/2008/11/08/wtframework-bookmarklet/
  [8]: http://wappalyzer.com/
  [9]: http://www.similartech.com
  [10]: https://chrome.google.com/webstore/detail/similartech-site-technolo/jiabgmelnfhgjkfdaoiccfcbaedjfcnm
  [11]: https://chrome.google.com/webstore/detail/pagexray/aedmpdookgbneegaeajpoldpnpfbpmlb

How do you determine what technology a website is built on?

I&#39;d like to create my own iBeacon with some Bluetooth Low Energy dev kits. Apple has yet to release a specification for iBeacons, however, a few hardware developers have reverse Engineered the iBeacon from the AirLocate Sample code and started selling iBeacon dev kits. 

**So what is the iBeacon Bluetooth Profile?**

Bluetooth Low Energy uses GATT for LE profile service discovery. So I think we need to know the Attribute Handle, Attribute Type, Attribute Value, and maybe the Attribute Permissions of the iBeacon attribute. So for an iBeacon with a UUID of E2C56DB5-DFFB-48D2-B060-D0F5A71096E0, a major value of 1 and a minor value of 1 what would the Bluetooth GATT profile service be?

Here are some assumptions I&#39;ve made from the discussion on Apple&#39;s forums and through the docs.

1. You only need to see the profile service (GATT) of a Bluetooth peripheral to know it is an iBeacon.

2. The Major and Minor keys are encoded somewhere in this profile service


Heres some companies with iBeacon Dev Kits that seem to have this figure out already:

 - http://redbearlab.com/ibeacon/
 - http://kontakt.io/

  [1]: https://developer.apple.com/library/ios/documentation/NetworkingInternetWeb/Conceptual/CoreBluetooth_concepts/BestPracticesForSettingUpYourIOSDeviceAsAPeripheral/BestPracticesForSettingUpYourIOSDeviceAsAPeripheral.html

Hopefully, in time we will have a profile posted on Bluetooth.org like these: https://www.bluetooth.org/en-us/specification/adopted-specifications

What is the iBeacon Bluetooth Profile

I have a program in which I&#39;ve lost the C++ source code.  Are there any good C++ decompilers out there?

I&#39;ve already ran across [Boomerang][1].


  [1]: http://boomerang.sourceforge.net/

Is there a C++ decompiler?

Obfuscation is one way, but it can&#39;t protect from breaking the piracy protection security of the application. How do I make sure that the application is not tampered with, and how do I make sure that the registration mechanism can&#39;t be reverse engineered?

Also it is possible to convert a C# application to native code, and [Xenocode][1] is too costly.

C# provides lot of features, and is the ideal language for my code, so writing the whole codebase again in C++ is out of the question.

Secure certificates can be easily removed from the signed assemblies in .NET.

  [1]: http://en.wikipedia.org/wiki/Spoon_%28software%29


Protect .NET code from reverse engineering?

I was snooping through my MSP430 microcontroller&#39;s header files, and I ran into this in `&lt;setjmp.h&gt;`:

    /* r3 does not have to be saved */
    typedef struct
    {
    	uint32_t __j_pc; /* return address */
    	uint32_t __j_sp; /* r1 stack pointer */
    	uint32_t __j_sr; /* r2 status register */
    	uint32_t __j_r4;
    	uint32_t __j_r5;
    	uint32_t __j_r6;
    	uint32_t __j_r7;
    	uint32_t __j_r8;
    	uint32_t __j_r9;
    	uint32_t __j_r10;
    	uint32_t __j_r11;
    } jmp_buf[1]; /* size = 20 bytes */

I understand that it declares an anonymous struct and typedef&#39;s it to `jmp_buf`, but I can&#39;t figure out what the `[1]` is for. I know it declares `jmp_buf` to be an array with one member (of this anonymous struct), but I can&#39;t imagine what it&#39;s used for. Any ideas?

What&#39;s the purpose of this [1] at the end of struct declaration?

I&#39;m trying to learn about reverse engineering, using Minesweeper as a sample application.  I&#39;ve found this [MSDN article][1] on a simple WinDbg command that reveals all the mines but it is old, is not explained in any detail and really isn&#39;t what I&#39;m looking for.

I have [IDA Pro disassembler][2] and the [WinDbg debugger][3] and I&#39;ve loaded winmine.exe into both of them.  Can someone provide some practical tips for either of these programs in terms of finding the location of the data structure that represents the mine field?

In WinDbg I can set breakpoints, but it is difficult for me to imagine at what point to set a breakpoint and at what memory location.  Similarly, when I view the static code in IDA Pro, I&#39;m not sure where to even begin to find the function or data structure that represents the mine field.

Are there any Reverse Engineers on Stackoverflow that can point me in the right direction?


  [1]: http://blogs.msdn.com/debuggingtoolbox/archive/2007/03/28/windbg-script-playing-with-minesweeper.aspx
  [2]: http://www.hex-rays.com/idapro/
  [3]: http://www.microsoft.com/whdc/devtools/debugging/installx86.Mspx

How can I find the data structure that represents mine layout of Minesweeper in memory?

There have been a few articles recently about Google&#39;s new imageless buttons:

- http://stopdesign.com/archive/2009/02/04/recreating-the-button.html
- http://stopdesign.com/eg/buttons/3.0/code.html
- http://stopdesign.com/eg/buttons/3.1/code.html
- http://gmailblog.blogspot.com/2009/02/new-ways-to-label-with-move-to-and-auto.html

I really like how these new buttons work in Gmail.  How can I use these or similar buttons on my site?  Are there any open source projects with a similar look &amp; feel?

If I wanted to roll my own button package like this using JQuery/XHTML/CSS, what elements could I use?  My initial thoughts are:

1. Standard `&lt;input type=&quot;button&quot;&gt;` with css to improve the look (the design article talked mostly about the css/imges involves.)

2. Jquery javascript to bring up a custom dialog rooted to the button on the &quot;onclick&quot; event which would have `&lt;a&gt;` tags in them and a search bar for filtering?  Would a table layout for that popup be sane?


I&#39;m terrible at reverse engineering things on the web, what are some of the tools that I could use to help reverse engineer these buttons?  Using Firefox&#39;s web developer toolbar I can&#39;t really see the css or javascript (even if it is minified) that is used on the buttons popup dialogs.  What browser tool or other method could I use to peek at them and get some ideas?

I&#39;m not looking to steal any of Google&#39;s IP, just get an idea of how I could create similar button functionality.

Google&#39;s Imageless Buttons

How can I generate UML diagrams (especially sequence diagrams) from existing Java code?

How to generate UML diagrams (especially sequence diagrams) from Java code?

Java `.class` files can be decompiled fairly easily. How can I protect my database if I have to use the login data in the code?

How can I protect MySQL username and password from decompiling?

Most app developers will integrate some third party libraries into their apps. If it&#39;s to access a service, such as Dropbox or YouTube, or for logging crashes. The number of third party libraries and services is staggering. Most of those libraries and services are integrated by somehow authenticating with the service, most of the time, this happens through an API key. For security purposes, services usually generate a public and private, often also referred to as secret, key. Unfortunately, in order to connect to the services, this private key must be used to authenticate and hence, probably be part of the application. 
Needless to say, that this faces in immense security problem. Public and private API keys can be extracted from APKs in a matter of minutes and can easily be automated. 

Assuming I have something similar to this, how can I protect the secret key:


    public class DropboxService  {
    
    	private final static String APP_KEY = &quot;jk433g34hg3&quot;;
    	private final static String APP_SECRET = &quot;987dwdqwdqw90&quot;;
    	private final static AccessType ACCESS_TYPE = AccessType.DROPBOX;
    
    	// SOME MORE CODE HERE
    	
    }

What is in your opinion the best and most secure way to store the private key? Obfuscation, encryption, what do you think?

Best practice for storing and protecting private API keys in applications

**What tools are available to aid in decoding unknown binary data formats?**

I know Hex Workshop and 010 Editor both support structures. These are okay to a limited extent for a known fixed format but get difficult to use with anything more complicated, especially for unknown formats. I guess I&#39;m looking at a module for a scripting language or a scriptable GUI tool.

For example, I&#39;d like to be able to find a structure within a block of data from limited known information, perhaps a magic number. Once I&#39;ve found a structure, then follow known length and offset words to find other structures. Then repeat this recursively and iteratively where it makes sense.

In my dreams, perhaps even automatically identify possible offsets and lengths based on what I&#39;ve already told the system!

Tools to help reverse engineer binary file formats

I recently bought chinesse device that connects via bluetooth with android phone / tablet. Since there is no application availible for windows / linux I want to create one for personal usage.

Usually phone connects to the device and exchanges some data. I connected PC to the device and looked into serial debugger and menaged to discover the protocol (one way only). Phone sends only one command to the device. But this time I&#39;m not able to find out what it containts. 

Is there any software that will allow me to look into data sent via bluetooth? I tried decompiling the app, but it looks really unfriendly.

Thanks.



Sniffing/logging your own Android Bluetooth traffic

After loading an executable into gdb, how do I break at the entry point, before the first instruction is executed?

The executable I&#39;m analyzing is a piece of malware that&#39;s encrypted so `break main` does absolutely nothing.

Stopping at the first machine code instruction in GDB

How do I get a list of all index &amp; index columns in SQL Server 2005+? The closest I could get is:

    select s.name, t.name, i.name, c.name from sys.tables t
	inner join sys.schemas s on t.schema_id = s.schema_id
	inner join sys.indexes i on i.object_id = t.object_id
	inner join sys.index_columns ic on ic.object_id = t.object_id
	inner join sys.columns c on c.object_id = t.object_id and
			ic.column_id = c.column_id

    where i.index_id &gt; 0	
	 and i.type in (1, 2) -- clustered &amp; nonclustered only
	 and i.is_primary_key = 0 -- do not include PK indexes
	 and i.is_unique_constraint = 0 -- do not include UQ
	 and i.is_disabled = 0
	 and i.is_hypothetical = 0
	 and ic.key_ordinal &gt; 0

    order by ic.key_ordinal

Which is not exactly what I want.  
What I want is, to list all user-defined indexes, (*which means no indexes which support unique constraints &amp; primary keys*) with all columns (ordered by how do they appear in index definition) plus as much metadata as possible.

List of all index &amp; index columns in SQL Server DB

As we know, Android apps are written in Java. In Java, no matter [what you do][1], it is impossible to protect compiled code from decompilation or reverse-engineering, as the Stack Overflow question *[How to lock compiled Java classes to prevent decompilation?][2]* suggests.

How would one go about protecting an app that contains algorithmic trade secrets from reverse-engineering?

By &quot;how&quot; I mean not only software techniques, but also other **creative** approaches.

  [1]: http://www.galkonline.com/2010/09/15/how-to-prevent-java-from-being-decompiled/
  [2]: https://stackoverflow.com/questions/49379/how-to-lock-compiled-java-classes-to-prevent-decompilation


Is it really impossible to protect Android apps from reverse engineering?

For CakePHP application, I created MySQL database. 

Which tool to be used to create ER Diagram of database? Fields and relations between tables are created in a way cakePHP likes.


thank you in advance!

All Reverse Engineering Solutions on Gang of Coders

Total of 24 Reverse Engineering Solutions