> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/notes-mcs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/notes-mcs/reverse-engineering/android-dynamic-analysis/dynamic-binary-instrumentation.md).

# Dynamic Binary Instrumentation

## Why?

* Requests to APIs are further encrypted or signed or MITM is not available.
  * MITM and packet sniffers are useless.
* Application has obfuscated values in RAM, created dynamically, and received from the network.
  * Static analysis and Decompilation are useless.
* Code is loaded dynamically with objects received.
  * Static analysis and Decompilation will have no code to analyze.
* Many values are hard coded (keys, urls…).
  * Patching takes too long and becomes expensive.

Custom Signatures are used.

```
POST /login HTTP/1.1
Host: social.io
Proxy-Connection: keep-alive
Content-Length: X
Accept: text/html, application/xhtml-
xml,application/xml;q=0.9,image/webp,*/*,q=0.8
Origin: http://social.io
Content-Type: application/x-www-form-urlencoded
Cookie: SessionId=O+qxnaYZLjpnLwHBcKmRcTexTWk=

username=john&password=xpto&signature=2rf+roJPEdCOSL0XXusHBcA0BGk=
```

Data is encrypted.

```
POST /login HTTP/1.1
Host: social.io
Proxy-Connection: keep-alive
Content-Length: X
Accept: text/html, application/xhtml-
xml,application/xml;q=0.9,image/webp,*/*,q=0.8
Origin: http://social.io
Content-Type: application/x-www-form-urlencoded
Cookie: SessionId=O+qxnaYZLjpnLwHBcKmRcTexTWk=

authData=3NH71S+7P8YeafgnBvXzJ1RzJdXm51VNPQYMWFiIMl8ZNr7+vGDNTcms8LHDUaC/lK2xRF/L
bPMwQ0pB+ZyB6PfYNaf5fIh/IGdlQZJrgXXgDDT7Mn2d259vzcdmBA3pJ04cLxGNnLSvdorYF+mLN7yik
zEagUWGfQe1nYzu3OT3947kqSORQuc4PTzuFKUXlolCcuVYvr5gt6ykfk9ACGVwyywGBG3OeFxNKi0kme
iBYxB8EJlmCF/xojM59gcGDv61ytidhVs=
```

## Other purposes

* Retrieving a call flow.
  * Map which methods are used, and what is the actual code execution flow.
* Identify arguments of Android API methods.
  * Log traffic and calls.
  * Allows intercepting data even with encrypted connections.
    * Interception happens before data is encrypted.
* Modify arguments of Android API methods.
  * Fuzzing.
  * Filter/modify data to trigger additional behaviour.
  * Trigger custom events.
* Circumvent protections to enable further analysis.
* The application is obfuscated and it is difficult to obtain the actual algorithm.