3

I've extracted an apk(react native) with dex2jar and jar to java through jd-qui and also with apktool, and I can view the source code but there is no clue where are the HTTP requests in the source code.

When I intercept the apk traffic I can see all the requests to graphql endoint but I cannot see in the source code, where they are triggered or stored.

I searched the extracted source code with some keywords such as grahpql endpoint name, and the server address but still no result.

And the code seems not obfuscated to me, just some parts are like;

@Metadata(d1 = {"\000\026\n\002\030\002\n\002\020\000\n\000\n\002\020\002\n\000\n\002\030\002\n\000\bf\030\0002\0020\001J\020\020\002\032\0020\0032\006\020\004\032\0020\005H&\006\006"}, d2 = {"Lcom/shopify/arrive/E2EModule;", "", "launch", "", "intent", "Landroid/content/Intent;", "app_release"}, k = 1, mv = {1, 7, 1}, xi = 48)
public interface E2EModule {
  void launch(Intent paramIntent);
}

Is there any way to reach where these requests are triggered or stored on the source code?

This is the apk name, com.shopify.arrive

4
  • As far as I know React native does not create DEX code, so most likely you won't find what you are searching by decompiling the DEX code no matter what tool you use.
    – Robert
    Dec 15, 2022 at 15:14
  • Hi @Robert thanks for the reply, when I decompile the dex files they crated react native libraries in it, that's why I assume, it may not be react native too, but any idea to find http requests in source code? Dec 15, 2022 at 15:34
  • Cross-posted to ReverseEngineering.SE: reverseengineering.stackexchange.com/q/31278/16786
    – Andrew T.
    Dec 16, 2022 at 3:52
  • If you can run the APK I would start with a dynamic analysis, e.g. use a man-in-the-middle proxy or simply use a DNS server where you can see all requests, then you get a list of servers. That ilist s a good starting point to search for the names in the APK, binary search or in decompiled code. Otherwise without knowing anything it will take you ages or pure luck to find where the request is created you are searching.
    – Robert
    Dec 16, 2022 at 16:14

1 Answer 1

3

There are many ways you can try

First option is to Reverse engineer code into dex and decompile using any tool like fernflower or CFR. Then apply regex extract script to pull all the http links. Reference of code

Second option is to use pre-build tool like MobSF Automated tool which is used to extract http urls

Another possibility is that the developer of app has hide the urls/link in the splitted way or has encrypted it, in that case you can do dynamic analysis to fetch the urls along with the file from which url is being called.

Another possibility is that developer has hidden it in the binary usually written in C using JNI Java Native Interfaces. You can use tool like IDA or Ghidra to disassemble code to have sneak into it.Here is tool

There are some other ways too which can be explored if these doesn't work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .