Difference between pages "Various Methods to Disassemble DEX Files" and "Windows"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (Created page with "This how-to documents various methods and tools in disassembling DEX files for the Android OS. An example "Hello Android" APK file developed from the Android SDK example is ...")
 
(Introduced in Windows 8)
 
Line 1: Line 1:
This how-to documents various methods and tools in disassembling DEX files for the Android OS.  An example "Hello Android" [[APK]] file developed from the Android SDK example is used to demonstrate the various tools.  The various tools and methods are listed below in the subsections.
+
{{Expand}}
  
==Tools==
+
'''Windows''' is a widely-spread [[operating system]] from [[Microsoft]].
  
The HelloAndroid.apk package was decompressed using a standard zip-utility. The output from the zip utility produced the following files:
+
There are 2 main branches of Windows:
 +
* the DOS-branch: i.e. Windows 95, 98, ME
 +
* the NT-branch: i.e. Windows NT 4, XP, Vista
  
<pre>
+
== Features ==
$unzip HelloAndroid.apk
+
* Basic and Dynamic Disks, see: [http://msdn.microsoft.com/en-us/library/windows/desktop/aa363785(v=vs.85).aspx]
Archive: HelloAndroid.apk
+
  inflating: res/layout/main.xml
+
  inflating: AndroidManifest.xml
+
extracting: resources.arsc
+
extracting: res/drawable-hdpi/icon.png
+
extracting: res/drawable-ldpi/icon.png
+
extracting: res/drawable-mdpi/icon.png
+
  inflating: classes.dex
+
</pre>
+
  
The file of importance in analyzing the various methods of disassembly is 'classes.dex'.  The various tools listed below will use this file.
+
=== Introduced in Windows NT ===
 +
* [[NTFS]]
  
===dedexer===
+
=== Introduced in Windows 2000 ===  
  
A disassembler (available at http://dedexer.sourceforge.net/) to turn the DEX format into an "assembly-like format".  The format uses Jasmin like syntax and various Dalvik opcodes.  The command used to disassemble the classes.dex file is:
+
=== Introduced in Windows XP ===
 +
* [[Prefetch]]
 +
* System Restore (Restore Points); also present in Windows ME
  
<pre>
+
==== SP2 ====
$ java -jar ddx1.11.jar -d HelloAndroidOoutput classes.dex
+
* Windows Firewall
Processing com/example/helloandroid/HelloAndroid
+
Processing com/example/helloandroid/R$attr
+
Processing com/example/helloandroid/R$drawable
+
Processing com/example/helloandroid/R$layout
+
Processing com/example/helloandroid/R$string
+
Processing com/example/helloandroid/R
+
</pre>
+
  
The command produced several files, but the important file is located at com/example/helloandroid/HelloAndroid.  The disassembly listing for that file is below.
+
=== Introduced in Windows Server 2003 ===
 +
* Volume Shadow Copies
  
<pre>
+
=== Introduced in [[Windows Vista]] ===
$ cat com/example/helloandroid/HelloAndroid.ddx
+
* [[BitLocker Disk Encryption | BitLocker]]
.class public com/example/helloandroid/HelloAndroid
+
* [[Windows Desktop Search | Search]] integrated in operating system
.super android/app/Activity
+
* [[ReadyBoost]]
.source HelloAndroid.java
+
* [[SuperFetch]]
 +
* [[NTFS|Transactional NTFS (TxF)]]
 +
* [[Windows NT Registry File (REGF)|Transactional Registry (TxR)]]
 +
* [[Windows Shadow Volumes|Shadow Volumes]]; the volume-based storage of the Volume Shadow Copy data
 +
* $Recycle.Bin
 +
* [[Windows XML Event Log (EVTX)]]
 +
* [[User Account Control (UAC)]]
  
.method public <init>()V
+
=== Introduced in Windows Server 2008 ===
.limit registers 1
+
; this: v0 (Lcom/example/helloandroid/HelloAndroid;)
+
.line 7
+
        invoke-direct  {v0},android/app/Activity/<init>        ; <init>()V
+
        return-void
+
.end method
+
  
.method public onCreate(Landroid/os/Bundle;)V
+
=== Introduced in [[Windows 7]] ===
.limit registers 4
+
* [[BitLocker Disk Encryption | BitLocker To Go]]
; this: v2 (Lcom/example/helloandroid/HelloAndroid;)
+
* [[Jump Lists]]
; parameter[0] : v3 (Landroid/os/Bundle;)
+
* [[Sticky Notes]]
.line 11
+
        invoke-super    {v2,v3},android/app/Activity/onCreate  ; onCreate(Landroid/os/Bundle;)V
+
.line 12
+
        new-instance    v0,android/widget/TextView
+
        invoke-direct  {v0,v2},android/widget/TextView/<init>  ; <init>(Landroid/content/Context;)V
+
.line 13
+
        const-string    v1,"Hello, Android"
+
        invoke-virtual  {v0,v1},android/widget/TextView/setText ; setText(Ljava/lang/CharSequence;)V
+
.line 14
+
        invoke-virtual  {v2,v0},com/example/helloandroid/HelloAndroid/setContentView    ; setContentView(Landroid/view/View;)V
+
.line 15
+
        return-void
+
.end method
+
  
 +
=== Introduced in [[Windows 8]] ===
 +
* [[Windows File History | File History]]
 +
* [[Windows Storage Spaces | Storage Spaces]]
 +
* [[Search Charm History]]
 +
* [[Resilient File System (ReFS)]]; Was initially available in the Windows 8 server edition.
 +
 +
=== Introduced in Windows Server 2012 ===
 +
* [[Resilient File System (ReFS)]]
 +
 +
== Forensics ==
 +
 +
=== Partition layout ===
 +
Default partition layout, first partition starts:
 +
* at sector 63 in Windows 2000, XP, 2003
 +
* at sector 2048 in Windows Vista, 2008, 7
 +
 +
=== Filesystems ===
 +
* [[FAT]], [[FAT|exFAT]]
 +
* [[NTFS]]
 +
* [[Resilient File System (ReFS) | ReFS]]
 +
 +
=== Recycle Bin ===
 +
 +
==== RECYCLER ====
 +
Used by Windows 2000, XP.
 +
Uses INFO2 file.
 +
 +
See: [http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf]
 +
 +
==== $RECYCLE.BIN ====
 +
Used by Windows Vista.
 +
Uses $I and $R files.
 +
 +
See: [http://www.forensicfocus.com/downloads/forensic-analysis-vista-recycle-bin.pdf]
 +
 +
=== Registry ===
 +
 +
The [[Windows Registry]] is a database of keys and values that provides a wealth of information to forensic [[investigator]]s.
 +
 +
=== Thumbs.db Files ===
 +
 +
[[Thumbs.db]] files can be found on many Windows systems. They contain thumbnails of images or documents and can be of great value for the [[investigator]].
 +
 +
See also: [[Vista thumbcache]].
 +
 +
=== Browser Cache ===
 +
 +
=== Browser History ===
 +
 +
The [[Web Browser History]] files can contain significant information. The default [[Web browser|web browser]] that comes with Windows is [[Internet Explorer|Microsoft Internet Explorer]] but other common browsers on Windows are [[Apple Safari]], [[Google Chrome]], [[Mozilla Firefox]] and [[Opera]].
 +
 +
=== Search ===
 +
See [[Windows Desktop Search]]
 +
 +
=== Setup log files (setupapi.log) ===
 +
Windows Vista introduced several setup log files [http://support.microsoft.com/kb/927521].
 +
 +
=== Sleep/Hibernation ===
 +
 +
After (at least) Windows 7 recovers from sleep/hibernation there often is a system time change event (event id 1) in the event logs.
 +
 +
=== Users ===
 +
Windows stores a users Security identifiers (SIDs) under the following registry key:
 +
<pre>
 +
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
 
</pre>
 
</pre>
  
===baksmali===
+
The %SID%\ProfileImagePath value should also contain the username.
  
The baksmali disassembler (available at http://code.google.com/p/smali/) disassembles the DEX file into a format loosely based on the Jasmin's/dedexer's syntax. The command used in this analysis to generate the disassembly is:
+
=== Windows Error Reporting (WER) ===
  
 +
As of Vista, for User Access Control (UAC) elevated applications WER reports can be found in:
 
<pre>
 
<pre>
$ java -jar baksmali-1.2.4.jar classes.dex
+
C:\ProgramData\Microsoft\Windows\WER\
 
</pre>
 
</pre>
  
The command outputs several files and produces the /out/com/example/helloandroid directory structure, but the main file to investigate is HelloAndroid.smali. HelloAndroid.smali displays the Jasmin syntax and partial Dalvik opcodes as:
+
As of Vista, for non-UAC elevated applications (LUA) WER reports can be found in:
 +
<pre>
 +
C:\Users\%UserName%\AppData\Local\Microsoft\Windows\WER\
 +
</pre>
  
 +
Corresponding registry key:
 
<pre>
 
<pre>
.class public Lcom/example/helloandroid/HelloAndroid;
+
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting
.super Landroid/app/Activity;
+
</pre>
.source "HelloAndroid.java"
+
  
 +
== Advanced Format (4KB Sector) Hard Drives ==
 +
Windows XP does not natively handle drives that use the new standard of 4KB sectors. For information on this, see [[Advanced Format]].
  
# direct methods
+
== %SystemRoot% ==
.method public constructor <init>()V
+
The actual value of %SystemRoot% is store in the following registry value:
    .registers 1
+
<pre>
 +
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
 +
Value: SystemRoot
 +
</pre>
  
    .prologue
+
== See Also ==
    .line 7
+
* [[Windows Event Log (EVT)]]
    invoke-direct {p0}, Landroid/app/Activity;-><init>()V
+
* [[Windows XML Event Log (EVTX)]]
 +
* [[Windows Vista]]
 +
* [[Windows 7]]
 +
* [[Windows 8]]
  
    return-void
+
== External Links ==
.end method
+
  
 +
* [http://en.wikipedia.org/wiki/Microsoft_Windows Wikipedia: Microsoft Windows]
 +
* [http://support.microsoft.com/kb/927521 Windows 7, Windows Server 2008 R2, and Windows Vista setup log file locations]
 +
* [http://www.forensicfocus.com/downloads/forensic-analysis-vista-recycle-bin.pdf The Forensic Analysis of the Microsoft Windows Vista Recycle Bin], by [[Mitchell Machor]], 2008
 +
* [http://www.ericjhuber.com/2013/02/microsoft-file-system-tunneling.html?m=1 Microsoft Windows File System Tunneling], by [[Eric Huber]], February 24, 2013
 +
* [http://www.nsa.gov/ia/_files/app/Spotting_the_Adversary_with_Windows_Event_Log_Monitoring.pdf Spotting the Adversary with Windows Event Log Monitoring], by National Security Agency/Central Security Service, February 28, 2013
  
# virtual methods
+
=== Malware/Rootkits ===
.method public onCreate(Landroid/os/Bundle;)V
+
* [http://forensicmethods.com/inside-windows-rootkits Inside Windows Rootkits], by [[Chad Tilbury]], September 4, 2013
    .registers 4
+
    .parameter "savedInstanceState"
+
  
    .prologue
+
=== Tracking removable media ===
    .line 11
+
* [http://www.swiftforensics.com/2012/08/tracking-usb-first-insertion-in-event.html Tracking USB First insertion in Event logs], by Yogesh Khatri, August 18, 2012
    invoke-super {p0, p1}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V
+
  
    .line 12
+
=== Under the hood ===
    new-instance v0, Landroid/widget/TextView;
+
* [http://msdn.microsoft.com/en-us/library/windows/desktop/aa366533(v=vs.85).aspx MSDN: Comparing Memory Allocation Methods], by [[Microsoft]]
 +
* [http://blogs.msdn.com/b/ntdebugging/archive/2007/06/28/how-windows-starts-up-part-the-second.aspx How Windows Starts Up (Part the second)]
 +
* [http://msdn.microsoft.com/en-us/library/aa375142.aspx DLL/COM Redirection]
 +
* [http://msdn.microsoft.com/en-us/library/windows/desktop/ms682586(v=vs.85).aspx Dynamic-Link Library Search Order]
 +
* [http://blogs.msdn.com/b/junfeng/archive/2004/04/28/121871.aspx Image File Execution Options]
  
    invoke-direct {v0, p0}, Landroid/widget/TextView;-><init>(Landroid/content/Context;)V
+
==== MSI ====
 +
* [http://blogs.msdn.com/b/heaths/archive/2009/02/02/changes-to-package-caching-in-windows-installer-5-0.aspx?Redirected=true Changes to Package Caching in Windows Installer 5.0], by Heath Stewart, February 2, 2009
 +
* [http://blog.didierstevens.com/2013/07/26/msi-the-case-of-the-invalid-signature/ MSI: The Case Of The Invalid Signature], by Didier Stevens, July 26, 2013
  
    .line 13
+
==== Side-by-side (WinSxS) ====
    .local v0, tv:Landroid/widget/TextView;
+
* [http://en.wikipedia.org/wiki/Side-by-side_assembly Wikipedia: Side-by-side assembly]
    const-string v1, "Hello, Android"
+
* [http://msdn.microsoft.com/en-us/library/aa374224.aspx Assembly Searching Sequence]
 +
* [http://blogs.msdn.com/b/junfeng/archive/2007/06/26/rt-manifest-resource-and-isolation-aware-enabled.aspx RT_MANIFEST resource, and ISOLATION_AWARE_ENABLED]
 +
* [http://msdn.microsoft.com/en-us/library/windows/desktop/dd408052(v=vs.85).aspx Isolated Applications and Side-by-side Assemblies]
 +
* [http://blogs.msdn.com/b/junfeng/archive/2006/01/24/517221.aspx#531208 DotLocal (.local) Dll Redirection], by [[Junfeng Zhang]], January 24, 2006
 +
* [http://blogs.msdn.com/b/junfeng/archive/2006/04/14/576314.aspx Diagnosing SideBySide failures], by [[Junfeng Zhang]], April 14, 2006
 +
* [http://omnicognate.wordpress.com/2009/10/05/winsxs/ EVERYTHING YOU NEVER WANTED TO KNOW ABOUT WINSXS]
  
    invoke-virtual {v0, v1}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V
+
==== Application Compatibility Database ====
 +
* [http://technet.microsoft.com/en-us/library/dd837644(v=ws.10).aspx Technet: Understanding Shims], by [[Microsoft]]
 +
* [http://msdn.microsoft.com/en-us/library/bb432182(v=vs.85).aspx MSDN: Application Compatibility Database], by [[Microsoft]]
 +
* [http://www.alex-ionescu.com/?p=39 Secrets of the Application Compatilibity Database (SDB) – Part 1], by [[Alex Ionescu]], May 20, 2007
 +
* [http://www.alex-ionescu.com/?p=40 Secrets of the Application Compatilibity Database (SDB) – Part 2], by [[Alex Ionescu]], May 21, 2007
 +
* [http://fred.mandiant.com/Whitepaper_ShimCacheParser.pdf Leveraging the Application Compatibility Cache in Forensic Investigations], by [[Andrew Davis]], May 4, 2012
  
    .line 14
+
==== System Restore (Restore Points) ====
    invoke-virtual {p0, v0}, Lcom/example/helloandroid/HelloAndroid;->setContentView(Landroid/view/View;)V
+
* [http://en.wikipedia.org/wiki/System_Restore Wikipedia: System Restore]
 +
* [http://www.stevebunting.org/udpd4n6/forensics/restorepoints.htm Restore Point Forensics], by [[Steve Bunting]]
 +
* [http://windowsir.blogspot.ch/2007/06/restore-point-analysis.html Restore Point Analysis], by [[Harlan Carvey]], June 16, 2007
 +
* [http://windowsir.blogspot.ch/2006/10/restore-point-forensics.html Restore Point Forensics], by [[Harlan Carvey]], October 20, 2006
 +
* [http://www.ediscovery.co.nz/wip/srp.html System Restore Point Log Decoding]
  
    .line 15
+
==== Crash dumps ====
    return-void
+
* [http://blogs.technet.com/b/yongrhee/archive/2010/12/29/drwtsn32-on-windows-vista-windows-server-2008-windows-7-windows-server-2008-r2.aspx Technet: Drwtsn32 on Windows Vista/Windows Server 2008/Windows 7/Windows Server 2008 R2], by Yong Rhee, December 29, 2010
.end method
+
* [http://support.microsoft.com/kb/315263 MSDN: How to read the small memory dump file that is created by Windows if a crash occurs], by [[Microsoft]]
</pre>
+
  
===dex2jar===
+
==== RPC ====
 +
* [http://blogs.technet.com/b/networking/archive/2008/10/24/rpc-to-go-v-1.aspx RPC to Go v.1], by Michael Platts, October 24, 2008
 +
* [http://blogs.technet.com/b/networking/archive/2008/12/04/rpc-to-go-v-2.aspx RPC to Go v.2], by Michael Platts, December 4, 2008
  
An easier method for disassembling DEX files is to reproduce the Java files.  The procedure for performing this task is to take the Dalvik opcodes to the Java byte codes (JAR file).  The next step is to take a Java decompiler, which will produce several java files.  The two tools used in the section are dex2jar (available at http://code.google.com/p/dex2jar/) and a java decompiler of choice.  The steps performed to complete this transformation are:
+
==== WMI ====
# <pre>$ ./dex2jar.bat classes.dex</pre>
+
* [http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp__understanding-wmi-malware.pdf Understanding WMI Malware], by Julius Dizon, Lennard Galang, and Marvin Cruz, July 2010
# Load the produced JAR file from dex2jar into the java decompiler.
+
  
The main class produced from the decompilation process using dex2jar is listed below.
+
==== Windows Error Reporting (WER) ====
 +
* [http://blogs.technet.com/b/yongrhee/archive/2010/12/29/drwtsn32-on-windows-vista-windows-server-2008-windows-7-windows-server-2008-r2.aspx Drwtsn32 on Windows Vista/Windows Server 2008/Windows 7/Windows Server 2008 R2], by Yong Rhee, December 29, 2010
  
<pre>
+
==== Windows Firewall ====
package com.example.helloandroid;
+
* [http://en.wikipedia.org/wiki/Windows_Firewall Wikipedia: Windows Firewall]
 +
* [http://technet.microsoft.com/en-us/library/cc737845(v=ws.10).aspx#BKMK_log Windows Firewall Tools and Settings]
  
import android.app.Activity;
+
==== Windows 32-bit on Windows 64-bit (WoW64) ====
import android.os.Bundle;
+
* [http://en.wikipedia.org/wiki/WoW64 Wikipedia: WoW64]
import android.widget.TextView;
+
  
public class HelloAndroid extends Activity
+
=== Windows XP ===
{
+
* [http://support.microsoft.com/kb/q308549 Description of Windows XP System Information (Msinfo32.exe) Tool]
  public void onCreate(Bundle paramBundle)
+
  {
+
    super.onCreate(paramBundle);
+
    TextView localTextView = new TextView(this);
+
    localTextView.setText("Hello, Android");
+
    setContentView(localTextView);
+
  }
+
}
+
</pre>
+
  
[[Category:Howtos]]
+
[[Category:Operating systems]]

Revision as of 14:14, 25 November 2013

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Windows is a widely-spread operating system from Microsoft.

There are 2 main branches of Windows:

  • the DOS-branch: i.e. Windows 95, 98, ME
  • the NT-branch: i.e. Windows NT 4, XP, Vista

Features

  • Basic and Dynamic Disks, see: [1]

Introduced in Windows NT

Introduced in Windows 2000

Introduced in Windows XP

  • Prefetch
  • System Restore (Restore Points); also present in Windows ME

SP2

  • Windows Firewall

Introduced in Windows Server 2003

  • Volume Shadow Copies

Introduced in Windows Vista

Introduced in Windows Server 2008

Introduced in Windows 7

Introduced in Windows 8

Introduced in Windows Server 2012

Forensics

Partition layout

Default partition layout, first partition starts:

  • at sector 63 in Windows 2000, XP, 2003
  • at sector 2048 in Windows Vista, 2008, 7

Filesystems

Recycle Bin

RECYCLER

Used by Windows 2000, XP. Uses INFO2 file.

See: [2]

$RECYCLE.BIN

Used by Windows Vista. Uses $I and $R files.

See: [3]

Registry

The Windows Registry is a database of keys and values that provides a wealth of information to forensic investigators.

Thumbs.db Files

Thumbs.db files can be found on many Windows systems. They contain thumbnails of images or documents and can be of great value for the investigator.

See also: Vista thumbcache.

Browser Cache

Browser History

The Web Browser History files can contain significant information. The default web browser that comes with Windows is Microsoft Internet Explorer but other common browsers on Windows are Apple Safari, Google Chrome, Mozilla Firefox and Opera.

Search

See Windows Desktop Search

Setup log files (setupapi.log)

Windows Vista introduced several setup log files [4].

Sleep/Hibernation

After (at least) Windows 7 recovers from sleep/hibernation there often is a system time change event (event id 1) in the event logs.

Users

Windows stores a users Security identifiers (SIDs) under the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

The %SID%\ProfileImagePath value should also contain the username.

Windows Error Reporting (WER)

As of Vista, for User Access Control (UAC) elevated applications WER reports can be found in:

C:\ProgramData\Microsoft\Windows\WER\

As of Vista, for non-UAC elevated applications (LUA) WER reports can be found in:

C:\Users\%UserName%\AppData\Local\Microsoft\Windows\WER\

Corresponding registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting

Advanced Format (4KB Sector) Hard Drives

Windows XP does not natively handle drives that use the new standard of 4KB sectors. For information on this, see Advanced Format.

%SystemRoot%

The actual value of %SystemRoot% is store in the following registry value:

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Value: SystemRoot

See Also

External Links

Malware/Rootkits

Tracking removable media

Under the hood

MSI

Side-by-side (WinSxS)

Application Compatibility Database

System Restore (Restore Points)

Crash dumps

RPC

WMI

Windows Error Reporting (WER)

Windows Firewall

Windows 32-bit on Windows 64-bit (WoW64)

Windows XP