Android malware reversing : constant values

Question

I was trying to reverse engineer an Android Malware sample and I find the following sample when decompiling the jar file I obtained by running dex2jar.

  if (i >= paramBundle.length())
  {
    ((TextView)findViewById(2131034112)).setText(((StringBuilder)localObject).toString());
    return;
  }

How can I find the string that 2131034112 refers to?

score 3 · Answer 1 · answered Jul 20 '15 at 02:59

The jar file produced by dextojar should include a class named R, which contains subclasses with resource id definitions:

public final class R {
...
    public static final class list {
        public static final int filename=0x7f050001;
        public static final int type=0x7f050000;
    }
...
}

The (sub)class name, and variable names, correspond to the ids from the resource definitions in the apk file (res/layout/*.xml). In the above example, the R.java was autogenerated from these entries in res/layout/main.xml:

 <TextView
   android:id="@+list/type"
   android:layout_width="20dip"
   android:layout_height="20dip"
   android:textSize="16sp"
    />
 <TextView
   android:id="@+list/filename"
   android:layout_width="0dp"    android:layout_weight="1"
   android:layout_height="wrap_content"
   android:textSize="16sp"
    />

So, since 2131034112 equals 0x7F050000, with my R.java and main.xml, your code would set the @+list/type textview content.

Android malware reversing : constant values

1 Answers1