• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Hacking concerns, help appreciated

M

MachineHead11

Lurker
Hi, this is my first post in this forum so be gentle if I'm being an idiot.

First off I know nothing about scripting or coding and I
have a few concerns about certain files on my phone.
Using ES File Explorer I can get as deep as a folder which is simply /. In this folder is on called system, and within that one called app. Here I have a list of all the apps on my phone, most of which have a corresponding .odex file.
I don't know if these are necessary and when I open them most of it appears jargon to me, but further down it is written in English.
I have attached a .txt file in this post for the.odex which relates to my PhoneSetupWizard.

I would be very grateful if someone with a knowledge of coding/scripting etc to have a brief look at it to see if it appears normal.

Thanks for your time
 

Attachments

does this help answer your question? (Quite informative to me, idk...)
What Is Odex And Deodex In Android [Complete Guide]

type "what is odex file in android" (Without the quotes of coarse) into google or something, here is an automated link for more search results:
Let me google that for you

PS: The link for the automated search is humerus and is all in good fun (Its an automatic Google search), its ok if you ask a question, I'm new here and an armature/descent programmer for micro-controllers, I'm new to android, I would not have known this either...lol

Hope this helps! :)
 
zBusterCB87 said:
does this help answer your question? (Quite informative to me, idk...)
What Is Odex And Deodex In Android [Complete Guide]

type "what is odex file in android" (Without the quotes of coarse) into google or something, here is an automated link for more search results:
Let me google that for you

PS: The link for the automated search is humerus and is all in good fun (Its an automatic Google search), its ok if you ask a question, I'm new here and an armature/descent programmer for micro-controllers, I'm new to android, I would not have known this either...lol

Hope this helps! :)
Click to expand...

I can't believe you pulled a lmgtfu, you cheeky. ......Buuuut, despite you're mis-placed sense smugness, you didn't actually answer my question, although I genuienly appreiciate the links.
Despite my lack of technical knowledge about what an. Odex file is, it was fairly clear they go hand in hand with the. Apk files.
My query was to whether or not the specific odex file I uploaded looked dodgy in any way i.e someone messing with code so it doesn't work the way it's supposed to, comprhende
Amigo.

I also have Elixer installed and it tellls me that my bootloader is unknown.

Thanks for the reply
 
That file was located in the root of the phone's system tree? Or was it actually in /system/app?

Are you rooted? If no, then there's nothing to be concerned about. If you want to make sure some malware didn't hijack your phone, you can install Root Checker: https://market.android.com/details?id=com.joeykrim.rootcheck If it says you're not rooted, then you're safe.

And, as always, make sure to read the following to help mitigate the chances of getting malware: http://androidforums.com/android-ap...ps-avoid-viruses-guide-those-new-android.html

If yes, you still likely have nothing to worry about. Every Android device has a setup wizard of some sort of another. The odex file is just there to support the APK.
 
Alright bud,

jerofld said:
That file was located in the root of the phone's system tree? Or was it actually in /system/app?
Click to expand...

Yeh, /system/app.

What do you make of the script?



jerofld said:
Are you rooted? If no, then there's nothing to be concerned about. If you want to make sure some malware didn't hijack your phone, you can install Root Checker: https://market.android.com/details?id=com.joeykrim.rootcheck If it says you're not rooted, then you're safe.

And, as always, make sure to read the following to help mitigate the chances of getting malware: http://androidforums.com/android-ap...ps-avoid-viruses-guide-those-new-android.html

If yes, you still likely have nothing to worry about. Every Android device has a setup wizard of some sort of another. The odex file is just there to support the APK.
Click to expand...

Thanks for the advice, much appreciated.
As far as I'm aware my phone isn't routed, but the fact that Ellxir tells me my bootloader is unknown makes me wonder.

Thanks for your time


*edit* About the set up wizard, when I try to launch it, I'm being told for security reasons I can't because it was not obtained from the android market?
 
Is this a used phone? If so it might be possible the previous owner touched something...
I would recommend reviewing every application you ever downloaded and installed to make sure...
Ellxir has compatibility with your phone, right?
If you know someone who is willing to lets you borrow their same phone as yours, you might be able to cross reference the Ellxer app?
If you can, a factory restore might do some help...idk
It depends on how the factory recovery recovers...

EDIT: I GOT IT!
Get someone with a phone like yours or borrow one somehow and gind this file on another device, linux based something (I forget what it is, been a while since i used it) can look at both files and compare differences in the text... idk if notepad++ does this, i never used it much...

ALSO:
I found a script someone made for decoding this, i think...helping? :)
http://www.lfarkas.org/linux/android/tools/decode-rom

Here is a post I found about it:
http://www.pinoyhaven.com/m/index.php/t1936.html

This link talks about decoding ROMs, but includes information about *.odex files:
http://forum.androidspin.com/archive/index.php/t-1620.html

This is what I searched: "decode *.odex"
(without the quotes)

I did not read these to extensively, but it might work if you want to try them out...

ADDED:
This deals with decompiling and recompiling odex files, I think:
http://wiki.sdx-developers.com/index.php/How_to_deodex_a_ROM
If someone here knows how to use linux better than I do, you might be able to take the decoded/de-compiled part when it decodes and dump it to a text file... idk I seen people do something like this in linux before...

Also their seem to be some odex and dex compilers online, someone was trying to de-compile to java source, and people were redirecting them to some other method... That might help you out...

HONESTLY: All I can say to this is good luck!!! I'm confuzzled... :S

I'm a programmer for imbedded robotics and micro-controllers, its been a long while since I messed with computers files with converting and changing things, I've been looking into androids because I just got my first android device about 2 weeks ago i think it was...

If I remember correctly, I think windows might have had this format somewhere at some point, I was using windows XP/vista then... They were somewhere in some linux based things I ran in windows, compiler or something...idk I cant remember...
 
zBusterCB87 said:
Is this a used phone? If so it might be possible the previous owner touched something...
I would recommend reviewing every application you ever downloaded and installed to make sure...
Click to expand...

Nah it was a new phone, and i'm pretty sure i havn't downloaded any dodgy apps.
I think this may have been set up by someone i know who has borrowed my phone....



buster said:
Ellxir has compatibility with your phone, right?
If you know someone who is willing to lets you borrow their same phone as yours, you might be able to cross reference the Ellxer app?
Click to expand...

Not an option but i might make a seperate post in the samsung forum regarding this, good idea.
buster said:
If you can, a factory restore might do some help...idk
It depends on how the factory recovery recovers...
Click to expand...


Factory restore makes no difference....
buster said:
DIT: I GOT IT!g
Get someone with a phone like yours or borrow one somehow and gind this file on another device, linux based something (I forjget what it is, been a while since i used it) can look at both files and compare differences in the text... idk if notepad++ does this, i never used it much...
Click to expand...

My only option is finding someone on a forum to help as I don't know anyone with the same phone as me....

buster said:
ALSO:
I found a script someone made for decoding this, i think...helping? :)
http://www.lfarkas.org/linux/android/tools/decode-rom

Here is a post I found about it:
Pinoy Haven - Ang Bagong Tambayan ng Pinoy! > HOW TO: deodex an .odex file

This link talks about decoding ROMs, but includes information about *.odex files:
[ADVANCED] Howto decode and compare roms [Archive] - AndroidSPIN Forums

This is what I searched: "decode *.odex"
(without the quotes)

I did not read these to extensively, but it might work if you want to try them out...

ADDED:
This deals with decompiling and recompiling odex files, I think:
How to deodex a ROM - SDX-Developers
If someone here knows how to use linux better than I do, you might be able to take the decoded/de-compiled part when it decodes and dump it to a text file... idk I seen people do something like this in linux before...
Click to expand...

Thanks for that info, I'll delve into it.

buster said:
Also their seem to be some odex and dex compilers online, someone was trying to de-compile to java source, and people were redirecting them to some other method... That might help you out...
Click to expand...

Could you elaborate any more do you think?

Your help and advice has been much appreciated, thanks man!
 
/system/app is the app folder of your entire android .

Without root permissions or rooted recovery it cant be penetrated .

.odex is the dex file or the "dalvik cache". Normal apps have it in /data/dalvik-cache/data@xyz.apk@classes.dex

When you use deodex ROM ,the same .odex file (which used to be present in /system) is present in /data/dalvik-cache/system@xyz.apk@classes.dex

All in all .odex or .dex are the java classes files .
odex is faster to boot and deodex can be modified easily .However they are same stuff .

You cant use Notepad to open .dex file .You will get bunch of symbols from planet Oozaru

You need baksmali plus java installed

Code: 
java -jar baksmali.jar -o output-directory blah.odex

That will give you a dozens if not hundreds of classes .
They will needed to be studied and analysed and then be proved that your phone is safe .It will also cost you money since you will need to hire a professional forensic analyst to do it

The easy way is check the dates of all apps in /system .If the .odex and apk are mismatch ,the .odex was recompiled . Usually all apps and .odexes have one date only .(except carrier/rom modified ones )

If not then go out and eat ice cream pref . vanilla with chocolate chips

Edit :You need setup wizard only once .After you do a factory reset or after you flash Gapps on AOSP ROM .(Remember you pressed next next next quickly to boot in your device) .The chances of someone "corrupting" it is zilch .
 
You must log in or register to reply here.
Back
Top Bottom