Personal Success

I feel there is no such thing as “success” instead it is “personal success”.

Very often people don’t treat “success” as “personal success”. By this I mean they compare their own success to others.

Each person runs their own race of life. He has his own value system.

Success has varied number of factors and whatever impact these factors is going to have on the success of a person is going to be limited to the person in question.

Also different people may have different priorities, factors and timelines that contribute to their success. They may have different goals, choices, appetite and satisfaction levels.

That is why I feel, “success” is actually “personal success”.

When one treats it as “personal success”,

1. He is aware of the terms and conditions that come with it.
2. He does not treat the role model, if any, as the sole destination but instead gains knowledge about the big picture of risks and rewards from the experience of the role model.
3. He is aware of the “what, why, when, where and how” questions about his idea of the quest of success.

Now it seems, someone has aptly said that “personal finance” is “personal”. ;-)

So the next time you read the word “success” just replace it with “personal success” in your mind.

Personal Finance is Personal

When talking about Personal Finance, the devil is in the details !

Personal finance is the financial management which an individual or a family unit performs to budget, save, and spend monetary resources over time, taking into account various financial risks and future life events.

• Source / Credits : Investopedia

However for each individual, the need, process, goal and the reason for doing money management (as in personal finance) is different.

A lot of times as one grows in their quest of earning money, one often feels the pressure about a particular form of investment, type of budgeting method or way of spending money, etc.

However without understanding one’s true need and goal, it is not good to treat “finance” as something “generic”. It is not “generic”, in fact it is indeed “personal”.

• There are a varied number of reasons for which one may have management of his personal finances like :
  • Opportunity cost
  • Stability
  • Volatility
  • Total cost of ownership
  • Cashflow
  • Capital gains
  • Buying time
  • Buying efforts
  • Long term / short term
  • Etc.

The list may be short / long / endless with respect to the above one, but the main idea here is, it is case by case basis depending on the individual in question.

That is why I feel, if possible one must definitely understand in general about the holistic picture but when it comes to one’s own “personal finance”, it is “personal”.

Kotlin Reverse Engineering Tutorial 1 - Study of Boolean Datatype Size

Intro

In this blogpost we will see the basic disassembly of code generated for JVM bytecode from a compiled Kotlin class to understand how boolean data type is treated internally.

Kotlin source code file (BooleanSize.kt) :

package com.shubhamaher.hellokotlin

fun main() {
    var booleanTrue : Boolean = true
}

Generated bytecode disassembly in Intellij IDEA

1. Open your Kotlin source file (BooleanSize.kt in this example).
2. Goto "Tools" --> "Kotlin" --> "Show Kotlin Bytecode"

Note: Make sure you have “Kotlin to Java Decompiler” plugin installed.

To confirm this do,

A. Goto "Help" --> "Find Action" --> type "Plugins" and open the Plugins Marketplace.

B. Switch to "Installed" tab and in the list of plugins installed, confirm the above decompiler plugin. 

Once you show the bytecode, it should look like below :

// ================com/shubhamaher/hellokotlin/BooleanSizeKt.class =================
// class version 50.0 (50)
// access flags 0x31
public final class com/shubhamaher/hellokotlin/BooleanSizeKt {


  // access flags 0x19
  public final static main()V
   L0
    LINENUMBER 4 L0
    ICONST_1
    ISTORE 0
   L1
    LINENUMBER 5 L1
    RETURN
   L2
    LOCALVARIABLE booleanTrue Z L1 L2 0
    MAXSTACK = 1
    MAXLOCALS = 1

  // access flags 0x1009
  public static synthetic main([Ljava/lang/String;)V
    INVOKESTATIC com/shubhamaher/hellokotlin/BooleanSizeKt.main ()V
    RETURN
    MAXSTACK = 0
    MAXLOCALS = 1

  @Lkotlin/Metadata;(mv={1, 1, 15}, bv={1, 0, 3}, k=2, d1={"\u0000\u0008\n\u0000\n\u0002\u0010\u0002\n\u0000\u001a\u0006\u0010\u0000\u001a\u00020\u0001\u00a8\u0006\u0002"}, d2={"main", "", "hellokotlin"})
  // compiled from: BooleanSize.kt
}


// ================META-INF/hellokotlin.kotlin_module =================
,
com.shubhamaher.hellokotlin
BooleanSizeKt

Disassembly Explanation

In above kotlin/java bytecode asm disassembly, the main section is the instructions used in “public final static main()V” i.e. “ICONST_1” and “ISTORE 0” followed by a “RETURN”.

Note that everything after end of L1 section, is just verbose information given as part of the disassembly.

So internally in the JVM, an “int” constant with value “1” (true) is pushed on the operand stack by “ICONST_1” and further stored on the local variables array at index 0 by “ISTORE 0”.

Observation

This tells us that the JVM “int” data type with value 0/1 is used internally for representing false/true value of a boolean, respectively.

For more information on the internal JVM instruction set and its working(Local variables array, Operand stacks, Method references, Constant pool, etc.), the JVM Specification is helpful esp. the Frames section.

JVM Spec documentation

In “the boolean type” section of the above JVM Spec, it is documented clearly as :

There are no Java Virtual Machine instructions solely dedicated to operations on boolean values. 

Instead, expressions in the Java programming language that operate on boolean values are compiled to use values of the Java Virtual Machine int data type.

Fun fact

Therefore the bytecode generated for above Kotlin source code using Boolean data type(BooleanSize.kt) will be same as the bytecode that will be generated for below Kotlin code snippet using the Int data type :

package com.shubhamaher.hellokotlin

fun main() {
    var integer : Int = 1
}

In summary, bytecode for

var integer : Int = 1

is same as bytecode for

var booleanTrue : Boolean = true

Verdict

This behaviour of treating Boolean as int is same since very long which I had covered more than a decade back in the Java source-specific reversing blogpost. In fact, this Kotlin source-specific blogpost is a revisit to the same study of boolean size in JVM because the Kotlin source is targeted to compile into Java bytecode.

The reason for treating a boolean as int, is simply the basic fact that the minimum possible atomic size of addressable data that can be stored or worked upon, in general for computation at processor level itself, is a byte (8 bits) and not a bit (1 bit).

And hence this is the reason a boolean cannot be treated in an optimum way practically as a single bit even if it theoretically represents at the most only two values(false/true) represented by a single bit change (0/1).

How to install jekyll on Windows 7 x64

Intro

Installing jekyll on an outdated Windows 7 OS needs a group of modules(ruby, gem, bundle, jekyll) with a specific matching set of older versions of the dependencies.

On Windows 10 most of the latest versions of the required modules and gems are compliant with the OS.

Hence for Windows 7 x64, the table below highlights the group of modules with versions that are tried and tested and covered by this guide for a successful jekyll installation :

Jekyll on Windows 7 Ultimate x64 :

Note#1 : The “architecture” used by “mingw” is “x64-mingw32” since its x64 edition of Windows 7.

Note#2 : While installing Ruby+Devkit please opt to install the complete msys2 suite.

This guide is tested on Windows 7 Ultimate x64 with below details:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

systeminfo | findstr /B /C:"OS Name" /B /C:"OS Version"
OS Name:                   Microsoft Windows 7 Ultimate
OS Version:                6.1.7601 Service Pack 1 Build 7601

Setup Steps

1. Install Git (Git-2.40.1-64-bit.exe) and checkout github-pages blog repo.
2. Install “Ruby+Devkit 2.6.0-1 (x64)” (rubyinstaller-devkit-2.6.0-1-x64.exe) from Ruby Archives
3. Copy/Paste “gemrc” file from github-pages blog repo to C:\ProgramData\ on Windows.
4. ‘set HTTPS_PROXY=https://address:port’
5. ‘gem update && gem cleanup’
6. ‘gem install jekyll:2.1.0’
7. ‘gem install rogue’
8. //Delete existing Gemfile.lock (if last build was done with a different setup combination of OS+Ruby+Gem+Bundle+Jekyll version)
9. ‘bundle install’ (This will pick Gemfile and parse it to install all dependencies)
10. ‘bundle exec jekyll serve’

Setup References

1. Install Jekyll on Windows 7
2. Run Jekyll on Windows (~7)
3. Jekyll on Windows - Official but for Windows ~10 only

Extra Details of Setup

Ruby:

$ ruby -v
ruby 2.6.0p0 (2018-12-25 revision 66547) [x64-mingw32]

Gem:

$ gem -v
3.0.1

Bundle:

$ bundle -v
Your RubyGems version (3.0.1) has a bug that prevents `required_ruby_version` from working for Bundler. Any scripts that use `gem install bundler` will break as soon as Bundler drops support for your Ruby version. Please upgrade RubyGems to avoid future breakage and silence this warning by running `gem update --system 3.2.3`
Bundler version 2.4.12

Jekyll:

$ jekyll -v
To use retry middleware with Faraday v2.0+, install `faraday-retry` gem
jekyll 2.1.0

Gems Installed :

$ gem list --local
actioncable (5.0.7.2)
actionmailer (5.0.7.2)
actionpack (5.0.7.2)
actionview (5.0.7.2)
activejob (5.0.7.2)
activemodel (5.0.7.2)
activerecord (5.0.7.2)
activesupport (5.0.7.2)
addressable (2.8.4)
arel (7.1.4)
bigdecimal (3.1.4, default: 1.4.1)
blankslate (2.1.2.4)
builder (3.2.4)
bundler (2.4.12, default: 1.17.2)
classifier (1.3.5)
cmath (default: 1.0.0)
coffee-script (2.4.1)
coffee-script-source (1.12.2)
colorator (0.1)
concurrent-ruby (1.2.2)
crass (1.0.6)
csv (3.2.6, default: 3.0.2)
date (3.3.3, default: 1.0.0)
dbm (default: 1.0.0)
did_you_mean (1.6.3)
e2mmap (default: 0.1.0)
erubis (2.7.0)
etc (1.4.2, default: 1.0.1)
execjs (2.8.1)
faraday (2.7.4)
faraday-net_http (3.0.2)
fast-stemmer (1.0.2)
fcntl (1.0.2, default: 1.0.0)
ffi (1.15.5 x64-mingw32)
fiddle (default: 1.0.0)
fileutils (1.7.1, default: 1.1.0)
forwardable (1.3.3, default: 1.2.0)
gdbm (default: 2.0.0)
globalid (1.1.0)
i18n (1.13.0)
io-console (0.6.0, default: 0.4.7)
ipaddr (1.2.5, default: 1.2.2)
irb (default: 1.0.0)
jekyll (2.1.0)
jekyll-coffeescript (1.2.2)
jekyll-gist (1.5.0)
jekyll-paginate (1.1.0)
jekyll-sass-converter (1.5.2)
jekyll-watch (1.5.1)
json (2.6.3, default: 2.1.0)
kramdown (1.17.0)
liquid (2.6.3)
listen (3.8.0)
logger (1.5.3, default: 1.3.0)
loofah (2.20.0)
mail (2.8.1)
mathn (0.1.0)
matrix (0.4.2, default: 0.1.0)
mercenary (0.3.6)
method_source (1.0.0)
mini_mime (1.1.2)
minitest (5.18.0)
mutex_m (0.1.2, default: 0.1.0)
net-imap (0.3.4)
net-pop (0.1.2)
net-protocol (0.2.1)
net-smtp (0.3.3)
net-telnet (0.2.0)
nio4r (2.5.9)
nokogiri (1.13.10 x64-mingw32)
octokit (4.25.1)
openssl (default: 2.1.2)
ostruct (0.5.5, default: 0.1.0)
parslet (1.5.0)
posix-spawn (0.3.15)
power_assert (2.0.3)
prime (0.1.2, default: 0.1.0)
psych (default: 3.1.0)
public_suffix (5.0.1)
pygments.rb (0.6.3)
racc (1.6.2)
rack (2.2.7)
rack-test (0.6.3)
rails (5.0.7.2)
rails-dom-testing (2.0.3)
rails-html-sanitizer (1.5.0)
railties (5.0.7.2)
rake (12.3.2)
rb-fsevent (0.11.2)
rb-inotify (0.10.1)
rdoc (default: 6.1.0)
redcarpet (3.6.0)
reline (0.3.3)
rexml (3.2.5, default: 3.1.9)
rogue (0.1.1)
rss (0.2.9, default: 0.2.7)
ruby2_keywords (0.0.5)
safe_yaml (1.0.5)
sass (3.7.4)
sass-listen (4.0.0)
sawyer (0.9.2)
scanf (default: 1.0.0)
sdbm (default: 1.0.0)
shell (0.8.1, default: 0.7)
singleton (0.1.1)
sprockets (4.2.0)
sprockets-rails (3.2.2)
stringio (3.0.6, default: 0.0.2)
strscan (3.0.6, default: 1.0.0)
sync (default: 0.5.0)
test-unit (3.5.7)
thor (1.2.1)
thread_safe (0.3.6)
thwait (0.2.0, default: 0.1.0)
timeout (0.3.2)
toml (0.1.2)
tracer (0.1.1, default: 0.1.0)
tzinfo (1.2.11)
webrick (1.8.1, default: 1.4.2)
websocket-driver (0.6.5)
websocket-extensions (0.1.5)
xmlrpc (0.3.2)
yajl-ruby (1.2.3)
zlib (3.0.0, default: 1.0.0)

Money is a misnomer

This is my first post under the category of Personal finance. In this I wanted to pen down the way I look at money.

What is money ? ( hehe basic question ! )

I personally feel that money is just a very popular misnomer. It is simply a currency. A medium of exchange. Yet it is often misunderstood as wealth. And since they primarily look at money as wealth and not as a “side outcome” or “byproduct”, they often have misconceptions of money as being the primary objective. Money is the figurative representation of the amount of value you add and hence primary objective should be to improve the value you add in earning the money.

This not only makes one appear greedy but it is not sustainable in the long run since being wealthy is about the journey of earning wealth and not only the destination.

In fact one should understand how money is created which will make it easy to understand how it can be seen as a “byproduct”. I will write about this “money printing”, may be some other day since it is not the primary reason of writing this post.

My take is, it can be seen as a vehicle to go from point A to point B rather than as wealth.

Now you may say, “yeah yeah Shubham, definitely it is not wealth and we know that”.

Well my point is not about only the wrong interpretation of money as wealth, but more about the fact that money should not only be seen as a currency but what you do with it is also more important esp. when you ask yourself questions like,

“How happy I am by earning my money ?”

“Am I spending money on the things I like to do ?”

“How am I using my money to invest in myself ?” - Most important if you ask me.

“Am I investing my money ? “ : This one is more tricky. Since if the answer is “Yes” to this question then, you should ask more questions to yourself like,

“Are you investing your money in other people’s investment or your own one ? Like something you want to build yourself personally or be part of or want to contribute to.”

Do you like the way you are earning money ?

The thing about money is there are many ways to earn it and hence how do you feel about the way you are earning it, is more important than how much you earn it. This includes the terms and conditions that come with the way you are earning it.

Each person is unique and hence “find your game” of earning the money. Take it as a sport and hence decide if you like the sport you are playing first i.e. know if you are loving the way you are earning money and happy about it. And like any other sport, this has rules too. Understanding the economy is one way of knowing the rules of this sport. I am learning about it too.

Whats your definition of being wealthy ?

I think the time value of my money is more important in terms of giving me the happiness.

To sum up, I would say that as money is time-driven it is more about how happy you feel while you are on the journey of earning it, since at the end even if you are wealthy the thing that is going to matter to you alone is, “how did you became one” rather than “you became one”.

So my definition of being wealthy would be my happiness in the process/journey of becoming wealthy esp. the mindset.

Keep learning !

Disclaimer : I am not wealthy :-P and this post is to express my mindset about money.

SymbianOS Archive

Recently, I found some SymbianOS development related files in my old backups.

They are a mix of some Java/C++ based SDKs and Theme Studios. Listing them for retrocomputing purpose !

Yes, 10+ years is “retro” in tech !!

Nokia Symbian C++ SDK :

Nokia Series 40 JavaME-based SDK :

Nokia Series 60 JavaME-based SDK :

Nokia Symbian Theme-development related :

Sun JavaME-based SDK :

How many blog engines ?

If you have read my earlier blogpost of completing 10 years since my first blog, then you must already know by now that I have used 3 blog engines till now :

2012-2015 Blogger :

Pros:

Easy to format, many features to upload pictures, change preferences, etc.

Cons:

Needs many HTML/CSS/JS tricks to customize, lots of hacks needed, limited tweaks, less control over data ownership, compliances, etc.

2016-2018 Github Pages with Jekyll :

Pros:

Markdown posts are easy but initial markdown syntax learning curve, simple design and themes, etc.

Cons:

Too much debugging needed if not done correctly or need to dig more to tweak, less visual features, etc.

2019-2021 Wordpress :

Pros:

Simple visual features, easy to use, etc.

Cons:

Need to manage yearly hosting stuff, needs self-management which is tedious and expensive for long term purpose of my need, etc.

2022 Github Pages with Jekyll :

Pros:

Less distractions while writing, more focused on content then other tweaks, static sites so faster loadtimes, etc.

Cons Conclusion ! :

Lets see how long I can use this blog engine then I can summarise. For now, its easy write content and export it to a static site in a quick way.

See you soon !

10 years since my first blog

Yay ! I have officially completed more than 10 years as a blogger :P

Actually I completed it in the month of July 2022 itself but this is a latepost.

To be honest, in this tenure spanning a decade since I wrote my first article, I have been more of a “blogreader” than a “blogwriter”.

My first blogpost was a Java reverse engineering tutorial (and series) followed by more blogposts on Windows and Android RCE.

This was the time during which Google Blogger was already old enough and popular as a traditional blogging platform.

So the stats for these 10 years are as follow :

1. I wrote 16 posts i.e. on average 1.6 articles per year. Wait ! Didnt you read my shameless “Lazy Blogger” self-declaration on the left sidebar ?

2. Out of total 16 posts, 4 of them are in the process of being recovered from my expired hosting space. Again ! Being lazy here to reconstruct these 4 articles.

3. Also, 1 article out of total 16 is missing “pictures” due to same incident of my expired hosting space. Guessed ? Now you know the lazy blogger in me.

4. In these 10 years I have used 3 blog engines. Another blogpost some other day on this soon !

I hope I will write some more blogs !

Checklist for a flat buyer in Pune

Recently one of my friend was looking to buy a new residential flat in Pune and asked me if there is a checklist.

I immediately replied in the chat to my friend, a “rough” checklist which I am also going to elaborate in this blogpost.

So here is a checklist that I think a flat buyer can use based on my personal journey and experience of buying a flat in Pune :

Note: I feel that until each step in the checklist is not followed strictly, one should not even move to the next step at all.

1. Finalise budget, BHK type (no. of rooms), and group of localities you like before even you start your flat buying journey. These 3 things should be damn final and you should be firm on them.

2. For each flat, consider builder’s experience (and not reputation as depicted in media) : Check past delivered projects by asking residents of those delivered projects or confirming the same as a recommendation in your network.

3. For each site visit, run away from project site if sample flat is furnished one OR the sample flat is at separate location from the building wing where all the residents are going to reside. Dont fall for the trap of visiting the sample flat even if requested multiple times by the builder.

4. Remember, less amenities = less maintenance preferred. On flat visit, make sure you note flat layout, carpet space, facing, frontage, ventillation and rooms layout. Do not forget to confirm electricity and drainage connections of the project site.

5. For each of 3 final selected flats, RERA project details with litigations : Easily doable online as a self-lookup.

6. For final one flat that you selected, paid lawyer due deligence is a must : Property advocate will confirm land litigations, many other certificates and other details.

7. At agreement time, read carefully line by line the draft soft copy of flat sale agreement and the final agreement.

8. At possession time, basically check everything in your flat : Kitchen top leakage, all dado works, all tiles grooving and cleaned plumbing system.

   Best of Luck !

Trip to South Goa

This post is recovered from damaged website. Work is in progress for this blogpost and below 3 specific blogposts:

http://shubhamaher.com/jamun-shots-recipe

http://shubhamaher.com/torna-fort-trek

http://shubhamaher.com/boiled-egg-bhurji-recipe

This year, in the monsoon season, knowing that the rainfall is incessant and will last longer than previous year I thought September last week will be the best time for the “annual” Goa trip. Yes!, you read it right “annual” because Goa is something I visit almost every year to unwind.

Coconut trees at Arossim Beach

Add to it the fact that the end of the monsoon season is around the month of September and the start of tourist season is around mid-October (because of Diwali vacations, Christmas, New Year, etc).

So travelling to Goa at the end of the month of September was my best decision to enjoy the less-crowded beaches, awesome greenery-just-after-the-end-of-monsoon season, benefits of less prices before the start of the tourist season: in short to Enjoy the Best of Goa !

Since this was my 7th trip to Goa and in all my previous travels, I have stayed at and visited places of North Goa, this time I decided to stay at South Goa.

Looking for accomodation in the South Goa, I found a very good deal on Goibibo for Treehouse Nova, Cansaulim at just 5195 INR for 3 nights with breakfasts !

Itinerary

Although I have visited Goa in the past, it was the first Goa trip for my wife and so I came up with the below itinerary to consider places of South Goa keeping in mind the places of North and Central Goa as well.

Day Region Places 1 South Goa Mobor beach, Colva beach 2 North Goa Calangute beach, Anjuna beach 3 Central Goa Panjim city, Miramar beach 4 South Goa Arossim beach, Majorda beach, Nanu beach

Beach Hopping !

Mobor Beach (Day 1)

A view at Mobor Beach One of my favourite lunch : Goan Fish Thali at Betty’s Place near Mobor Beach

Calangute Beach (Day 2)

Relaxing on the Calangute Beach

At Calangute Beach, we just relaxed at a shack gazing at the sea and sipping drinks 😉

Travel Tip#1: Water sports are expensive and limited at Calangute Beach so prefer to do them at less price on Anjuna Beach which is not that far from Calangute Beach.

Anjuna Beach (Day 2)

We did water sports at Anjuna Beach.

Travel Tip#2: Now a days, water sports activities have been commercialised a lot and hence the prices are now increased. However if more than one person is going to do the water sports, be patient and bargain !

I struck a good deal for 2 of us that included a package of 4 sports ( Parasailing, Banana ride, Bumper ride and Jetski ride) for 2200 INR (2people). Getting ready for Parasailing !

Parasailing
Parasailing at Anjuna Beach
Goan Thali Lunch near Anjuna Beach

Panaji City (Day 3)

In Panaji, we visited the Fontainhas (Latin Quarter), Panaji Church, Viva Panjim and Miramar Beach. With my wife at Our Lady of the Immaculate Conception Church, Panaji Lunch at Viva Panjim – A famed restaurant serving delicious Goan and Portuguese cuisine

Arossim Beach (Day 4)

Arossim Beach

A view at Arossim Beach
Boat (white) at Arossim Beach
Arossim Beach view
Boat (cyan) at Arossim Beach

Majorda Beach (Day 4)

Parasailing activity going on at Majorda Beach

Boat at Majorda Beach
Majorda Beach view
Coconut trees at Majorda Beach

Nanu Beach (at Betalbatim) (Day 4)

Nanu Beach view

Nanu Beach at Betalbatim

Trip Costs

I had a good 4 day / 3 night trip in Goa within my budget. I spent 16890 INR in total right from my home in Pune to Goa and back. Below is the breakdown of major expenses : Sr. No. Expense for Expense Amount

1. Pune-Goa Bus (Non-AC Seater) for 2 1400 INR
2. Goa-Pune Bus (Non-AC Seater) for 2 1200 INR
3. Stay at Treehouse Nova (Superior Room, 3 nights with buffet breakfasts, 2 people) 5195 INR
4. Water sports at Anjuna Beach for 2 people 2200 INR
5. Bike Rental (1 Honda Deo at 400INR/day for 4 days) 1600 INR
6. Bike Petrol (Burned ~10 litres in 4 days) 700 INR
7. Food(4 lunches, 4 dinners), Cabs (4), etc. (Note: Lost track of other expenses but all within this amount only) 4595 INR

Grand Total: 16890 INR

Write CSV file in Groovy/Grails

There are many libraries to work with CSV files. We will make use of the OpenCSV library to write a sample CSV with two rows.

Code snippet:

CSVWrtier Example in Groovy

@GrabConfig(systemClassLoader = true)
@Grab(group='au.com.bytecode', module='opencsv', version='2.4')
 
import au.com.bytecode.opencsv.CSVWriter
 
class CSVWriterExample {
 
    static void main(String[] args) {
 
            def outputFilePath = "/home/user-name/employee.csv"
 
            File csvFile = new File(outputFilePath)
            csvFile.createNewFile()
 
            csvFile.withWriter { writer ->
 
                CSVWriter csvWriter = new CSVWriter(writer)
 
                csvWriter.writeNext(["1","Alice","123"] as String[])
                csvWriter.writeNext(["2","Bob","456"] as String[])
        }
    }
}

Boiled Egg Bhurji - Recipe

Recently I had boiled egg bhurji on a street food joint in my office area after which this became one of my favourite dish.

After observing the street food vendor make it for me many times, I wanted to cook it soon.

I tried cooking the dish and it did turn out successful. Here is the recipe for a simple, quick and lip-smacking boiled-egg bhurji ! Enjoy !

Ingredients

• Eggs – 4 ( for 2 servings)
• Onions – 2 (big)
• Tomatoes – 1 (big)
• Green Chillies – 3 to 5 ( as per taste )
• Coriander Leaves ( for garnishing )
• Salt ( as per taste )
• Turmeric Powder ( 1 teaspoon )
• Red Chilly Powder ( 3 teaspoon )
• Garam Masala ( 1 teaspoon ) – preferably home-made
• Chicken Masala ( for taste, ready-made is fine)
• Bread / Bun / Chapati ( as per your preference)

Preparation

1. Fine chop all veggies ( Onions, Tomatoes, Green chillies, Coriander leaves) and keep them aside. 2. Hard boil the eggs, remove shells and cut each egg into half to separate yolks and whites.
3. Chop both whites and yolks into small/medium pieces and keep them aside. 4. Heat a pan/kadhai, add oil and saute chopped onions, tomatoes and green chillies until onions start becoming brown.
5. Add turmeric powder, red chilly powder, garam masala, chicken masala, salt to the mixture. Stir fry well.
6. Add whites and stir fry for 3 minutes. Let the still mixture cook for 5 minutes.
7. Finally, add yolks, stir fry, mix well and let the mixture cook for 3 minutes. 8. Serve with chapati / bun / bread.

Torna Fort Trek

This post is recovered from damaged website. Work is in progress for this blogpost and below 3 specific blogposts:

http://shubhamaher.com/jamun-shots-recipe

http://shubhamaher.com/boiled-egg-bhurji-recipe

http://shubhamaher.com/trip-to-south-goa

It’s start of the June and the monsoon season is showing up here in Pune. I and my friends decided to go on a trek to Torna Fort ( also called as Prachandgad ) on 17th June, Saturday. We reached the foothill around 9 am and started hiking. Nowadays there is a cement road constructed […]

Jamun Shots - Recipe

This post is recovered from damaged website. Work is in progress for this blogpost and below 3 specific blogposts:

http://shubhamaher.com/torna-fort-trek

http://shubhamaher.com/boiled-egg-bhurji-recipe

http://shubhamaher.com/trip-to-south-goa

Ingredients

1. Jamuns ( Jambul ) – 500gms
2. Rock salt – 2 pinches
3. Salt – 1 pinch
4. Water – 1 glass

Preparation

1. Clean the Jamuns by washing in water.
2. Soak in water for about 1 hour.
3. Add salt, rock salt and boil on very low flame till the skin of the Jamuns…

How to make a cheap Blowgun for less than 100₹.

I love documentaries and watch them more than I watch movies. So, just two weeks before, I was watching a very old documentary on tribal life called as “Nomads of the Rainforest”.

While watching the documentary, what intrigued me the most in the life of a nomad was the tools and techniques these tribal men used, to hunt their food. Especially, the blowgun (also called blowpipe).

This simple yet powerful weapon seemed to be favourite amongst all tribal communities. After having seen how the nomads created this weapon using simple tools and basic equipment in the forest, I decided to search for an online tutorial which will instruct to create one and came across this very short and useful video:

This weekend, a friend of mine involuntarily reminded me of this DiY Project and I immediately decided to make one today.

Although, the above video is self-explanatory, I have summarized below, all the steps that I did to make the blowgun.

Things needed for Blowgun:

I already had a pack of sticky notes and a pair of scissors, so I went to a nearby hardware store and bought the following required things as seen in the above video:

Making the Blowgun

As the blowgun comprises of only two things, we simply snug-fit the connector to the PVC pipe at one end.

Making the Darts

This is one of the important part of the whole blowgun kit.

• Using the clay pack, roughly mould small amount of clay into tiny cones as shown below and keep these aside:

• Take a sticky note, using one corner of it as apex of the cone, twist it as shown in picture# 2.a, 2.b and 2.c below:

Picture# 2.a

Picture# 2.b

Picture# 2.c

• Tape the outer part of the sticky note such that it completes the cone(see picture# 3.a). Cut off excess tape with a pair of scissors(see picture# 3.b). Now, picture# 3.c shows how an empty paper dart looks.

Picture# 3.a

Picture# 3.b

Picture# 3.c

• Take one clay cone that we created earlier, and pierce a nail into it such that we can push the pointed part of the cone into pointed part of the paper dart. Gently push the nail alongwith the clay cone so that it fits in properly. Then, pull out the nail from outside. [See below pictures: 4.a to 4.e]

Picture# 4.a

Picture# 4.b

Picture# 4.c

Picture# 4.d

Picture# 4.e

• Now we take the dart from above step, and try to fit in the pipe so as to create a line using which we can cut off excess paper. [See below pictures: 5.a to 5.f]

Picture# 5.a

Picture# 5.b

Picture# 5.c

Picture# 5.d

Picture# 5.e

Picture# 5.f

• In similar way, I created paper darts with different types of nails. [See below picture]

Picture# 6.a

• So the complete blowgun kit looks like this:

Picture# 7.a

Making the Dartboard

I dont have a dartboard, so I decided to make one by reusing things at home.

• Pulled out an unused box and using my juggling ring, a ruler, pens and protractor; drew borders on it. [See below pictures: 8.a and 8.b]

Picture# 8.a

Picture# 8.b

Testing the Blowgun kit

Now that the dartboard is ready, I decided to try the complete blowgun kit.

• Mounted the dartboard on one of my wall in the bedroom and tried to shoot a couple of darts. It works perfect.

Picture# 9.a

Picture# 9.b

• You can be creative and do other things to the blowgun like add laser, spray-paint the gun, adding a quiver, etc.

Android Malware Analysis - null Security Community Meetup Talk

Being a security enthusiast, I had a good opportunity to talk on one of my interesting subject in mobile security: Android Malware Analysis at the null Open Security Community September 2014 Meetup held at SICSR (Symbiosis Institute of Computer Studies and Research), Pune.

Meetup Agenda:

Time	Topic
10:00 am to 10:10 am	Introductions
10:10 am to 10:45 am	News Bytes by Sneha Rajguru
10:45 am to 11:15 am	Android Malware Analysis by Shubham Aher
11:15 am to 12:00 pm	Secure coding in PHP  by Sneha Rajguru
12:00 pm to 12:15 pm	Feedback & Topic Discussion for Next Month meet

This was my first talk at null Meetup and I really enjoyed interacting with all the other inquisitive and like-minded security enthusiasts and professionals.

Alongwith the presentation, my talk required analyzing a couple of real-world Android malwares and demoing a few code snippets from these. So here are the download links for all the material:

PowerPoint Presentation: http://www.mediafire.com/view/gwev57c4ymhlv6f/AndroidMalwareAnalysis.pptx

Malware Samples Analyzed:

1. Android.HippoSMS - http://contagiominidump.blogspot.in/2011/07/hipposms-sms-trojan.html
2. MouaBad.P - http://contagiominidump.blogspot.in/2013/12/mouabadp-android-dialer-sms-trojan.html
3. Android.Beita - http://contagiominidump.blogspot.in/2013/11/beita-android-infostealer.html
4. Android.ScarePackage - http://contagiominidump.blogspot.in/2014/07/android-scarepackage-ransomware.html
5. Android.Dendroid - http://contagiominidump.blogspot.in/2014/03/dendroid-android-spyware.html
6. Android.Zitmo - http://contagiominidump.blogspot.in/2011/07/zitmo-android-edition-zeus-for-mobile.html

Special Thanks to all the null Community Members and Volunteers for organizing this meetup. Looking forward to give more talks in the future.

About null - The Open Security Community :

null is India's largest open security community. Registered as a non-profit society in 2010, we have been active since even before that. null is about spreading information security awareness. All our activites such as null Monthly Meets, null Humla, null Bachaav, null Puliya, null Job Portal are for the cause of that.

null is Open, is professional, is inclusive, responsible and most importantly completely vounteer driven.

Any questions/comments/suggestions/criticisms, feel free to post.

How to change the HTC Sense 2.1 Ring Lockscreen to default Slide-to-side Lockscreen

Many smartphone users ( including me ), don't like the new ring lockscreen that we get after some software updates on older HTC Sense 2.1 devices ( like my phone, which is HTC Salsa C510e ).

So here is a trick to change the ring lockscreen to a slide-to-side lockscreen as shown below:

Ring lockscreen changed to Slide-to-side lockscreen

Prerequisites:

• A rooted phone
• Phone with HTC Sense as GUI
• HTC Sense version 2.1
• Any file explorer with root access (my favourite is X-plore ! Its best for stuff like modding)

Steps:

1. Check HTC Sense version.
By navigating to "Settings" ==> "About phone" ==> "Software information", check if it says "2.1" under "HTC Sense version". This is how it should look:

2. Using any of your favourite file explorer app, navigate to /system/app/ . There will be a file named "HtcLockScreen.apk" (see the red box) :

3. Rename it to "HtcLockScreen.apk.bak". We dont delete it because if the trick doesn't work or if we want the ring lockscreen back, we can rename it to original name.

4. After renaming:

5. Reboot the phone. You will have the slide-to-side lockscreen after the phone starts.

Native Android Reverse Engineering Tutorial#1: Patching/Modifying String within Native Android App

Aim:

To learn to:

1. Decompile the Native Android App File (.apk) into Java code (.java)
2. Disassemble the Shared Object File (.so) into ARM Assembler Opcodes.
3. Use of tools like IDA (Interactive Disassembler), dex2jar, jd-gui, etc.

This tutorial introduces you to the basics of reverse engineering a Native Android app on Ubuntu.

Prerequisite:

• http://www.shubhamaher.blogspot.in/2013/01/android-reverse-engineering-tutorial1.html
• Knowledge of basic UNIX commands.

Tools Needed:

• Android SDK (for adb and Emulators )
• Dex2jar
• AXMLPrinter2.jar (for converting a binary XML into textual XML)
• jd-gui
• signapk.jar (for re-signing the modified APK)

Overview:

• The general overview of steps required to carry for reversing a Native Android app are:

Steps:

DOWNLOAD

Step#1:

I have put together all the tools and the target crackme APK file in one directory called "mycracklab", zipped and uploaded it. Download the mycracklab.zip and extract it anywhere you like. I have the "mycracklab" directory at /home/shubhuntu/mycracklab/

TESTING the TARGET CRACKME

$ pwd
/home/shubhuntu/mycracklab

$ ls
crackme.native-1.apk  tools

Step#2:

Viewing files in the APK. An APK is a ZIP file with a .apk extension. So we use the "zipinfo" command.

$ zipinfo crackme.native-1.apk
Archive:  crackme.native-1.apk
Zip file size: 153346 bytes, number of entries: 8
-rw----     2.0 fat     1436 bX defN 13-Apr-08 16:45 AndroidManifest.xml
-rw----     1.0 fat      576 b- stor 13-Apr-08 16:45 resources.arsc
-rw----     2.0 fat     2924 bl defN 13-Apr-08 16:45 classes.dex
-rw----     2.0 fat   268812 bl defN 13-Mar-13 22:29 lib/armeabi/gdbserver
-rw----     2.0 fat    13432 bl defN 13-Apr-08 16:26 lib/armeabi/libhello-jni.so
-rw----     2.0 fat      409 bl defN 13-Apr-08 16:45 META-INF/MANIFEST.MF
-rw----     2.0 fat      462 bl defN 13-Apr-08 16:45 META-INF/CERT.SF
-rw----     2.0 fat     1203 bl defN 13-Apr-08 16:45 META-INF/CERT.RSA
8 files, 289254 bytes uncompressed, 152306 bytes compressed:  47.3%

Step#3:
Starting the emulator.
Using the Android's AVD Manager I have started an emulator running Android 4.2 that is API Level 17:

Step#4:
Installing the APK in the emulator using adb.

To install, I will use the Android Debug Bridge i.e. adb which is present in the "platform-tools" directory of the Android SDK.

$ cd /opt/android/adt-bundle-linux-x86/sdk/platform-tools/
shubhuntu@elf:/opt/android/adt-bundle-linux-x86/sdk/platform-tools$ ls
aapt  adb  aidl  api  dexdump  dx  fastboot  lib  llvm-rs-cc  NOTICE.txt  renderscript  source.properties

$ ./adb install /home/shubhuntu/mycracklab/crackme.native-1.apk
987 KB/s (153346 bytes in 0.151s)
 pkg: /data/local/tmp/crackme.native-1.apk
Success

If the command succeeds, that means it is installed and an icon for the app appears in the menu of emulator:

Step#5:
Click on the app to start the crackme:

As seen the crackme displays the message "Hello from JNI !". Our aim is to modify this message string.
Let us begin our hunt for the message.
Remember NOT to close the emulator !

                                                   DECOMPILATION (.dex to .jar to *.java files)

Step#6:

Extraction of all the files from the crackme APK(which is actually a ZIP file).

$ cd /home/shubhuntu/mycracklab/
$ unzip -d extracted crackme.native-1.apk 
Archive:  crackme.native-1.apk
  inflating: extracted/AndroidManifest.xml  
 extracting: extracted/resources.arsc  
  inflating: extracted/classes.dex   
  inflating: extracted/lib/armeabi/gdbserver  
  inflating: extracted/lib/armeabi/libhello-jni.so  
  inflating: extracted/META-INF/MANIFEST.MF  
  inflating: extracted/META-INF/CERT.SF  
  inflating: extracted/META-INF/CERT.RSA  

$ cd extracted/
$ ls
AndroidManifest.xml  classes.dex  lib  META-INF  resources.arsc

Step#7:

Conversion of the "classes.dex" file to "classes-dex2jar.jar" file.

$ sh ../tools/dex2jar-0.0.9.13/d2j-dex2jar.sh classes.dex
dex2jar classes.dex -> classes-dex2jar.jar

Step#8:

Conversion of the .jar file to *.java files using jd-gui Java decompiler.

Step#8.1:

Start the jd-gui tool.

$ jd-gui classes-dex2jar.jar &
[1] 4371

Step#8.2:

Navigate to "File" ==> "Save All Sources" inside the jd-gui.

Keep the default filename as it is: "classes-dex2jar.src.zip"

Click on "Save" button.

Step#8.3:

Extraction of the *.java files into a directory called "javacode"

$ ls
AndroidManifest.xml  classes.dex  classes-dex2jar.jar  classes-dex2jar.src.zip  jd-gui.cfg  lib  META-INF  resources.arsc

$ unzip classes-dex2jar.src.zip -d javacode
Archive:  classes-dex2jar.src.zip
   creating: javacode/android/
   creating: javacode/android/annotation/
  inflating: javacode/android/annotation/SuppressLint.java  
  inflating: javacode/android/annotation/TargetApi.java  
   creating: javacode/com/
   creating: javacode/com/example/
   creating: javacode/com/example/hellojni/
  inflating: javacode/com/example/hellojni/BuildConfig.java  
  inflating: javacode/com/example/hellojni/HelloJni.java  
  inflating: javacode/com/example/hellojni/R.java  

IDENTIFYING the PACKAGES, CLASSES and METHODS to PATCH

Step#9:

Converting the Binary XML into a Textual XML using AXMLPrinter2.jar

$ java -jar ../tools/AXMLPrinter2.jar AndroidManifest.xml > AndroidManifest.xml.text

$ ls
AndroidManifest.xml  AndroidManifest.xml.text  classes.dex  classes-dex2jar.jar  classes-dex2jar.src.zip  javacode  jd-gui.cfg  lib  META-INF  resources.arsc

$ vim AndroidManifest.xml.text

This is how the textual XML will look:

We come to know that the initial activity is ".HelloJni" which corresponds to "HelloJni.java" source file and is in "com.example.hellojni" package.
Open "HelloJni.java" in any of your favourite Java editor.
Following is the code of "HelloJni.java":

package com.example.hellojni;

import android.app.Activity;
import android.os.Bundle;
import android.widget.TextView;

public class HelloJni extends Activity
{
  static
  {
    System.loadLibrary("hello-jni");
  }

  public void onCreate(Bundle paramBundle)
  {
    super.onCreate(paramBundle);
    TextView localTextView = new TextView(this);
    localTextView.setText(stringFromJNI());
    setContentView(localTextView);
  }

  public native String stringFromJNI();

  public native String unimplementedStringFromJNI();
}

/* Location:           classes-dex2jar.jar
 * Qualified Name:     com.example.hellojni.HelloJni
 * JD-Core Version:    0.6.2
 */

Its quite evident that the static code block which gets executed first is loading a native library named "hello-jni".
So its full name will be "libhello-jni.so"

Step#10:
Verifying the shared object file "libhello-jni.so"

$ file ./lib/armeabi/libhello-jni.so
./lib/armeabi/libhello-jni.so: ELF 32-bit LSB shared object, ARM, version 1 (SYSV), dynamically linked, stripped

Also you can observe from the "HelloJni.java" file, that the "setText()" method sets the text using the native method declared as:

public native String stringFromJNI();

DISASSEMBLING the LIBRARY FILE

Step#11:
We will now look for this "stringFromJNI()" method in the disassembled view of IDA inside the native file "libhello-jni.so".
I am running the Windows version of IDA on Ubuntu using Wine but you can build and use the Linux version if you want.

Select the file to disassemble in IDA:

Step#12:

It will detect it automatically as an ELF Shared Object File. Click OK :

Step#13:
ARM and THUMB SWITCH INSTRUCTIONS warning. Just click OK:

Step#14:
This is the disassembled view of the "libhello-jni.so" file. Click on the "Exports" tab for viewing all functions exported by this library:

Step#15:
Here is the list of all exports. The Java methods that are made native and implemented using this library are by default named in "Java_complete_package_name_ClassName_methodName" format.
For e.g.:
In our case, package name is "com.example.hellojni", class name is "HelloJni" and method name is "stringFromJNI" so the function name in exports will be "Java_com_example_hellojni_HelloJni_stringFromJNI".

Click on this function, and IDA will show you the ARM opcodes for this function:

Step#16:
This is the disassembled view of the function. IDA is so powerful that it comments the code where strings are used. Thus as you can see that IDA has commentend our string (I have highlighted it with a red box below). Also we come to know that the string "Hello from JNI !" is declared as a variable named "aHelloFromJni".

Double-click on "aHelloFromJni" and it will show you the declaration of string.

Step#17:
As you can see, "aHelloFromJni" is defined as "Hello from JNI !" with the DCB assembler directive.

DCB is an ARM Assembler Directive that stands for Define Constant Byte.

Step#18:
 Now click on the "Hex View" tab, and you will see the Hex Dump for the defined string.
Click on the first character of the string i.e. 'H', and at the status bar at the bottom you will get the file offset of the beginning of the string literal.

In this case it is 0x2030.

MODIFYING the LIBRARY FILE

Step#19:
Using any of your favourite Hex Editor (I have used Bless Hex Editor), open the file "libhello-jni.so" and go to file offset 0x2030.

Step#20:
Replace the original string bytes with new bytes and save the file.
I have replaced the original string "Hello from JNI !" with "Bye.. from JNI !"
Warning#1: As it is a binary ELF shared object file, take care that you replace only the original bytes in the string "Hello from JNI !" starting from the offset 0x2030 till 0x203F.
Warning#2: Also see that you "REPLACE" and not "INSERT".

RE-SIGNING the APK FILE

Now as we have modified the "libhello-jni.so" file we need to update the modified file in the "crackme.native-1.apk" file and also resign the "crackme.native-1.apk" !

Step#21:
Updating the modified library file inside the .apk file.

$ zip ../crackme.native-1.apk -u lib/armeabi/libhello-jni.so 
updating: lib/armeabi/libhello-jni.so
 zip warning: Local Entry CRC does not match CD: lib/armeabi/libhello-jni.so
 (deflated 61%)

Step#22:Re-signing the updated .apk file.

$ cd ..
$ java -jar ./tools/signapk.jar ./tools/testkey.x509.pem ./tools/testkey.pk8 crackme.native-1.apk crackme.native-1-SIGNED.apk

TESTING the MODIFIED CRACKME

Merely installing the new crackme will give error as the fully qualified name of both the original and modified crackme will conflict because of being same (com.example.hellojni).
So before installing our modified apk, we need to uninstall the previous one.

Step#23:
Uninstall the previous crackme manually by navigating to "Settings" ==> "Manage Applications".

In order to test our new modified apk, we need to go to "platform-tools" directory of the SDK:

$ cd /opt/android/adt-bundle-linux-x86/sdk/platform-tools/

P.S.: The emulator is still running.

Step#24:

Install modified APK (crackme.native-1-SIGNED.apk) in Emulator using adb.

$ ./adb install /home/shubhuntu/mycracklab/crackme.native-1-SIGNED.apk 
970 KB/s (153453 bytes in 0.154s)
 pkg: /data/local/tmp/crackme.native-1-SIGNED.apk
Success

Step#25:

Click the icon to run the crackme.

List of blogs for Reverse Engineering

Android Reverse Engineering Tutorial#1: Disassembling and Decompiling DEX files

Aim:

To learn to:

1. Decompile the Android App File (.apk) into Java code (.java)
2. Disassemble the Dex File (.dex) into Dalvik Opcodes (.smali)
3. Use of tools like adb(Android Debug Bridge), dex2jar, jd-gui, etc.

Besides above things, this tutorial introduces you to the basics of reverse engineering on Android platform.

Tools Needed:

• Android SDK (for adb and Emulators )
• EasyAPKDisassembler ( Its batch utility created by some XDA member that supports disassembling, converting binary XML to textual XML, APKtool assembly/disassembly, Signing/Designing Certificates, etc)
• Dex2jar
• WinRAR or any archive tool (with .zip file support)
• jd-gui or any other Java decompiler.

Steps for DISASSEMBLING (.dex to .smali) :

1. Copy the target APK file ( TestHelloWorld.apk ) to "platform-tools" folder inside the main "android-sdk" folder. For e.g. On my machine Android SDK is in "D:\Program Files(x86)\Android\android-sdk\platform-tools"

2. Copy the Command Prompt(cmd.exe) from your system files into "platform-tools" folder and double click it to type following commands:

D:\Program Files (x86)\Android\android-sdk\platform-tools>adb devices
List of devices attached
emulator-5554   device

D:\Program Files (x86)\Android\android-sdk\platform-tools>adb install TestHelloW
orld.apk
24 KB/s (5546 bytes in 0.220s)
        pkg: /data/local/tmp/TestHelloWorld.apk
Success

3. "adb devices" tells us the list of running emulators.

4. We install the APK package with "adb install TestHelloWorld.apk" command.

5. Lets check and see the app in emulator:

6. Download and extract "EasyApkDisassembler.V1.3.1.zip" in a folder anywhere you like. Also copy the "TestHelloWorld.apk" in the same folder.

7. Open "TestHelloWorld.apk" with WinRAR or any other archive tool that supports the ZIP format as .APK is nothing but a .ZIP file with a different extension. From this file extract the "classes.dex" into the same dir where you extracted the "EasyApkDisassembler.V1.3.1.zip" files :

8. Start "EasyApkDisassembler.EN.bat" , press option 2 and give the name of the file as "TestHelloWorld.apk" :

9. Now the "classes.dex" file is disassembled into the same folder with a name as "out_TestHelloWorld.apk". This folder contains all the disassembled source code in Dalvik Opcodes format (.smali) files :

10. Navigate to "\out_TestHelloWorld.apk\com\example\android\helloactivity\" :

11. You will see many .smali files. Open the "HelloActivity.smali" file in Notepad or any other text editor you like :

.class public Lcom/example/android/helloactivity/HelloActivity;
.super Landroid/app/Activity;
.source "HelloActivity.java"


# direct methods
.method public constructor ()V
    .registers 1

    .prologue
    .line 27
    invoke-direct {p0}, Landroid/app/Activity;->()V

    .line 28
    return-void
.end method


# virtual methods
.method public onCreate(Landroid/os/Bundle;)V
    .registers 3
    .parameter "savedInstanceState"

    .prologue
    .line 35
    invoke-super {p0, p1}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V

    .line 39
    const/high16 v0, 0x7f02

    invoke-virtual {p0, v0}, Lcom/example/android/helloactivity/HelloActivity;->setContentView(I)V

    .line 40
    return-void
.end method

12. You have successfully disassembled the .dex file into .smali file. In order to understand the .smali code you will need to go through the Dalvik Opcodes List.

13. The disassembled file in .smali format is very easy to patch. In my upcoming Android reversing tutorials I will be covering patching the Dalvik Bytecodes.

Steps for DECOMPILING (.dex to .java) :

1. Download latest copy of "dex2jar" tool and extract its content in the same folder where you extracted the "EasyApkDisassembler.V1.3.1.zip" files as in above part. Also copy the same "classes.dex" into "dex2jar-0.0.9.6" folder :

2. Within the "dex2jar-0.0.9.6" folder, open the command prompt and type following command :

dex2jar classes.dex

3. After the command completes you will see the "classes_dex2jar.jar" file in the same folder. You can extract this .jar file into a folder you like and you will see many .class files. Open the "HelloActivity.class" file in "jd-gui" or any other java decompiler you like :

4. You have successfully decompiled the .dex file into .java file.

Download Links:

1. EasyAPKDisassembler:
http://www.mediafire.com/download.php?86e1th638ztn71a or
http://code.google.com/p/easy-apk-dissassembler/downloads/detail?name=EasyApkDisassembler.V1.3.1.zip&can=2&q=

2. Dex2jar:
http://code.google.com/p/dex2jar/downloads/detail?name=dex2jar-0.0.9.12-a.zip&can=2&q=

3. WinRAR:
http://www.rarlab.com/rar/wrar420.exe

4. jd-gui:
http://jd.benow.ca/jd-gui/downloads/jd-gui-0.3.5.windows.zip 

Win32 Reverse Engineering Tutorial#1: Fishing hardcoded password from a simple crackme

Java Reverse Engineering Tutorial#3: Cracking simple password check using bytecode patching

Aim:

In this tutorial we will learn how to patch the bytecode present in the class file of the simple crackme which we used in the previous tutorial.

Input:

You are given a simple crackme (Java .class file)

Tools:

• JavaBite - My favourite Java bytecode viewer/editor

Tutorial:

1. Lets first run the given crackme file (SimplePasswordCheck.class) and see what happens:

2. If we type "john" as password, it results in "ACESS DENIED" that means the password "john" is wrong.

3. Now open the class file in JavaBite by navigating to 'Classes | Add Java Class' in the menu. We will not use any java decompiler(like we did in previous tutorial) as we are going to study the class file at a more granular i.e. assembly(java opcode) level.

4. After opening the file you will see something like this:

5. In the left-hand side column, expand the tree by navigating from the class file to 'Methods | main'. After selecting 'main', the bytecodes of 'main()' method will be loaded in the right-hand side column. This is the opcode/assembly representation of the body of the 'main()' method. After loading, it should like this:

6. In the loaded bytecode, there are 3 columns:

1. '#' - The bytecode index (in hex).
2. 'ByteCode' - The actual hex representation of the bytcode.
3. 'Disassembled' - The disassembled representation of the java opcodes.

7. All the words like 'new', 'dup', 'getstatic', 'invokespecial', 'astore_1', 'ldc', 'invokevirtual', 'ifeq', 'goto', 'return' are infact the java opcodes. In order to understand them properly you should go through the 'Java Virtual Machine Instruction Set'.

8. As we have know from the previous tutorial that this crackme has 'shubham' as the password, we see the same string as being the argument to 'ldc' instruction at bytecode index '000B' in the loaded bytecode.(See below):

#	ByteCode	Disassembled
000B	1205	ldc #0005<shubham>

See the specification for the 'ldc' instruction at http://docs.oracle.com/javase/specs/jvms/se5.0/html/Instructions2.doc8.html

Short Explanation: The argument (number) '0005' is a reference to the string literal "shubham" in the constant pool of the loaded class file.

9. Traversing down in the loaded opcodes, we see a line of our interest the 'ifeq' check ! This is the appropriate line to patch as it is a validation check for the password.

#	ByteCode	Disassembled
0020	99000E	ifeq 0000002E

See the specification for the 'if<cond>' instruction at http://docs.oracle.com/javase/specs/jvms/se5.0/html/Instructions2.doc6.html

Short Explanation: The eq succeeds if and only if value = 0. That means if the comparison with 0(false) succeeds then it branches to the address given in the argument. So in above e.g., if the condition is false then it jumps to bytecode index '0000002E' that is at line:

002E          B20006          getstatic #0006<java.io.PrintStream java.lang.System.out>'

10. Next we see that the string "ACCESS DENIED :-(" is loaded. This confirms that the current line(bytecode index '0031') is the line inside the 'else' block of the 'if-else' statement.

11. So we now, actually patch the 'ifeq' line at bytecode index '0020' as shown below:

 Select the line. Righclick and choose 'Edit instruction'.

12. Now the 'Edit Instruction' box will pop up. Select 'ifne' from the 'Instruction' dropdown list.

13. Also double click the 'BRANCH_OFFSET' item in the 'Parameters' tab and a 'Edit Branch Offset' box will pop up. Select '002E - getstatic' from the 'Branch to line' dropdown list of the 'Branch Offset' tab.(see below)

14. Thats it! 

Conclusion:

We have changed the 'ifeq' conditional instruction to the 'ifne' conditional instruction i.e. we have inverted the conditional check. But why ? What we have done is that we have patched the crackme such that for every password input other than the original("shubham") the crackme will result in displaying the message "ACCESS GRANTED :-)" that means for any password(except original) the true case of if-else check is executed.

Notes:

If you have not understood this tutorial then you must be lacking the knowledge of Java opcodes. Please go thoroughly from the 'Java Virtual Machine Instruction Set'.

Downloads/Links:

• JavaBite
• Java Virtual Machine Instruction Set

Java Reverse Engineering Tutorial#2: Cracking simple password check using decompiler

Aim:

To learn how to use the decompiler in reverse engineering.

Input:

You are given a simple crackme (Java .class file)

Tools:

• jd-gui Java Decompiler

Tutorial:

1. Lets first run the given crackme file (SimplePasswordCheck.class) and see what happens:

2. If we type "john" as password, it results in "ACESS DENIED" that means the password "john" is wrong.

3. Open the class file (SimplePasswordCheck.class) in jd-gui decompiler. You will see the following decompiled code:

import java.io.DataInputStream;
import java.io.PrintStream;

class SimplePasswordCheck
{
  public static void main(String[] paramArrayOfString)
    throws Exception
  {
    DataInputStream localDataInputStream = new DataInputStream(System.in);
    String str1 = "shubham";

    System.out.println("\nPlease enter your password: ");
    String str2 = localDataInputStream.readLine();

    if (str2.equals(str1))
    {
      System.out.println("\nACCESS GRANTED :-) ");
    }
    else
    {
      System.out.println("\nACCESS DENIED :-( ");
    }
  }
}

4. The string "shubham" is assigned to String variable 'str1' and the input password is taken in String variable 'str2'.

 5. There is a simple if-else check to compare if 'str1' and 'str2' are equal that means the string "shubham" is a hardcoded password !!

6. So we have fished out the hardcoded password from the decompiled code of the class file. Lets try this fished password to check if it works:

Conclusion:

This tutorial covered how to fish out the password from a class file by using a decompiler. However such technique of using only decompilation is not feasible in complex(obfuscated) programs. In such a case you may need to use other techniques like patching the actual and appropriate bytecode in the class file by studying the check/validation process at a more granular level.

The purpose of this tutorial was to make you understand the use of decompiler in reverse engineering, understand the scope of finding hardcoded password.

However, in the 'Java Reverse Engineering Tutorial#3' , we will reverse engineer this very same crackme with a different approach - Java bytecode patching. This will clear the significance of using both the techniques.

Notes:

In case you are unable to run the given .class file crackme, you can compile for yourself the sourcefile(SimplePasswordCheck.java) for this tutorial.

Downloads:

• JD-GUI Java Decompiler
• SimplePasswordCheck.class
• SimplePasswordCheck.java

Java Reverse Engineering Tutorial#1: Study of Boolean Datatype Size

class BooleanSize
{
 public static void main(String args[])
 {
  boolean myboolean;
  
  myboolean=true;
 }
}

C:\Program Files (x86)\Java\jdk1.6.0\bin>javac BooleanSize.java

class BooleanSize
{
  public static void main(String[] paramArrayOfString)
  {
    int i = 1;
  }
}