How does it work?

[loAnto98]

I don't understand this part '' the classes which holds these random private static fields in the array''. The first part is to enter the name of the app, but I don't understand what else needs to be entered. Do you have Telegram for private discussions? Thanks in advance, I've searched everywhere and you're the first to have fixed this issue.

[mawo95]

Sorry i dont have telegram, but discord (@mawocoder).
You have to enter the App name and also the target classes.

Pairip generates a bunch of classes in the classes.dex which only contains empty strings. The strings gets replaced at startup by pairip with important values, which the app needs to run.
Frida will hook these strings and save them so we can leter replace the empty classes with classes which already hold the right strings so we dont need pairip to do that anymore, so we can remove pairip

[G705-Ghilan]

but pairipcore.so prevent frida from listening on the app
will that still work ??

[mawo95]

Yes it will still Work.

You firstly run the app, and after it started and is running you start firda-server (the apk on the Emulator) and the node js program frida.js

[loAnto98]

I can't find you on discord, I would like some help

[mawo95]

I accepted your friend request. Please describe the issue here and also on discord (you can copy the Message)

[rubenvereecken]

@loAnto98 first, identify the encrypted files in the decompiled .apk

find base/assets -type f | grep -oE '[a-zA-Z0-9]{16}$'

-> shows 26 files for me

Second, look for those strings in the decompiled .smali files. Those classes you end up finding are the ones you're meant to add to this repository's frida.js. The goal will be to replace them with decrypted versions, found by running frida after the VM has started up and run successfully (so it doesn't crash straight away).

Note: one challenge I came across is, is that only 20 out of 26 strings were static fields in smali files. Two keys were in .so libraries. Others, dynamic. So replacing them was harder.

[hienngocloveyou]

I accepted your friend request. Please describe the issue here and also on discord (you can copy the Message)

I can not find you, please add me I need pairip service

[mawo95]

@EricTangs The App Crash can have several reasons, make sure to check the following Options:

1. Have you Changed the Startup class to the apps MainActivity instead of pairip vm runner in the AndroidManifest.json?

2. Double check if you have replaced all classes (check with the regex for classes with empty strings again)

3. Have you names the classes right? It should be Like the original (you can also copy paste the content of each class instead of replacing full Files)

4. The App might use more Security which detect the apk Signature Change (This isnt pairip related though and you removed pairip (U gotta find a solution for the other Security then))

[mawo95]

@EricTangs Yes this looks exactly right.
It means
stringName placeholder (--) value
With the first py program you can Transform this txt Format into smali files with the correct field names and values. Its normal that some Strings hold empty values ("").