Analyzing Akamai BMP 4.1.3 - Part 1 - For Noobs Learn
App showcase: Iberia 14.81.0 IDA Pro: 9.3 1. Initial analysis Well, I already had some prior knowledge of how Akamai worked, after loading the library in Ida, which I found very strange initially: ...

Source: DEV Community
App showcase: Iberia 14.81.0 IDA Pro: 9.3 1. Initial analysis Well, I already had some prior knowledge of how Akamai worked, after loading the library in Ida, which I found very strange initially: The library is over 2MB, and the low number of functions made me realize something was wrong. So I went to check the exports: I try disasm addresses of the exported functions: initializeKeyN @ 0x9d060 encryptKeyN @ 0x9d074 decryptN @ 0x9d18c buildN @ 0x9d394 <-- prob generates the sensor data The decompilation failed because this isn't even a functional arm64 instruction: 0x9d060: bytes=1094e857b4b328ef -> NOT a valid ARM64 instruction 0x9d394: bytes=a23908369f7bcc23 -> NOT a valid ARM64 instruction The bytes appeared to be random data, not opcodes. The native code is encrypted on disk. strings before: 2. Decompression using unicorn IDA only recognized 8 functions in the entire binary (of ~1.5MB of .text!). Among them: .init_proc @ 0x2cdc20 — function that runs automatically when the