Smali File Format

Overview

Smali is a human-readable assembly language for the Dalvik virtual machine used in Android applications. Named after the Icelandic word for "assembler," Smali provides a way to disassemble, analyze, and modify Android APK files at the bytecode level. It's essential for Android reverse engineering, security analysis, and application modification.

Technical Details

• MIME Type: text/plain
• File Extension: .smali
• Category: Code
• Created by: JesusFreke
• Related to: Android Dalvik VM, ART (Android Runtime)
• Paradigm: Assembly language, stack-based

Structure and Syntax

Smali files contain disassembled Dalvik bytecode with a syntax similar to other assembly languages, featuring class definitions, method implementations, and field declarations.

Basic Class Structure

.class public Lcom/example/MyClass;
.super Ljava/lang/Object;
.source "MyClass.java"

# interfaces
.implements Ljava/io/Serializable;

# instance fields
.field private name:Ljava/lang/String;
.field private age:I

# static fields
.field public static final TAG:Ljava/lang/String; = "MyClass"

# direct methods
.method public constructor <init>()V
    .locals 1
    
    invoke-direct {p0}, Ljava/lang/Object;-><init>()V
    
    return-void
.end method

# virtual methods
.method public getName()Ljava/lang/String;
    .locals 1
    
    iget-object v0, p0, Lcom/example/MyClass;->name:Ljava/lang/String;
    
    return-object v0
.end method

Data Types and Descriptors

# Primitive types
# V - void
# Z - boolean
# B - byte
# S - short
# C - char
# I - int
# J - long (64-bit)
# F - float
# D - double (64-bit)

# Object types
# Ljava/lang/String; - String object
# Ljava/lang/Object; - Object
# [I - int array
# [[Ljava/lang/String; - 2D String array

# Method signatures
# ()V - method with no parameters returning void
# (I)Ljava/lang/String; - method taking int, returning String
# (Ljava/lang/String;I)Z - method taking String and int, returning boolean

.method public example(Ljava/lang/String;I)Z
    .locals 3
    .param p1, "text"    # Ljava/lang/String;
    .param p2, "number"  # I
    
    # Method implementation
    const/4 v0, 0x1
    return v0
.end method

Variables and Registers

# Register types:
# vN - local variable registers
# pN - parameter registers
# locals directive specifies number of local registers

.method public calculateSum(II)I
    .locals 2    # declares v0, v1 as local registers
    # p0 = this (implicit for non-static methods)
    # p1 = first parameter
    # p2 = second parameter
    
    # Add parameters and store in v0
    add-int v0, p1, p2
    
    # Move result to v1
    move v1, v0
    
    # Return result
    return v1
.end method

Instructions and Operations

Arithmetic Operations

# Integer arithmetic
add-int v0, v1, v2        # v0 = v1 + v2
sub-int v0, v1, v2        # v0 = v1 - v2
mul-int v0, v1, v2        # v0 = v1 * v2
div-int v0, v1, v2        # v0 = v1 / v2
rem-int v0, v1, v2        # v0 = v1 % v2

# Immediate operations
add-int/lit8 v0, v1, 0x5  # v0 = v1 + 5
mul-int/lit16 v0, v1, 0x100 # v0 = v1 * 256

# Floating point operations
add-float v0, v1, v2      # v0 = v1 + v2 (float)
add-double v0, v1, v3     # v0/v1 = v1/v2 + v3/v4 (double, uses register pairs)

# Bitwise operations
and-int v0, v1, v2        # v0 = v1 & v2
or-int v0, v1, v2         # v0 = v1 | v2
xor-int v0, v1, v2        # v0 = v1 ^ v2
shl-int v0, v1, v2        # v0 = v1 << v2
shr-int v0, v1, v2        # v0 = v1 >> v2

Control Flow and Conditionals

# Conditional jumps
if-eq v0, v1, :label      # if v0 == v1 goto label
if-ne v0, v1, :label      # if v0 != v1 goto label
if-lt v0, v1, :label      # if v0 < v1 goto label
if-ge v0, v1, :label      # if v0 >= v1 goto label
if-gt v0, v1, :label      # if v0 > v1 goto label
if-le v0, v1, :label      # if v0 <= v1 goto label

# Zero comparison
if-eqz v0, :label         # if v0 == 0 goto label
if-nez v0, :label         # if v0 != 0 goto label

# Unconditional jump
goto :label

# Example method with conditionals
.method public checkValue(I)Ljava/lang/String;
    .locals 2
    .param p1, "value"    # I
    
    const/16 v0, 0xa      # v0 = 10
    
    if-ge p1, v0, :large_value
    
    const-string v1, "Small value"
    return-object v1
    
    :large_value
    const-string v1, "Large value"
    return-object v1
.end method

Object Operations

# Object creation
new-instance v0, Ljava/lang/StringBuilder;
invoke-direct {v0}, Ljava/lang/StringBuilder;-><init>()V

# Field access
iget v0, p0, Lcom/example/MyClass;->count:I     # v0 = this.count
iput v0, p0, Lcom/example/MyClass;->count:I     # this.count = v0

# Static field access
sget v0, Lcom/example/MyClass;->staticField:I   # v0 = MyClass.staticField
sput v0, Lcom/example/MyClass;->staticField:I   # MyClass.staticField = v0

# Array operations
new-array v0, v1, [I                            # v0 = new int[v1]
array-length v0, v1                             # v0 = v1.length
aget v0, v1, v2                                 # v0 = v1[v2]
aput v0, v1, v2                                 # v1[v2] = v0

# Object array operations
aget-object v0, v1, v2                          # v0 = v1[v2] (object)
aput-object v0, v1, v2                          # v1[v2] = v0 (object)

Method Invocation

# Instance method calls
invoke-virtual {v0, v1}, Ljava/lang/String;->charAt(I)C
move-result v2    # v2 = result of previous invoke

# Static method calls
invoke-static {v0, v1}, Ljava/lang/Math;->max(II)I
move-result v2

# Direct method calls (constructors, private methods)
invoke-direct {v0}, Ljava/lang/Object;-><init>()V

# Interface method calls
invoke-interface {v0, v1}, Ljava/util/List;->get(I)Ljava/lang/Object;
move-result-object v2

# Super method calls
invoke-super {p0, p1}, Lcom/example/BaseClass;->method(I)V

Advanced Features

Exception Handling

.method public riskyOperation()V
    .locals 2
    
    # Try block start
    :try_start
    # Risky code here
    const/4 v0, 0x0
    div-int v1, v0, v0    # Division by zero
    :try_end
    
    .catch Ljava/lang/ArithmeticException; {:try_start .. :try_end} :catch_handler
    
    return-void
    
    :catch_handler
    # Exception handling code
    const-string v0, "Division by zero error"
    return-void
.end method

Annotations

.class public Lcom/example/AnnotatedClass;
.super Ljava/lang/Object;

# Class annotation
.annotation system Ldalvik/annotation/Signature;
    value = {
        "Ljava/lang/Object;",
        "Ljava/io/Serializable;"
    }
.end annotation

.method public annotatedMethod()V
    .locals 0
    
    # Method annotation
    .annotation runtime Ljava/lang/Deprecated;
    .end annotation
    
    return-void
.end method

Inner Classes and Synthetic Methods

# Inner class definition
.class Lcom/example/OuterClass$InnerClass;
.super Ljava/lang/Object;
.source "OuterClass.java"

# Enclosing class reference
.annotation system Ldalvik/annotation/EnclosingClass;
    value = Lcom/example/OuterClass;
.end annotation

# Synthetic accessor method
.method static synthetic access$000(Lcom/example/OuterClass;)I
    .locals 1
    .param p0, "x0"    # Lcom/example/OuterClass;
    
    iget v0, p0, Lcom/example/OuterClass;->privateField:I
    
    return v0
.end method

Reverse Engineering Applications

APK Analysis Workflow

# 1. Extract APK contents
unzip app.apk -d app_extracted/

# 2. Convert DEX to Smali
baksmali d app_extracted/classes.dex -o smali_output/

# 3. Analyze Smali files
# Look for sensitive information, API keys, etc.
grep -r "password\|key\|token" smali_output/

# 4. Modify Smali code (if needed)
# Edit .smali files with text editor

# 5. Rebuild DEX from Smali
smali a smali_output/ -o classes.dex

# 6. Repackage APK
# Replace original classes.dex and repackage

Common Analysis Patterns

# Looking for API endpoints
const-string v0, "https://api.example.com"

# Finding encryption keys
.field private static final SECRET_KEY:Ljava/lang/String; = "hardcoded_key"

# Identifying reflection usage
invoke-static {v0}, Ljava/lang/Class;->forName(Ljava/lang/String;)Ljava/lang/Class;

# Finding native method calls
.method public native nativeMethod()I
.end method

# Locating obfuscated code patterns
.method public a(Ljava/lang/String;)Ljava/lang/String;
    # Obfuscated method names
.end method

Security Analysis

# Permission checks
invoke-static {p0, v0}, Landroid/support/v4/content/ContextCompat;->checkSelfPermission(Landroid/content/Context;Ljava/lang/String;)I

# Intent creation and data
new-instance v0, Landroid/content/Intent;
const-string v1, "com.example.SECRET_ACTION"
invoke-direct {v0, v1}, Landroid/content/Intent;-><init>(Ljava/lang/String;)V

# SharedPreferences access
const-string v0, "sensitive_data"
invoke-interface {v1, v0, v2}, Landroid/content/SharedPreferences;->getString(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;

Modification and Patching

Code Injection Example

# Original method
.method public authenticate(Ljava/lang/String;)Z
    .locals 2
    .param p1, "password"    # Ljava/lang/String;
    
    # Original authentication logic
    invoke-virtual {p0, p1}, Lcom/example/Auth;->validatePassword(Ljava/lang/String;)Z
    move-result v0
    
    return v0
.end method

# Modified method (bypass authentication)
.method public authenticate(Ljava/lang/String;)Z
    .locals 2
    .param p1, "password"    # Ljava/lang/String;
    
    # Log the attempt
    const-string v0, "AUTH"
    const-string v1, "Authentication bypassed"
    invoke-static {v0, v1}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I
    
    # Always return true
    const/4 v0, 0x1
    return v0
.end method

Adding Debug Output

# Insert logging statements
const-string v0, "DEBUG"
new-instance v1, Ljava/lang/StringBuilder;
invoke-direct {v1}, Ljava/lang/StringBuilder;-><init>()V
const-string v2, "Variable value: "
invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v1, p1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v1
invoke-static {v0, v1}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

Tools and Development Environment

Essential Tools

• baksmali/smali: Core disassembler and assembler
• apktool: APK disassembly and rebuilding
• jadx: Java decompiler with Smali support
• JADX-GUI: Graphical interface for code analysis
• Android Studio: IDE with debugging capabilities
• frida: Dynamic instrumentation framework

Development Workflow

# Disassemble APK
apktool d app.apk

# Navigate to smali directory
cd app/smali

# Edit smali files
vim com/example/MyClass.smali

# Rebuild APK
cd ..
apktool b app -o modified_app.apk

# Sign APK (for installation)
jarsigner -keystore debug.keystore modified_app.apk alias_name

Static Analysis Scripts

# Python script to analyze Smali files
import os
import re

def find_sensitive_data(smali_dir):
    sensitive_patterns = [
        r'const-string.*password',
        r'const-string.*key',
        r'const-string.*token',
        r'const-string.*secret'
    ]
    
    for root, dirs, files in os.walk(smali_dir):
        for file in files:
            if file.endswith('.smali'):
                filepath = os.path.join(root, file)
                with open(filepath, 'r') as f:
                    content = f.read()
                    for pattern in sensitive_patterns:
                        matches = re.finditer(pattern, content, re.IGNORECASE)
                        for match in matches:
                            print(f"Found in {filepath}: {match.group()}")

find_sensitive_data('smali_output/')

Best Practices

Analysis Approach

• Start with high-level class structure analysis
• Focus on entry points (Activities, Services, Receivers)
• Look for obfuscation patterns and naming conventions
• Identify sensitive operations and data flows
• Use dynamic analysis to complement static analysis

Code Modification

• Always backup original files before modification
• Test modifications on non-production devices
• Use consistent register naming and comments
• Validate bytecode correctness after changes
• Document modifications for future reference

Security Considerations

• Respect application licensing and terms of service
• Use reverse engineering for legitimate security research
• Be aware of legal implications in your jurisdiction
• Avoid distributing modified applications without permission
• Consider responsible disclosure for security vulnerabilities

Common Use Cases

Security Research

• Vulnerability analysis and penetration testing
• Malware analysis and detection
• Privacy assessment and data flow analysis
• Authentication bypass research

Development and Debugging

• Understanding third-party library implementations
• Debugging obfuscated applications
• Performance analysis and optimization
• Educational purposes and learning Android internals

Forensics and Investigation

• Digital forensics investigations
• Intellectual property protection
• Compliance verification
• Incident response and analysis

Smali continues to be an essential tool for Android security professionals, researchers, and developers who need to understand and analyze Android applications at the bytecode level.