Pieces0310

取证须让证物说话,莫妄以自我心证来给案情下定论.切忌画靶射箭,为找而找. 取证的根基仰赖经验与判断,在IT各领域的经验愈丰富,愈能看出端倪. 取证须善用工具,但不过度依赖工具.工具只能帮你缩小可能范围,但无法告诉你答案,仍需靠人进行分析判断.

首页 新随笔 联系 订阅 管理

Someone mentioned that APK Downgrade Extraction no longer works on Android 14, and regardless of the mobile forensic tool used, it is impossible to successfully extract data via APK Downgrade Extraction.

I'm curious about this issue and decide to find out what's going on. Take WhatsApp for testing, and I manually run the script step by step to conduct APK Downgrade Extraction on smartphone running Android 14. First of all, keep present version of the APK and rename it to "whatsapp.apk" instead of "base.apk".


Next, uninstall WhatsApp with "-k" parameter so as to keep the data safe and sound. Then  restart the phone in order to install the old version of the APK. The purpose was to utilize the allowBackup attribute to perform an ADB backup.


However, an error message appear during installation, indicating that Android 14 does not allow installation due to the target SDK version being too low. It seemed impossible to proceed.


Fortunately, there is a way to bypass this restriction by using certain parameter " --bypass-low-target-sdk-block "  to successfully install the APK. After that, I'm able to perform the backup and retrieve the chat messages of WhatsApp.


Finally, the original version of the APK needed to be installed to restore everything to its original state.








posted on 2024-05-19 16:17  Pieces0310  阅读(505)  评论(0)    收藏  举报