#Lastpass google authenticator backup codes apk#
#Lastpass google authenticator backup codes install#
#Lastpass google authenticator backup codes android#
#Lastpass google authenticator backup codes trial#

#Lastpass google authenticator backup codes android#

Just transfer frida-server to the emulator and run it as root.ĭownload frida-server with the correct architecture $ objection -g exploreĬom.thenticator on (Android: 8.0.0 ) # android sslpinning disable (agent ) Custom TrustManager ready, overriding SSLContext.init () (agent ) Found .TrustManagerImpl, overriding TrustManagerImpl.verif圜hain () (agent ) Found .TrustManagerImpl, overriding TrustManagerImpl.checkTrustedRecursive () (agent ) Registering job 458584. Hooking functionsīecause the emulator offers rooted images out of the box, there was no need to inject the Frida gadget into individual applications. Do keep in mind that it uses VirtualBox under the hood, so enable nested virtualization if you’re running this inside a VM.

#Lastpass google authenticator backup codes install#

It also offers a one-click installation of “Open GApps” and it’s virtual devices are rooted by default.īonus: I could just install both apps from the Play store. It does require an account, but it’s free for personal use.

#Lastpass google authenticator backup codes trial#

Lastly, The main LastPass application would refuse to authorize the authenticator app if it detected tampering with the authenticator app (which I was doing to load in the Frida gadget).Īfter some trial and error, I settled on using the Genymotion Android emulator. The main application also relies on the Google Play services, so a vanilla emulator wouldn’t work. The authenticator app relies on the actual LastPass main application for authenticating to your vault, and authorizing it to upload and download backups. Normally this would be pretty straight forward from here. Also, it will classify your phone as a “ USB device” even though it’s connected through WiFi. Note that the application will hang until you connect to the gadget. Now it’s simply a matter of uninstalling the old version, and installing the patched one. So make sure you have those properly set up.

#Lastpass google authenticator backup codes apk#

Rebuilding the APK with the frida-gadget loaded.īuilt new APK with injected loadLibrary and frida-gadgetĬopying final apk from /tmp/tmplw_i6t_6. to in current directory.ĭo keep in mind that it needs these tools available in your path to function properly: Writing patched smali back to: /tmp/tmplw_i6t_6.apktemp/smali/com/lastpass/authenticator/activities/SplashActivity.smaliĬreating library path: /tmp/tmplw_i6t_6.apktemp/lib/arm64-v8a locals countĬurrent locals value is 0, updating to 1: Reading smali from: /tmp/tmplw_i6t_6.apktemp/smali/com/lastpass/authenticator/activities/SplashActivity.smaliĪttempting to fix the constructors. Target class not specified, searching for launchable activity instead. Patcher will be using Gadget version: 14.2.13Īpp already has

Using latest Github gadget version: 14.2.13 Determining it using `adb `.ĭetected target device architecture as: arm64-v8a Then, simply $ objection patchapk -s base.apk Also check out the developer documentation for more detailed instructions. Simply enable both “ USB debugging” and “ Wireless ADB debugging” in the developer menu. You don’t even have to connect it to your PC via USB. However, there is a much easier approach if you have an Android phone and adb. This is the part were most tutorials tell you to go to some shady “ apk downloader” website to download the APK’s you want to examine. Maybe we can get our hands on that backup and use it? Let’s find out! Getting at the Android app The LastPass Authenticator app does support “backup up” all your 2FA codes to your LastPass vault though: The official advice is “disable it for all your accounts and re-enable it with a new 2FA application”. For some reason there is no official way to export all saved tokens from that app. Unless you also use LastPass Authenticator for your 2FA tokens.

Moving passwords over takes less than five minutes. LastPass offers an export feature, and other managers offer import features. Switching password managers is simple enough. I use LastPass on both my laptop and Android phone, so that would become a problem. However, they decided to no longer support more than one device type, unless you pay a hefty fee. I’ve been an avid user of LastPass for a few years now.

If you want to export all TOTP’s from the LastPass Authenticator app, use this script. Export TOTP’s from LastPass Authenticator