Skip to main content

38. Android APK Reverse Engineering

With a single APK, you can extract all of an app's secrets. This is a recurring topic in CTF mobile categories.

Core Tools​

jadx — Decompiles an APK into Java code. Its GUI version makes analysis convenient.

jadx -d output/ target.apk

apktool — Extracts smali code and decompiles resources. Supports repackaging after a patch.

apktool d target.apk
apktool b output/ -o patched.apk

frida — Runtime hooking. Essential for bypassing SSL pinning and manipulating function return values.

Analysis Flow​

  1. Inspect Java code with jadx → explore the core logic
  2. Search for hardcoded keys/URLs with strings / grep
  3. Connect network traffic to a Burp Suite proxy
  4. Bypass SSL pinning → use frida-scripts
  5. Patch smali → remove root checks and license validation

CTF Tips​

  • Check for hidden hints in META-INF/
  • Pay attention to encrypted files in the assets/ directory
  • Many apps store tokens in shared_prefs XML

Ultimately, understanding code is the heart of reverse engineering. Tools are only a means.