How to attack (and secure) an Android app: an introduction
summary
A tiny demo app with a Java and native password check reveals concrete techniques: static analysis with Jadx and the Ghidra decompiler finds the cleartext passwords; quick binary string hunting and smali edits via apktool let an attacker repackage and always return true; live injection with a Frida server and simple JavaScript hooks overrides both Java and JNI checks; and local GDB/Android Studio debugging changes return registers to force success. Defenses shown: signature checks, R8/ProGuard obfuscation, native obfuscators, runtime integrity checks and layered detections.
AI-written summary · about
chapters (11)
- 0:00Introduction to app attacks
- 1:32Reverse engineering basics
- 21:00Protecting against reverse engineering
- 24:48Repackaging attacks
- 37:54Defending against repackaging
- 40:21Hooking explained
- 44:09Frida demo for hooking
- 53:30Countermeasures for hooking
- 54:54Debugging as an attack vector
- 1:01:16Native debugging demo
- 1:05:12Final security recommendations
related talks
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
47mSecuring Android Applications
45mGoing Beyond Obfuscation: Advanced Techniques for Protecting Android Apps
38mAdvanced Techniques for Protecting Android Apps
43mAttacking Android Applications
47mAttacking Android Applications
28mSecure Development whit Android
42mAttack & Defend Mobile Apps