Reverse - Engineering apps on the device - how far can we go?
summary
Demonstrates concrete limits: on an unrooted device one app can read another app’s APK via the package manager, unzip it with Java zip APIs, enumerate classes.dex strings using the Android DX parser, disassemble with Baksmali, list classes with Dex Member List, load and invoke code with DEXClassLoader, and inflate target layouts by creating a context with INCLUDE_CODE and IGNORE_SECURITY. Works live against ForkHub — images, strings and Moshi.builder.toString execute as proof of life — while private internal files and keystores remain protected; external files are readable with permission.
AI-written summary · about
chapters (13)
- 0:00Introduction to reverse engineering
- 1:25App sandboxing model
- 3:29Accessing APK files on device
- 8:04Extracting resources from apps
- 10:29Analyzing DEX files
- 14:39Extracting strings from DEX
- 16:43Disassembling DEX to Smali
- 17:47Loading and executing code
- 21:16Executing methods from other apps
- 22:19Loading layouts from other apps
- 25:27External storage and file ownership
- 30:00Browsing external storage files
- 31:48Security implications and takeaways
related talks
21mReverse-Engineering apps on the device - how far can we go?
38mReverse Engineering is not just for hackers
29mA day in the life of a mobile reverse engineer
47mAttacking Android Applications
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
45mReverse engineering mobile apps: how, why, and what now?
14mBeginners Guide to Reverse Engineering Android Apps
28mSecure Development whit Android