Reverse-Engineering apps on the device - how far can we go?
summary
An app on device opens another app’s APK from PackageManager.publicSourceDir, treats it as a zip to read assets, uses Resources.getResourcesForApplication and a probing loop over resource IDs to enumerate and load strings, drawables and booleans, reads assets via assets.list, extracts classes.dex files and writes them out, loads them with DexClassLoader and Jake Wharton’s dex-member-list to enumerate classes and members, uses reflection to instantiate and invoke methods, and clones a layout inflater with CONTEXT_IGNORE_SECURITY* to inflate and display another app’s layouts — all without a desktop debugger.
AI-written summary · about
chapters (15)
- 0:00Introduction to reverse engineering
- 0:57Understanding Android sandboxing
- 1:39Exploring APK contents
- 3:04Reading resources from APKs
- 7:14Extracting resource values
- 8:18Demo of resource extraction
- 9:05Accessing assets from other apps
- 10:29Analyzing DEX files
- 12:34Loading and executing code
- 15:43Demo of code execution
- 16:46Loading layouts from other apps
- 18:30Ignoring security restrictions
- 19:15Demo of layout inflation
- 20:20Manipulating loaded views
- 20:43Key takeaways and conclusion
related talks
33mReverse - Engineering apps on the device - how far can we go?
38mReverse Engineering is not just for hackers
45mReverse engineering mobile apps: how, why, and what now?
29mA day in the life of a mobile reverse engineer
14mBeginners Guide to Reverse Engineering Android Apps
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
47mAttacking Android Applications
37mThe Art of Hiding Sensitive Info in Plain Sight