Reverse engineering mobile apps: how, why, and what now?
summary
Shows a live workflow: unpack APK with apktool, decompile with JD-GUI/baksmali, inject a Frida hook to replace hasPaid() with a constant true and remove the ad container on an Android emulator, which works in memory; inspects iOS with Hopper and attempts a two-byte NOP patch in the simulator (demo fails intermittently). Finds base64 API tokens (== padding), recommends per-user tokens, ProGuard/DexGuard obfuscation tradeoffs, and native C for critical checks.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:35Michals background
- 2:04Agenda
- 2:35What is engineering
- 2:55What is the compilation
- 3:43Dynamic vs static analysis
- 5:05Static analysis tools
- 10:08Language differences
- 14:15Swift
- 15:06Defaults
- 15:17Smiley
- 15:37Decompiler
- 16:00Demo
- 21:15Assembly
- 28:48Obfuscators
- 33:00Bad practice
- 34:01How to store talking
- 35:10Security conference
- 35:46Is it worth it
- 36:44Not all is bad
- 38:10Resources
- 39:58Questions
related talks
47mAttacking Android Applications
38mReverse Engineering is not just for hackers
29mA day in the life of a mobile reverse engineer
29mA Day in the Life of a Mobile Malware Reverse Engineer
42mAttack & Defend Mobile Apps
54mUnwrapping the Truth: Analysis of Mobile Application Wrapping Solutions
43mAttacking Android Applications
21mReverse-Engineering apps on the device - how far can we go?