Reverse Engineering Apps

Reverse engineering is taking a finished app apart to understand how it works inside.

Attackers use it to find secrets, bypass checks, and discover vulnerabilities.

Apps are distributed as packages: an APK on Android or an IPA on iOS.

These are essentially archives that an attacker can unpack and explore.

Static analysis means inspecting the app without running it.

Attackers unzip the package and read its files, resources, and code to learn its structure and logic.

Tools can turn compiled code back into readable form.

On Android, a tool like jadx converts bytecode into Java-like source, revealing how the app behaves.

One of the first things attackers hunt for is hardcoded secrets.

API keys or URLs left in the code are easy to spot once decompiled, so never rely on hiding secrets in the app.

Dynamic analysis watches the app while it runs.

Attackers observe network traffic, memory, and function calls to see real values and behavior, not just static code.

Tools like Frida let an attacker hook into a running app and change its behavior on the fly.

They can skip a security check or read a secret value as it is used.

After understanding an app, an attacker may tamper with it.

They modify the code, repackage it, and distribute a cracked or trojanized version to other users.

Obfuscation renames and scrambles code so it is harder to read.

It does not make reversing impossible, but it slows attackers down and raises the effort required.

Apps can check whether they have been modified using integrity checks, and detect rooted or jailbroken devices.

When tampering is found, the app can refuse to run sensitive features.

The key lesson: assume the client can be reversed.

Keep secrets and enforce critical decisions on the server, where the attacker has no control.

What is the safest assumption when designing a mobile app's security?

Attackers reverse apps with static and dynamic analysis, decompilers, and hooking tools like Frida to find secrets and tamper.

Use obfuscation and integrity checks to slow them, but ultimately trust the server, not the client.