0Pricing
Ethical Hacking Academy · Lesson

Static Analysis of APKs

Decompiling.

Static Analysis of APKs is a free Ethical Hacking Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Static APK Analysis

Static analysis of an APK means inspecting its code and resources without running it. The goal is to recover readable source-like code from the compiled DEX.

This reveals hardcoded secrets, logic flaws, and the app's true behavior.

Decoding with apktool

apktool decodes an APK back into readable resources and smali (a human-readable form of DEX bytecode). It also decodes the binary AndroidManifest.xml.

Use it to read the manifest and to repackage modified apps.

apktool d app.apk -o app_src

Smali Code

Smali is the assembly-like language for Dalvik bytecode. It is verbose but lets you make precise edits, for example bypassing a check by changing a comparison.

You can patch smali and rebuild the APK to alter app behavior.

const/4 v0, 0x1   # force a boolean to true

Getting Java with jadx

jadx decompiles DEX directly to readable Java. The GUI version, jadx-gui, lets you browse classes, search strings, and follow method calls.

It is the fastest way to understand an app's logic.

jadx-gui app.apk

The dex2jar Path

An alternative pipeline converts DEX to a JAR with dex2jar, then opens it in a Java decompiler like JD-GUI.

jadx usually produces cleaner output, but dex2jar is useful when jadx struggles.

d2j-dex2jar app.apk -o app.jar

Hunting for Secrets

Decompiled code often contains hardcoded secrets: API keys, tokens, encryption keys, and backend URLs.

Search the source for keywords like password, secret, apikey, and http. Developers wrongly assume compiled code hides these.

grep -ri "api_key\|secret\|password" app_src/

Reviewing the Manifest

With the manifest decoded, check for:

  • Exported components.
  • android:debuggable="true".
  • android:allowBackup="true" (data can be extracted via backup).
  • Dangerous or custom permissions.

Network Security Config

The Network Security Configuration controls TLS behavior. A config allowing cleartext traffic or trusting user-added CAs weakens transport security.

Such settings make interception (a later topic) much easier.

<application android:usesCleartextTraffic="true">

Automated Scanning with MobSF

MobSF (Mobile Security Framework) automates static analysis. Upload an APK and it reports permissions, hardcoded secrets, insecure settings, and a risk score.

It is great for triage, though manual review still finds deeper issues.

Repacking and Re-signing

After patching smali, rebuild with apktool and re-sign the APK (Android refuses unsigned apps). Tools like apksigner or uber-apk-signer handle signing.

This workflow underpins tampering tests and runtime modifications.

apktool b app_src -o patched.apk
uber-apk-signer -a patched.apk

Deep Links and WebViews

Look for deep link intent filters and WebView usage. Misconfigured deep links can launch internal screens with attacker-controlled data.

WebViews with JavaScriptInterface or that load untrusted content can expose the app to injection and data theft. Both are common static-review findings.

Quick Check

Recall which tool gives readable Java directly from an APK.

Recap

You now understand static APK analysis:

  • Use apktool for smali and the decoded manifest; jadx for readable Java.
  • Hunt for hardcoded secrets and review the manifest for exported, debuggable, and backup flags.
  • Check the Network Security Config; use MobSF for automated triage.
  • Patch smali, then rebuild and re-sign to test tampering.

Next you will manipulate a running app with Frida.

Frequently asked questions

Is the “Static Analysis of APKs” lesson free?

Yes — the full text of “Static Analysis of APKs” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Static Analysis of APKs”?

Decompiling. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Static Analysis of APKs” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Android App Structure
  2. Static Analysis of APKs
  3. Dynamic Analysis with Frida
  4. Insecure Storage and Comms
← Back to Ethical Hacking Academy