| name | analyzing-blackbox-android-apk |
| description | Reconstruct the logic of Android apps from an .apk (or .dex/.jar). Covers manifest/entrypoint analysis, jadx Java decompilation, smali inspection, native .so analysis, and finding network endpoints, secrets, and obfuscated logic. Use for Android apk/dex targets. |
| license | Apache-2.0 |
| metadata | {"domain":"reverse-engineering","formats":"apk, dex, jar"} |
Analyzing Black-Box Android APK
Scope
Android .apk packages (zip of DEX + resources + native libs), bare .dex, and
.jar. Reconstruct app logic, entrypoints, and external interactions statically.
Workflow
-
Triage the apk. Then unpack: unpack mode=apk. This runs:
apktool → decoded AndroidManifest.xml, resources, and smali under
<apk>.apktool/.jadx → readable Java sources under <apk>.jadx/sources/.
-
Read the manifest (<apk>.apktool/AndroidManifest.xml):
package, android:debuggable, usesCleartextTraffic.- Permissions = capability hint (INTERNET, SMS, LOCATION, CONTACTS, etc.).
- Entrypoints: launcher
<activity> with MAIN/LAUNCHER intent, <service>,
<receiver> (BOOT_COMPLETED → persistence), <provider>. Note exported
components (android:exported="true") — attack/automation surface.
-
Trace logic in Java (grep/read the jadx sources):
- Start at the launcher Activity's
onCreate, Application onCreate, and any
onReceive/onStartCommand.
- Network:
okhttp, Retrofit, HttpURLConnection, WebView.loadUrl,
URL(...). Pull endpoints with strings_scan on the apk and grep in sources.
- Storage/secrets:
SharedPreferences, SQLite, hardcoded keys/tokens,
BuildConfig fields, res/values/strings.xml, assets/.
- Crypto:
javax.crypto.Cipher, MessageDigest, Base64 — find key derivation.
-
De-obfuscate. ProGuard/R8 renames to a.a.a. Use cross-references and
string decryptors: locate the static String decrypt(...)/Base64+XOR helper,
read it, and apply by hand. Reflection (Class.forName, getMethod.invoke)
hides calls — resolve the target class/method from nearby string constants.
-
Native code. .so files in lib/<abi>/ hold real logic for protected apps
and JNI methods (native Java methods, JNI_OnLoad). Extract a .so and switch
to the analyzing-blackbox-elf-object skill (decompile/disasm/symexec).
-
DEX-only / packers. Bare .dex → unpack mode=apk still drives jadx. Known
packers (jiagu, bangcle) decrypt DEX at runtime; statically, inspect the
Application class and assets/ for the encrypted payload and the loader.
Report
Package & permissions · entrypoints (activities/services/receivers) · network
endpoints & protocols · secrets/keys/crypto · obfuscation scheme · native-lib
logic · overall behavior & findings.
