analyzing-blackbox-android-apk

name	analyzing-blackbox-android-apk
description	Reconstruct the logic of Android apps from an .apk (or .dex/.jar). Covers manifest/entrypoint analysis, jadx Java decompilation, smali inspection, native .so analysis, and finding network endpoints, secrets, and obfuscated logic. Use for Android apk/dex targets.
license	Apache-2.0
metadata	{"domain":"reverse-engineering","formats":"apk, dex, jar"}

Analyzing Black-Box Android APK

Scope

Android .apk packages (zip of DEX + resources + native libs), bare .dex, and .jar. Reconstruct app logic, entrypoints, and external interactions statically.

Workflow

1. Triage the apk. Then unpack: unpack mode=apk. This runs:

   • apktool → decoded AndroidManifest.xml, resources, and smali under <apk>.apktool/.
   • jadx → readable Java sources under <apk>.jadx/sources/.

2. Read the manifest (<apk>.apktool/AndroidManifest.xml):

   • package, android:debuggable, usesCleartextTraffic.
   • Permissions = capability hint (INTERNET, SMS, LOCATION, CONTACTS, etc.).
   • Entrypoints: launcher <activity> with MAIN/LAUNCHER intent, <service>, <receiver> (BOOT_COMPLETED → persistence), <provider>. Note exported components (android:exported="true") — attack/automation surface.

3. Trace logic in Java (grep/read the jadx sources):

   • Start at the launcher Activity's onCreate, Application onCreate, and any onReceive/onStartCommand.
   • Network: okhttp, Retrofit, HttpURLConnection, WebView.loadUrl, URL(...). Pull endpoints with strings_scan on the apk and grep in sources.
   • Storage/secrets: SharedPreferences, SQLite, hardcoded keys/tokens, BuildConfig fields, res/values/strings.xml, assets/.
   • Crypto: javax.crypto.Cipher, MessageDigest, Base64 — find key derivation.

4. De-obfuscate. ProGuard/R8 renames to a.a.a. Use cross-references and string decryptors: locate the static String decrypt(...)/Base64+XOR helper, read it, and apply by hand. Reflection (Class.forName, getMethod.invoke) hides calls — resolve the target class/method from nearby string constants.

5. Native code. .so files in lib/<abi>/ hold real logic for protected apps and JNI methods (native Java methods, JNI_OnLoad). Extract a .so and switch to the analyzing-blackbox-elf-object skill (decompile/disasm/symexec).

6. DEX-only / packers. Bare .dex → unpack mode=apk still drives jadx. Known packers (jiagu, bangcle) decrypt DEX at runtime; statically, inspect the Application class and assets/ for the encrypted payload and the loader.

Report

Package & permissions · entrypoints (activities/services/receivers) · network endpoints & protocols · secrets/keys/crypto · obfuscation scheme · native-lib logic · overall behavior & findings.