const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/ANDROID" date="2026-08-19" title="Android on the authorized desk" lede="An APK is a zip. jadx is a hypothesis about Java. The interesting trust boundary is often a .so. Combine them in that order."/>
<P>Android reverse engineering has a ritual that wastes time: dump everything into jadx, screenshot a class named <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>CryptoUtil</span>, ship. The Java layer is where UI and Retrofit live. Keys, pinning, and protocol blobs frequently live in JNI.</P>
<Callout>Device and APK from the customer, or a store build they named in the letter. We do not sideload onto employee phones “to see.”</Callout>
<H2>The tools</H2>
<H3>apktool</H3>
<P>Decode resources and smali. You need it when the question is “what extra does the manifest grant” or “which layout hides the debug panel.” It is not a Java decompiler.</P>
<H3>jadx</H3>
<P>Best-effort Java from DEX. Readable, sometimes wrong, always incomplete for obfuscated control flow. Use it to find the JNI declarations and the network wrappers. Do not treat method names after ProGuard as truth without the mapping, and do not assume you have the mapping.</P>
<H3>baksmali / dexdump</H3>
<P>When jadx gives up. Smali is ugly and honest.</P>
<H3>Ghidra / IDA on .so</H3>
<P>After you unzip lib/armeabi-v7a or arm64-v8a. This is the same native desk as firmware, plus JNI_OnLoad and RegisterNatives. Combination with the Java layer: jadx tells you the Java name; the .so tells you what it actually does.</P>
<H3>Frida (authorized runtime)</H3>
<P>Confirm a JNI argument, dump a buffer the static pass already found, watch which cert store is consulted. We document certificate pinning, root checks, and Play Integrity as boundaries. We do not ship a “pinning bypass tutorial.” If the engagement is “does the broker still run when the Java layer is lied to,” that is a scoped test, and the method stays in the report.</P>
<H2>Combination</H2>
<Code lang="flow.txt">{`APK (zip)
  ├─ AndroidManifest.xml     apktool / aapt
  ├─ classes.dex             jadx  → JNI names, API clients
  ├─ assets / res            config, sometimes a second protocol
  └─ lib/*/*.so              Ghidra → confirm with Frida on a lab device`}</Code>
<Ul items={[
'Manifest first: components exported, permission set, cleartext traffic.',
'jadx second: find native methods and the HTTP stack.',
'.so third: that is often the protocol.',
'Runtime last, and only on a lab install.'
]}/>
<H2>What “Android RE” is not</H2>
<P>It is not cracking paid apps. It is not a Play Integrity bypass cookbook. It is: what does this client send, what does it trust, what can a modified client on a device you own still make the server accept. The last question is a server question. If the server accepts a stripped client, the pin was theater.</P>
<Related items={[
['post-re-stack.html','The reverse-engineering desk'],
['post-re-dynamic.html','Static vs dynamic']
]}/>
</>;
}
window.Article=Article;
mountPost();