/ANDROID · 2026-08-19
Android on the authorized desk
An APK is a zip. jadx is a hypothesis about Java. The interesting trust boundary is often a .so. Combine them in that order.
Android reverse engineering has a ritual that wastes time: dump everything into jadx, screenshot a class named CryptoUtil, ship. The Java layer is where UI and Retrofit live. Keys, pinning, and protocol blobs frequently live in JNI.
Device and APK from the customer, or a store build they named in the letter. We do not sideload onto employee phones “to see.”
The tools
apktool
Decode resources and smali. You need it when the question is “what extra does the manifest grant” or “which layout hides the debug panel.” Java comes from jadx.
jadx
Best-effort Java from DEX. Readable, sometimes wrong, always incomplete for obfuscated control flow. Use it to find the JNI declarations and the network wrappers. Do not treat method names after ProGuard as truth without the mapping, and do not assume you have the mapping.
baksmali / dexdump
When jadx gives up. Smali is ugly and honest.
Ghidra / IDA on .so
After you unzip lib/armeabi-v7a or arm64-v8a. This is the same native desk as firmware, plus JNI_OnLoad and RegisterNatives. Combination with the Java layer: jadx tells you the Java name; the .so tells you what it actually does.
Frida (authorized runtime)
Confirm a JNI argument, dump a buffer the static pass already found, watch which cert store is consulted. We document certificate pinning, root checks, and Play Integrity as boundaries. We do not ship a “pinning bypass tutorial.” If the engagement is “does the broker still run when the Java layer is lied to,” that is a scoped test, and the method stays in the report.
Combination
APK (zip)
├─ AndroidManifest.xml apktool / aapt
├─ classes.dex jadx → JNI names, API clients
├─ assets / res config, sometimes a second protocol
└─ lib/*/*.so Ghidra → confirm with Frida on a lab device
- Manifest first: components exported, permission set, cleartext traffic.
- jadx second: find native methods and the HTTP stack.
- .so third: that is often the protocol.
- Runtime last, and only on a lab install.
What we answer
We do not crack paid apps, and we do not publish a Play Integrity bypass cookbook. Authorized Android RE asks what this client sends, what it trusts, and what a modified client on a device you own can still make the server accept. The last question is a server question. If the server accepts a stripped client, the pin was theater.