The security analysis of an Android application normally requires a certain reverse engineering process. The APK is a compressed file. The first step would be to get the APK uncompressed and reverse it into DEX bytecode or Smali resource files. These can be seen as Android intermediate resource files. Then, the DEX can further be reversed into Java class in order to get the Java source code. The following diagram shows the process and related tools we will demonstrate in the coming section:
This is a list of the tools for the reverse engineering of APK and security analysis:
|
Tools |
Usage in security testing |
|
apktool_2.1.0.jar |
The APKTool is used to reverse the APK file into Smali, resource files and also extract the manifest.xml |
|
JADX |
It's used to reverse the APK file into Java source code... |