Analyzing Android App Binaries - GDG Silicon Slopes Aug 2022

In this talk, we are going to analyze the structure of Android Package files (.apk), see how Android App Bundles (.aab) could help to reduce the app size, and take a look at the ways to reverse engineer Android apps.

We will work with a sample Android app that uses a modern tech stack including Kotlin and Jetpack Compose. We are going to decompile it, make a source code change and compile it back in order to launch an updated app on the device.

Transcript

1. Analyzing Android app binaries Pavlo Stavytskyi Google Developer Expert, Android
2. ▪ Google Developer Expert, Android About me 2
3. ▪ Google Developer Expert, Android ▪ Mobile Infrastructure at Lyft About me 3
4. 4 Agenda
5. ▪ Android package files Agenda 5
6. ▪ Android package files ▪ Reverse engineering Android apps Agenda 6
7. 7 Android package files
8. ▪ .apk .aab .aar files Android package files 8
9. ▪ .apk .aab .aar files ▪ They are all .zip files Android package files 9
10. 10 Demo
11. 11 Reverse engineering Android apps
12. ▪ APK Analyzer Reverse engineering Android apps 12
13. ▪ APK Analyzer ▪ dex2jar Reverse engineering Android apps 13
14. ▪ APK Analyzer ▪ dex2jar ▪ JD-GUI Reverse engineering Android apps 14
15. ▪ APK Analyzer ▪ dex2jar ▪ JD-GUI ▪ Apktool Reverse engineering Android apps 15
16. 16 APK Analyzer
17. 17 Demo
18. 18 dex2jar
19. ▪ brew install dex2jar dex2jar 19
20. ▪ brew install dex2jar ▪ d2j-dex2jar app-release.apk dex2jar 20
21. ▪ brew install dex2jar ▪ d2j-dex2jar app-release.apk ▪ JD-GUI dex2jar 21
22. 22 Demo
23. 23 Apktool
24. ▪ brew install apktool Apktool 24
25. ▪ brew install apktool ▪ apktool d app-release.apk Apktool 25
26. ▪ brew install apktool ▪ apktool d app-release.apk ▪ Make a change Apktool 26
27. ▪ brew install apktool ▪ apktool d app-release.apk ▪ Make a change ▪ apktool b -f -d app-release Apktool 27
28. ▪ keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000 Signing modified APK 28
29. ▪ keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000 ▪ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore app-release/dist/app-release.apk alias_name Signing modified APK 29
30. ▪ keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000 ▪ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore app-release/dist/app-release.apk alias_name ▪ jarsigner -verify -verbose -certs app-release/dist/app-release.apk Signing modified APK 30
31. ▪ https://github.com/Morfly/compose-arch-sample Sample project 31
32. 32 Q&A