Basics

Android Reverse Engineering Basics

• Talk: https://www.youtube.com/watch?v=NrxTBcjAL8A
• Udemy: https://www.udemy.com/course/hacking-and-pentesting-android-applications/
• Cheatsheet: https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet
• Vuln APKs:
  • https://pentester.land/cheatsheets/2018/10/12/list-of-Intentionally-vulnerable-android-apps.html
  • https://www.linkedin.com/pulse/10-vulnerable-android-applications-beginners-learn-hacking-anugrah-sr
  • https://securityonline.info/allsafe-intentionally-vulnerable-android-application/
• Blogs:
  • https://www.ragingrock.com/AndroidAppRE/
  • https://oldbam.github.io/
  • https://secrary.com/android-reversing/

Emulator

Genymotion

Activities

• Screens of your phone
  • Open the camera → one activity
  • Go from camera to camera settings → screen changes →another activity

Intent

• Communication between Activities
  • Message objects that request the Android runtime to start an activity, or another app component in your app or some other app
• Implicit Intent
  • Example: options of how you want to view an image or open a URL (duckduckgo, chrome, etc.)
• Explicit Intent
  • Example: when you don't get asked how to view a file (maybe bc that's the only app that supports opening this file)

Broadcast Receivers

• When an app is "listening" to a broadcast, e.g. low battery or GPS location high latitude

Services

• Applications that performs long-running operations, usually in the background
• No user interface (unlike Activities)