Mobile Application Reverse Engineering Research Analysis

Overview

This repository documents a deep static security assessment and reverse engineering analysis performed on a production mobile application.

The research focused on reconstructing the application's internal architecture, identifying backend communication workflows, analyzing authentication mechanisms, inspecting local storage implementations, and mapping the networking stack through APK decompilation and smali bytecode analysis.

The assessment was conducted in a controlled research environment strictly for educational and defensive security research purposes.

---

Research Objectives

The primary objectives of this assessment included:

• Mobile APK reverse engineering
• Smali bytecode inspection
• Backend communication analysis
• Authentication workflow reconstruction
• Session management analysis
• Secure storage inspection
• Networking stack identification
• Endpoint discovery
• Mobile application architecture mapping
• Runtime interception preparation

---

Technologies & Frameworks Identified

Networking Stack

The application utilizes:

• OkHttp3
• HTTP form-based authentication
• Cookie-based session management
• ASP.NET backend communication architecture

Observed Networking Components

okhttp3.OkHttpClient
okhttp3.Request
okhttp3.FormBody
okhttp3.CookieJar
okhttp3.CertificatePinner

---

Reverse Engineering Workflow

1. APK Decompilation

The APK was decompiled to extract:

• Smali bytecode
• AndroidManifest.xml
• Internal package structures
• Resource files
• Application metadata

Tooling

apktool d app.apk

---

2. Static Smali Analysis

Static analysis was performed across:

smali/
smali_classes2/

The assessment identified multiple internal modules related to:

Networking
Storage
Authentication
UI Components
Session Handling

---

Key Findings

Backend Communication Analysis

The application communicates with a remote backend infrastructure over HTTPS.

Observed functionality included:

• Authentication requests
• Captcha handling
• Attendance retrieval workflows
• Academic data requests
• Session persistence handling

---

Authentication Workflow Reconstruction

The login workflow was reconstructed through static inspection of request structures and ASP.NET state management mechanisms.

Identified Login Parameters

txtUserName
txtPassword
__VIEWSTATE

The application appears to rely on:

• ASP.NET ViewState handling
• Session cookies
• Form-based authentication requests

---

Local Storage Analysis

The application implements encrypted local storage using:

androidx.security.crypto.EncryptedSharedPreferences

Encryption Schemes Identified

AES256_SIV
AES256_GCM

Storage Operations Observed

The application stores:

• Session information
• Authentication state
• Persistent string values
• Boolean flags
• Timestamp values
• Float-based preference data

---

Internal Components Identified

Storage Layer

PrefsManager.smali

Networking Layer

OkHttpClient.smali
Request.smali
FormBody.smali
CookieJar.smali
CertificatePinner.smali

---

Security Observations

Positive Security Practices

• EncryptedSharedPreferences implementation
• Structured networking abstraction
• HTTPS-based communication
• Session persistence controls
• Certificate pinning implementation presence

Potential Exposure Areas

• Backend endpoint exposure
• Static request parameter discovery
• Session workflow reconstruction
• Request structure visibility
• Cookie handling exposure

---

Analysis Techniques Used

Static Analysis Techniques

Performed using:

• Apktool
• Smali inspection
• String extraction
• Endpoint enumeration
• Manual bytecode tracing
• Network stack reconstruction

Example Enumeration Commands

findstr /s /i "http" *.*
findstr /s /i "Request$Builder" *.*
findstr /s /i "SharedPreferences" *.*
findstr /s /i "Authorization" *.*
findstr /s /i "Cookie" *.*

---

Runtime Analysis Preparation

The research also included preparation for runtime interception and traffic analysis using:

• Burp Suite
• Frida
• TLS interception workflows
• Dynamic request tracing
• Runtime instrumentation concepts

---

Research Methodology

The assessment followed a layered mobile application security research methodology:

1. APK extraction
2. Package enumeration
3. Smali reconstruction
4. Network stack identification
5. Authentication flow tracing
6. Secure storage analysis
7. Endpoint discovery
8. Runtime interception preparation

---

Skills Demonstrated

This research demonstrates practical experience in:

• Android reverse engineering
• Mobile application security analysis
• APK decompilation
• Smali bytecode inspection
• Android networking analysis
• Authentication mechanism analysis
• Secure storage assessment
• Mobile security research methodology

---

Disclaimer

This repository is intended strictly for:

• Educational purposes
• Defensive security research
• Authorized application analysis
• Mobile application security learning

No unauthorized access, exploitation, or malicious activity was performed.

---

Author

Darsh Chatrani

• Cybersecurity Researcher
• Certified Penetration Tester (CPT v3)

Portfolio: https://rootdarsh-dev.vercel.app/

---

Keywords

Android Security
APK Reverse Engineering
Smali Analysis
Mobile App Security
Android Static Analysis
Cybersecurity Research
Android Networking Analysis
Mobile Security Assessment
Application Reverse Engineering