Android static analysis fundamentals: apktool, jadx and aapt2
You learn to examine an APK without running it: unpack the package, read the manifest and resources, browse the code with jadx, and turn embedded secrets and risky settings into a clean finding note.
Level 201 · 22 lessons · 18 practice labs
Lessons
Unpacking the package
- The static analysis workflow: what comes first
- unzip versus apktool: binary XML and the resource table
- Decoding with apktool: the folder layout and apktool.yml
- aapt2 dump: badging, permissions and resources
- Short task: decode three APKs and tabulate package name, version, min and target SDK
Manifest and configuration
- Security flags in the manifest: debuggable, allowBackup, usesCleartextTraffic
- Permission review: does the request match the function
- Deriving the exported surface from the manifest
- Reading the network security configuration
- Short task: pull five security findings from a manifest and rank them
Reading the code
- The jadx command line: the output folder and classes that fail
- Finding entry points: Application, launcher activity, exported components
- Searching code by pattern: URLs, keys, crypto and log calls
- Reading code with obfuscated names: what a.b.c means
- Following data flow: from input to a risky call
- Short task: find where the session token is stored by tracing it through the code
Secrets, resources and signature
- Hunting secrets in strings.xml, assets and the raw folder
- Third-party SDK inventory: recognising libraries from package names
- Signature and certificate check: debug certificates, scheme versions
- Writing a static finding: evidence, impact, fix
- Short task: find three embedded secrets in an APK and suggest a fix for each
Capstone
- Capstone: write the static review report for a parcel tracking app
Practice labs
- Decode an APK with apktool: Decode an APK and show where the manifest, smali and resources are in the output folder.
- Compare unzip output with apktool output: Open the same APK both ways and explain why the manifest is readable in only one.
- Script an identity table for three APKs: Use a script over aapt2 output to tabulate package name, version, SDK and permission count.
- Find the debug and backup flags in a manifest: Find the debuggable and allowBackup values in a decoded manifest and state their risks.
- Compare permissions with function: Match the permissions of the Mercanköşk Otelcilik booking app to its feature list and report the excess ones.
- Extract and rate five findings from a manifest: Write five findings from the flags, exported components and network configuration, each with a severity and a fix.
- Find the launcher activity with jadx: Decompile the APK with jadx and show the app's launch class.
- Find the class that sends the login request: Extract the class that calls the login endpoint and the fields it sends.
- Trace the token's path through obfuscated code: In an APK with obfuscated names, document the call chain from where the token is received to where it is stored.
- List every URL in the code: Use ripgrep to extract the URLs in the decompiled code and flag the test server.
- Find crypto and log calls by pattern: Write patterns that search for cipher modes and log calls and pick out the three risky results.
- Turn search patterns into a reusable checklist: Prepare a ten-pattern search file, run it on two different APKs and report the results with false alarms weeded out.
- Find the secret in a config file under assets: Find the file holding a service password in the decoded APK's assets folder.
- Produce a third-party SDK inventory: Recognise the SDKs in the app from package names and classify them as analytics, advertising or payment.
- Write fix advice for three embedded secrets: Find three secrets in an APK and state, with reasons, which must move to the server and which must be restricted.
- Write one finding as evidence, impact, fix: Turn the cleartext traffic permission into a three-part finding note.
- Turn a signature check into a finding: Write a finding, with output as evidence, for an APK signed with a debug certificate.
- Write the static report for a parcel tracking app: Review the Kuzeyyıldızı Kargo app and deliver a report with a summary, six findings and the fix order.
About this course
You learn to examine an APK without running it: unpack the package, read the manifest and resources, browse the code with jadx, and turn embedded secrets and risky settings into a clean finding note.
What you will learn
- Unpacking the package
- Manifest and configuration
- Reading the code
- Secrets, resources and signature
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.