APK reversing (unpack → patch → hook)

When it applies

You have an APK and a device/emulator you're authorized to test (tradecraft-scope-roe, scope.txt), and the job is mechanics: read the logic, locate a check, patch and repackage, or hook the runtime. For the broader what-to-test coverage map, work mobile-android-assessment alongside — this skill is the reverse-engineering toolchain it routes into.

Why it works

An APK is a zip of DEX bytecode plus resources. DEX decompiles to near-readable Java (jadx) and round-trips losslessly through smali (apktool), so you can read at the Java level but patch at the smali level and rebuild. Anything the app hides from static reading — decrypted strings, runtime checks, pinning — yields to Frida instrumentation on a rooted/emulated device.

Method

Ready-to-adapt Frida hook recipes (crypto, OkHttp, pinning, root/emulator/anti-debug bypass, storage): see cheatsheet.md next to this file.