Episode Details

The old playbook of decompiling Java doesn't work anymore. Modern Android apps hide their logic in monolithic ARM64 native libraries, demanding a new toolchain. In this episode, we break down the three layers of a modern APK, from the hollow Java shell to the obfuscated native code. We explore how the NSA’s Ghidra framework and the dynamic analysis toolkit Frida/Objection are used to trace API calls and disable SSL pinning. We also navigate the murky ethical and legal landscape of reverse engineering for unofficial integrations, distinguishing between reading the API contract and exploiting vulnerabilities.