How to Reverse Engineering an Android App
By: Mahmud Ahsan
Tags: Software Engineering, Android, Hacking, Security, Android App Development

Video Tutorial

Here are the steps we will follow:

Download an APK file from Google Play Store (it could be any APK file)

Using some free tools, we will reverse engineer the APK file to see the code.

If the APK file is protected using any premium software, then we can not reverse the code actually, or if the code is obfuscated then it will also be difficult to read the code after reverse engineering.

APK stands for the Android application package, a file format used by the Android operating system for distribution and installation.

Disclaimer: This tutorial is for educational purposes. During this demonstration, we selected an application APK file from the Google Play Store. If this chosen APK file is not working, try a different one or may use your own. There is no intention to harm or tamper with the APK file we chosen from the Google Play Store.

Step 1:

We will use the dex2jar software.

Let’s download dex2jar software from the following link: https://sourceforge.net/projects/dex2jar/.

software from the following link: https://sourceforge.net/projects/dex2jar/. If you want to see the code there is a GitHub link, that is https://github.com/pxb1988/dex2jar

This is a zip file and in my desktop->demo3 directory I put the unzipped directory of this zip file.

Step 2:

We need to download JD-GUI software. You can visit the following link http://java-decompiler.github.io/ and in the download section based on your operating system, you can download the software.

I store the software in my desktop->demo3 directory.

dex2jar-2.0 and jd-gui directories within demo3 directory

Step 3:

We need to target any android app. So in this case I am targeting EnglishScore: Free British Council English Test app from the following google play store link. https://play.google.com/store/apps/details?id=com.englishscore

Step 4:

We need to download the APK file.

Visit the following site https://apkpure.com/region-free-apk-download

On the website, at the top text field, paste the google play store app link and click download .

and click . It will take some time, and will show you another download link. Use that link to download the APK file.

Download link generated

After downloading store the app in demo3->dex2jar-2.0 directory

The APK file is placed within dex2jar-2.0 directory

Step 5:

Open your terminal if you use mac or open your Windows PowerShell if you use windows.

In the terminal, go to the target directory. In my case it will be: cd /Users/mahmud/Desktop/demo3/dex2jar-2.0

Now fix the permission of all files by pasting the following commands:

chmod 0777 *

Now type ./d2j-dex2jar.sh and then type Eng and click tab to get the full file name. EnglishScore\ Free\ British\ Council\ English\ Test_v1.00.32_apkpure.com.apk .

and then and to get the full file name. . Now click enter. It will take some time, and you will see a new file named

EnglishScore Free British Council English Test_v1.00.32_apkpure.com-dex2jar.jar is created.

File Structures and Commands in Terminal

Step 6:

Now go to your jd-gui->build->libs directory. And in my case, if I double click jd-gui-1.6.1.jar you will see the following interface of the app.

directory. And in my case, if I double click you will see the following interface of the app. Now drag and paste the EnglishScore Free British Council English Test_v1.00.32_apkpure.com-dex2jar.jar file within the app and you will see the following things.

Reversed Engineering Code

If you click the com section, you will see what 3rd party libraries this app is used.

Also in this app, if you click englishscore section, you will see the source code of the app.

Now click any file, for example, BritishCouncil.class file and you will see the actual code of the app. If this app was protected by any premium tool, or even obfuscated the code before releasing the app, we couldn’t easily understand the code after reverse engineering.

But unfortunately, many android app developers didn’t know about reverse engineering and spying eyes can easily reverse engineer the app.

So it is important to know by all android developers.

Conclusion

If you click distinct classes of this application, you can see all the code. Now think, if you are an android developer, you are developing a financial or banking app and you didn’t use any obfuscation techniques or especially for financial type app; you didn’t use any protection then how easy it is for hackers to hack your application or breach the security right?

So I hope you understand how vulnerable our app is. If you want to know how to protect an Android app from reverse engineering, check the following article.