A day in the life of a mobile reverse engineer
summary
Shows how Google gets APKs from Play, OEM system images and alternative stores, scans 500k apps/day with ML then escalates ambiguous cases to manual reverse engineering. Demonstrates using unzip, smali/decompilers (JD/JADX/JEB), IDA and JADX for native analysis, and runtime inspection with Frida hooks. Gives a concrete sample: XOR/encrypted strings in DEX and native .so, staged asset APKs that download a rooting exploit and SMS exfiltration, and says it takes about two days to fully unpack and resulted in mass flagging.
AI-written summary · about
chapters (20)
- 0:00Introduction to mobile reversing
- 1:30Why Google reverses apps
- 4:21PHA and mobile threats
- 5:04Fetching applications for analysis
- 6:31Automated and manual analysis
- 7:13Demo of a malicious app
- 10:25Disassembling DEX files
- 11:52Decompiling to Java code
- 12:54String obfuscation techniques
- 14:38Obfuscation challenges
- 15:00Native libraries in malware
- 16:27Real-world obfuscation example
- 17:09Analyzing native code with IDA
- 21:47Multi-stage malware analysis
- 22:31Dynamic analysis methods
- 23:56Frida for code instrumentation
- 25:20Anti-analysis tricks
- 27:44Getting started in reversing
- 28:49Future of malware detection
- 29:11Closing and Q&A
related talks
29mA Day in the Life of a Mobile Malware Reverse Engineer
30mA day in the life of a mobile reverse engineer
45mReverse engineering mobile apps: how, why, and what now?
38mReverse Engineering is not just for hackers
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
47mAttacking Android Applications
21mReverse-Engineering apps on the device - how far can we go?
33mReverse - Engineering apps on the device - how far can we go?