This article introduces reverse engineering of Android apps: what it is, the tools used, and how to make your own app harder to reverse engineer.

What is reverse engineering?

Reverse engineering means taking something apart to understand how it works. In software, it means turning a compiled program back into a form a person can read, to study its behaviour. Security testers reverse engineer their own applications to find weaknesses such as hard-coded secrets and insecure logic.

Only reverse engineer applications you own or are authorised to test.

Android apps and APK files

Android apps are distributed as APK files. An APK is an archive, similar to a ZIP file, that contains the app's compiled code (.dex files), resources, assets, certificates and the manifest file.

Tools for reverse engineering an APK

• Apktool: decodes an APK's resources and code into a readable form, and can rebuild it.
• dex2jar: converts .dex files to Java .jar files.
• A Java decompiler: turns the .jar back into readable Java source.
• APK Analyzer: shows the contents and structure of an APK.

Installing and using Apktool (Windows)

1. Create a separate folder for Apktool.
2. Download the wrapper script from the Apktool repository and save it in that folder as apktool.bat.
3. Download the latest Apktool .jar from the Apktool downloads page, save it in the same folder, and rename it to apktool.jar.
4. Copy the APK you want to examine into the same folder.
5. Open a command prompt in that folder.
6. Run apktool d apk_filename.apk.
7. Apktool creates a folder with the same name as the APK, containing the decoded resources and code.

How to defend your app against reverse engineering

• Enable code shrinking and obfuscation in release builds (R8, which uses ProGuard rules). It removes unused code and renames classes, fields and methods to short, meaningless names, which makes the code much harder to read.
• Consider a commercial protection tool such as DexGuard, which adds string encryption and tamper detection.
• Do not rely on obfuscation to hide secrets. Keep API keys and credentials on your server, not in the app.

How Vooki Pro helps

• Once you know which APIs an app calls, Vooki Pro can security-test them.
• Build the requests in the API Builder, or import them as cURL, HAR or Postman.
• Finds hard-coded API keys and personal data returned by those APIs.

Frequently asked questions

Why reverse engineer an Android app?

To find hard-coded secrets, insecure storage and the back-end APIs the app depends on.

Is reverse engineering legal?

Only on apps you own or have explicit permission to test.

Related: API keys and secrets in front-end code · How to security-test a REST API from OpenAPI or Postman