Mobile app reverse engineering — what defenders need to know

Why this matters

Most mobile apps can be reverse-engineered by a determined attacker: extract IPA/APK, disassemble with Ghidra/IDA, instrument with Frida. The defender's job is to make this expensive: code obfuscation (R8/ProGuard, LLVM-based), root/jailbreak detection (multiple checks), anti-debug, integrity self-checks. None individually prevent reversal; combined they raise the bar.

Demo

Frida workflow: install frida-server on rooted/jailbroken device, write a JS script that hooks verify_signature() and forces return true, attach to app. App now thinks any signature is valid. Defence: detect Frida (multiple methods), refuse to run on rooted devices, integrity-check the loaded code segments.

Try it yourself

1. Install Frida and walk through Frida's tutorial. Hook a method in a sample app.
2. Read OWASP Mobile Application Security Testing Guide (MASTG). Note the long list of defences.
3. Pick one defence (e.g. Frida detection). Build it into a sample app. Test against Frida.

References

• Frida
• OWASP MASTG