https://th4mjeed.github.io/tags/android/ Recent content in Android on Home Hugo en Thamjeed Sat, 18 Jul 2026 00:00:00 +0000 https://th4mjeed.github.io/posts/apk_reverse_engineering/ Sat, 18 Jul 2026 00:00:00 +0000 https://th4mjeed.github.io/posts/apk_reverse_engineering/ <hr> <h4 id="target-mobiflix-android-app-commobiflixmobile">Target: Mobiflix Android App (<code>com.mobiflix.mobile</code>)</h4> <p><strong>Date:</strong> July 18, 2026<br> <strong>Researcher:</strong> thamjeed<br> <strong>Environment:</strong> Fedora WSL2 on Windows 11, Physical Android device (Xiaomi POCO, Android 13, arm64)<br> <strong>Scope:</strong> Educational — understanding mobile app architecture, API design, native library obfuscation, and dynamic instrumentation techniques.</p> <hr> <h2 id="overview">Overview</h2> <p>This document is a complete, step-by-step writeup of reverse engineering an Android streaming application from scratch. The goal was to understand:</p> <ul> <li>Where the app fetches its content from</li> <li>How the app protects its API endpoints</li> <li>What encryption scheme is used to hide configuration</li> <li>How certificate pinning is implemented and bypassed</li> <li>The full API surface area of the backend</li> </ul> <p>The process combined static analysis (decompiling the APK and reading Java/smali code) with dynamic analysis (Frida instrumentation, mitmproxy traffic interception).</p>