Mobile applications
Take an APK apart: the manifest rules that define the attack surface, navigating DEX without decompiling it, and when to stop reading and hook.
By the end you can
- Read an APK's structure from its zip listing and say what each part implies
- Decode a binary AndroidManifest and identify every exported component
- State the export rule correctly, including the intent-filter default
- Follow a string to its load site and a method to its callers inside a DEX
- Decide between static reading and runtime hooking, and justify the choice
1. Read
2. Use the tools
In the order they come up while solving. Each opens the workspace tab that runs it.
APK and IPA analyzer: manifest, exported components, DEX xrefs
Open an Android APK or an iOS IPA in the browser: the parsed manifest with every exported component, signing scheme, secret scan, and a DEX cross-reference workbench.
Java .class disassembler
Disassemble JVM bytecode, read the constant pool, and recover strings and logic from .class and .jar files.
ELF, PE and Mach-O binary analyzer
Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.
Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 25 match in total - see the full index.
Checkpoint
Given an APK, list every component reachable by another app on the device, and say for each one which rule made it reachable.
Teaching note
The export default is the thing everybody gets wrong: a component with an intent-filter and no android:exported attribute is exported. Teach it as a rule with two cases rather than as a single attribute, or half the class will report a challenge's entry point as private.