Mobile applications

Before the session

• Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
• Read the lesson yourself first - about 11 minutes.
• Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.

Objectives

Written as things a student can do afterwards, so they can be assessed rather than asserted.

1. Read an APK's structure from its zip listing and say what each part implies
2. Decode a binary AndroidManifest and identify every exported component
3. State the export rule correctly, including the intent-filter default
4. Follow a string to its load site and a method to its callers inside a DEX
5. Find the native library behind a JNI call and treat it as an ordinary ELF
6. Decide between static reading and runtime hooking, and justify the choice

Running order (120 min)

Tools used

• APK and IPA analyzer: manifest, exported components, DEX xrefs - Open an Android APK or an iOS IPA in the browser: the parsed manifest with every exported component, signing scheme, secret scan, and a DEX cross-reference workbench.https://ctfpal.com/?tool=apk-ipa-analyzer
• Java .class disassembler - Disassemble JVM bytecode, read the constant pool, and recover strings and logic from .class and .jar files.https://ctfpal.com/?tool=java-class-disassembler
• ZIP archive inspector - Read a ZIP’s central directory and local headers, spot mismatches used to hide files, and check encryption and compression per entry.https://ctfpal.com/?tool=zip-archive-inspector
• ELF, PE and Mach-O binary analyzer - Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.https://ctfpal.com/?tool=elf-pe-analyzer
• Strings extractor for binaries and blobs - Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.https://ctfpal.com/?tool=strings-extractor

Reading

• Reversing managed code: .NET, Java, and Python bytecode - 6 min. When the binary is not machine code but bytecode with names attached, the job stops being disassembly and becomes reading. Decompiling .NET and Java back to source, disassembling .pyc, and what obfuscators actually take away.
• Taking an Android app apart - 5 min. An APK is a zip, and most of what a mobile challenge turns on is in metadata rather than in code. The manifest rules that decide the attack surface, how to navigate DEX without a decompiler, and when to stop reading and start hooking.

Practice set

Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.

1. vault-door-training - picoCTF 2019, easy
2. Binary Instrumentation 1 - picoCTF 2025, medium
3. Binary Instrumentation 2 - picoCTF 2025, medium
4. Fresh Java - picoCTF 2022, medium
5. Java Code Analysis!?! - picoCTF 2023, medium
6. Mob psycho - picoCTF 2024, medium
7. Pico Bank - picoMini by CMU-Africa, medium
8. Safe Opener - picoCTF 2022, medium
9. Safe Opener 2 - picoCTF 2023, medium
10. Binary Instrumentation 3 - picoCTF 2026, hard
11. Binary Instrumentation 4 - picoCTF 2026, hard
12. droids0 - picoCTF 2019, hard

Checkpoint (gradeable)

Given an APK, list every component reachable by another app on the device, and say for each one which rule made it reachable.

Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.

Where the room gets stuck

The export default is the thing everybody gets wrong: a component with an intent-filter and no android:exported attribute is exported. Teach it as a rule with two cases rather than as a single attribute, or half the class will report a challenge's entry point as private.

• Reading android:exported as the whole export rule. A component with an intent-filter and no explicit attribute is exported on older targets, which is where the entry point usually is.
• Decompiling to Java and stopping. The decompiler drops what it cannot express; the smali is authoritative and is often shorter than the argument about it.
• Looking for the secret in the Java. Anything valuable is regularly in a native library, a resource, or assembled at runtime from pieces.
• Treating a signed APK as untouchable. Repackaging and re-signing with your own key is routine, and a debuggable rebuild answers in a minute what static reading argues about for an hour.
• Trusting the DEX string table. Strings are regularly assembled or decrypted at runtime, which is why the load site matters more than the table and why the cross-reference step comes before the reading.

If a student wants the subject, not the answer

Chapter-level references, so a student can be pointed at twenty pages rather than at a book. Nothing here is required to complete the module.

• Bug Bounty Bootcamp, Vickie Li. Chapter 23, Hacking Android Apps. The teardown workflow with the manifest read as an attack surface rather than as configuration.
• Practical IoT Hacking, Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, and Beau Woods. Chapter 14, Attacking Mobile Applications. The mobile app as one component of a device ecosystem, including what it stores and what it talks to.

If you finish early

• Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
• Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
• Ask a student to break their own example - construct an input that defeats the tool, and explain why.