APK and IPA analyzer: manifest, exported components, DEX xrefs

An APK is a zip, which means half of what you need is readable without any tooling at all - and the other half is in a binary XML format and a bytecode container that a zip viewer shows you as noise.

Start with the manifest, and read the export rules carefully

AndroidManifest.xml inside an APK is not XML. It is a chunk stream with a string pool, and the thing every Android challenge turns on lives in its tree: which components are reachable from another app, what intents they accept, and whether android:debuggable was left on.

The rule that catches people: an activity, service or receiver with an intent-filter and no android:exported attribute is exported. That has been Android's default since long before 12 made the attribute mandatory, so a component with no exported line is not automatically private - and it is very often the entry point a challenge intends you to find. Every component here reports the rule that decided its answer rather than just the answer.

• `android:debuggable="true"` means you can attach jdb or Frida without root. Check it before you write an exploit for anything.
• `android:allowBackup` defaults to true when absent - the opposite default to exported - so app data can be pulled with adb backup unless it was explicitly turned off.
• An exported component with no `android:permission` is reachable by any app on the device. The count of those is the attack surface.

Then the code

The DEX workbench indexes every method's references in one pass and lets you read them in both directions: who calls this, what does this touch, and where is this string loaded. Methods are ranked by call sites, with instruction count breaking the tie - because the method nothing in the DEX calls is usually the entry point Android calls, and among those the big one is the interesting one.

Names you give a method are keyed to the file and survive a reload, which matters for anything that takes more than one sitting.

iOS

An IPA gets its Info.plist parsed properly - binary and XML both, nested dictionaries included, which is where NSAppTransportSecurity hides - and its app binary handed to the Mach-O parser for architecture, fat slices and linked libraries. The field to check first is cryptid: a non-zero one means the __TEXT segment is FairPlay-encrypted on disk, and every string and instruction you are looking at is ciphertext.