Reverse-Engineering apps on the device - how far can we go?
American Express Technology
Jeb Ware is a Senior Engineer in the Technology organization at American Express, where he works on Android applications. He has been developing for Android since the original G1. He enjoys breaking a new phone every six months, trying out the shiny new APIs in each Android release, and decompiling your app to see how it's working.
As Android developers, we know that our app is insulated from other apps in the device by the Android Application Sandboxing model. But the reality is that this sandbox only protects your data. Your APK is completely exposed to other apps, including resources, assets, and code. I wanted to know how much reverse-engineering I could do from within an app, so I built an app that can run on your phone and inspect any other app’s resources, looking at image assets and reading string values. It can even load another app’s code, and execute it. All this happens without leaving the device, without classic reverse-engineering tools on a developer machine. I’ll walk through the APIs that expose your resources, and show how to put them into action. I will demonstrate how we can inspect, and even execute, another app's code. You will come away with a better understanding of what is and is not protected by the Android Application Sandbox, and which parts of your app are freely available for reverse-engineering.