Reverse Engineering
Mobile Application Reverse Engineering
We examine your iOS and Android app in its compiled form. We reveal embedded keys and evaluate the effectiveness of its protections.
What it is
Anyone who downloads your mobile app can analyze it on their own device. Reverse engineering examines the app from its compiled package. Embedded keys, hidden functions, and API addresses are uncovered. The resilience of protections such as device integrity checks is assessed.
Scope
- Analyzing iOS and Android packages
- Searching for embedded keys, passwords, and API addresses
- Identifying hidden and undocumented functions
- Assessing device integrity and tamper checks
- Testing code obfuscation resilience
The need
When organizations need it
- Before your mobile app's code protection and integrity checks go live.
- When it is uncertain whether an embedded key in the app can be extracted.
- When an assessment against OWASP MASVS resilience requirements (MASVS-RESILIENCE) is needed.
Method
How we work
-
Analysis
We open the app package and examine the code and resources.
-
Search
We identify embedded keys, hidden functions, and API addresses.
-
Testing
We assess the resilience of integrity and tamper protections.
Outcome
What you have at the end
A clear overview of embedded secrets and the resilience of protections in your app, mapped to OWASP MASVS resilience requirements.
Frequently asked questions
How does this differ from an app security test?
An app test finds vulnerabilities. Reverse engineering examines the app's internals, embedded secrets, and protection resilience. The two are complementary.
Is code obfuscation sufficient protection?
Obfuscation increases the effort but is not sufficient alone. A sensitive key or logic cannot be protected by obscurity alone against a determined attacker.
Reverse Engineering
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting