0

When it comes to reversing apk files, I understand that are mainly 2 approaches. The first involves using a decompilation engine which will try to produce java files which are more readable but can be unreliable when the apk uses obsfucation. The 2nd method i know of involves converting the dex files into smali code which are more reliable but slightly harder to understand. When it comes to detecting malware by looking for method calls, which approach is more suitable? (I am not interested in re-packaging the code into a working apk.)

2

Smali, obviously. There's no reason to add an extra level of inefficiency and errors into your tool. Decompilation is primarily useful for making the code easier to read for humans.

0

If you want to understand the overall structure, like to locate the suspicious method, I would recommend decompile to java to check first, since java is in a much higher level and can be indexed easily to see the code structure.. For smali, it's more suitable for repackaging since it's just a kind of assembly for dex binary, but its level is low and needs some learning if you're not very familiar with it

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.