I've recently gotten into Android reverse engineering, and I've been messing around with some apps lately for education/research purposes to see how some things are done with private (mobile) APIs.

One of the apps I have been testing is giving me some weird behavior. After decompiling the APK, I've noticed there is a class which is completely missing, although I am able to see the class when tracing with Frida.

The developer must have 'hidden' this class somehow, right? Is this something to do with ProGuard/DexGuard? Or is it possible the developer has simply included an entire Java class in an encrypted string hidden in another Java class? I'm stumped trying to figure out how this kind of thing would be possible, but I am looking to learn.

  • Both are possible. You can check whether it is a decompiler bug by using a better tool like baksmali. This should show the classes, even if they are "hidden" by decompiler bugs. If it still doesn't show up, it is probably being dynamically loaded somehow.
    – Antimony
    Nov 29 '18 at 2:50
  • @Antimony, thank you. I'll take a look at baksmali. I'll also do some research on dynamically loaded classes/code. Thank you.
    – codsane
    Nov 29 '18 at 5:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.