I am new to this sort of stuff. I just found hardcoded public and private keys in an android app. I just can't figure out what it is being used for. Any advice on that?

  • In such a case a dynamic analysis using Frida may be the easier approach. Identify the functions that make use of those key for en/decryption, hook them and look on the data they are used for and when they are used respectively what function you triggered before. Note that you may get no results because the keys are not used at all (dead code). – Robert Mar 12 '20 at 18:02

They must be stored in some variable or in resources, You can check all the usages for that variable or where that resource was used in the classes, and backtrack and see whatever catches your interests

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.