App reverse engineering

Taking a mobile app apart to read its code, keys and hidden endpoints.

What it means

App reverse engineering means taking a finished mobile app apart to understand how it works. Anyone can download your app, unpack it, and run tools that turn the compiled code back into something readable. They can list the web addresses it calls, read strings stored inside, and watch its traffic.

The idea that makes it click: anything you ship to a phone is in the hands of the person who owns that phone. You cannot keep a secret inside the app, and you cannot rely on a screen that hides a button. Only checks on your server hold.

Why it matters

What people find decides what they can do next. An API key or password left in the code, a hidden admin endpoint, a feature switched off by a flag the app reads on start, or a trust in the app to enforce a price or limit. Each can be used directly against your backend, without the app at all.

Copying is another cost. Rivals can clone an app, strip licence checks or repackage it with malware and publish it. Mobile security guidance from OWASP treats resilience against reverse engineering as a separate area of the standard, but it is a hurdle to slow people down, not a lock.

How it shows up

Reverse engineering is routine on Android, where tools decompile the package, and on iOS, where the binary is analysed after it is decrypted on a device. Typical discoveries are hardcoded secrets, old API versions that are still live, and endpoints that skip checks because the app never calls them wrongly. See shadow APIs.

Obfuscation and anti-tamper measures raise the effort but do not prevent it. The reliable defence is to assume the app is fully readable: keep secrets on the server, check authorisation on every request there, and test your API directly as an attacker holding the app would, as part of mobile pentesting.

Questions people ask

App reverse engineering, answered

Can a mobile app be made impossible to reverse engineer?

No. Obfuscation, encryption of strings and tamper checks make it slower and more costly, but a determined person with the app on their own device can eventually read it.

Design as if they will.

Is reverse engineering illegal?

It depends on country, purpose and licence terms. Security researchers do it routinely, and some laws allow it for interoperability or research. Others restrict it.

Do not do it to apps you have no permission to test, and take legal advice for your market.

Does obfuscation protect API keys in an app?

It hides them from a casual look, not from a tool. Anything the app needs at runtime can be captured from memory or traffic.

Keep keys on your server, and use short-lived tokens for the app.

What should we check after finding the app can be unpacked?

List everything inside it: URLs, keys, flags, certificates. Then ask what each would let a stranger do against your servers.

Fix by moving the secret or the check to the server, and rotate anything that was exposed.

Is this the same as jailbreak detection?

No. Reverse engineering is analysing the app. Jailbreak and root detection is the app checking whether the phone has been modified, which is one way to resist analysis.

Both are weaker than server-side checks.

Sources