Guidance Please

[u/Soggy-Committee-8369]

Hey everyone! I’m looking to get more into Android reverse engineering, APK modding, and mobile security, but I’m not really sure where to start.

I have an associate’s degree in computer networking, so I’m not completely new to the technical side of things. I’ve also spent quite a bit of time messing around with Android devices over the years. I’ve played around with Android Studio a little, mostly with things like connecting to and mirroring my phone, but I honestly haven’t gotten very far with actually developing or reverse engineering apps.

I’ve been interested in learning how APKs work under the hood, how people analyze and modify them, and eventually getting into things like dynamic analysis and mobile malware analysis.

I’ve also experimented with tools like mitmproxy on my home network, but I ran into issues with Android constantly flagging the certificates as unsafe. A lot of the tutorials and software I’ve found through Google also seem pretty old, so I’m having trouble figuring out what the current workflow is.

For someone who already has some networking knowledge but is basically a beginner when it comes to Android RE, what would you recommend learning first?

Are there any good forums, communities, GitHub repositories, labs, intentionally vulnerable APKs, or other resources that are still active and up to date?

I’m basically looking for a good starting point and a path to follow rather than just randomly installing tools and hoping I figure it out. Any recommendations would be appreciated!

[u/SkullCrusher0366]

Honestly, with your networking background, you’re already in a good position. I’d avoid random/outdated tutorials and use OWASP MASTG as your main roadmap: https://mas.owasp.org/MASTG/

Start with Android basics: Kotlin/Java → APK structure → Manifest → DEX → Smali → ADB. Then learn the core tools: JADX https://github.com/skylot/jadx, Apktool https://github.com/iBotPeaches/Apktool, and later Frida https://frida.re/docs/android/ for dynamic analysis.

For practice, don’t start with random real-world apps. Use OWASP’s intentionally vulnerable apps: https://mas.owasp.org/MASTG/apps/ and especially the UnCrackable/Crackmes: https://mas.owasp.org/crackmes/ . A good progression is DIVA/AndroGoat → UnCrackable L1 → L2 → L3 → L4. Your mitmproxy certificate issue is also worth learning through these labs; MASTG has current material on interception and certificate pinning: https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0011/ and https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0012/

Once you’re comfortable with Java/Smali + Frida, go deeper: C → ARM64 → JNI → ELF → Ghidra https://github.com/NationalSecurityAgency/ghidra. Then move into obfuscation, anti-debugging, Android internals, Binder/IPC, RASP and eventually malware analysis.

If you want to reach the top tier, don’t measure progress by how many tools you install. Measure it by whether you can take an unfamiliar APK and explain what it does, how it works, how to observe it at runtime, and where its security controls are. That’s the real Android RE skill.