Reverse engineering Android apps: what hackers see when they decompile your fintech

Akande Simpa Lead Security Engineer & Cofounder, Simpa Labs Comprehensive Security Partner (CSP)

The attacker's toolkit

Reverse engineering an Android app does not require specialized hardware or expensive subscriptions. The entire toolkit is open-source, well-documented, and freely available. In mobile security, the fundamental challenge is that your binary runs on the attacker's physical device under their complete control.

How attackers obtain and decompile the APK

The static analysis phase begins with getting the binary. Attackers pull APKs directly from devices using ADB (Android Debug Bridge) or download them from mirror repositories:

# Locate the APK path on a connected test device
adb shell pm path com.simpalabs.wallet

# Pull the compiled package to your workstation
adb pull /data/app/com.simpalabs.wallet-98yza/base.apk fintech-wallet.apk

# Decompile Dalvik bytecode to structured Java using jadx
jadx -d ./decompiled-src fintech-wallet.apk

Within minutes, the attacker has a fully browsable directory containing the app's resource assets and reconstructed class structures.

Static Analysis: Obfuscation vs. Plaintext

If an app is shipped with default compiler configurations, reverse engineering reveals the original logic verbatim. Below is an example of what jadx reveals in an unhardened authentication module compared to an obfuscated one:

public class TransactionValidator {
    private String PAYSTACK_SECRET = "sk_live_51M0x...";
    
    public boolean checkPin(String pin) {
        String hashedPin = md5(pin);
        return hashedPin.equals(this.storedPinHash);
    }
}

public class a {
    private String b = "sk_live_51M0x..."; // Secret is still plaintext!
    
    public boolean a(String str) {
        return a.a(str).equals(this.c);
    }
}

[!IMPORTANT] > Notice that while method and class names are renamed to generic characters (a, b, c), string constants like API keys, endpoints, and encryption tokens are **not** obfuscated by default and remain readable in plaintext.

Bytecode Manipulation: Smali Patching

If a security check happens solely client-side (such as checking if a device is rooted before launching the app), an attacker can patch the Dalvik assembly (Smali) to skip the check entirely. Using apktool, they extract the Smali files, locate the conditional jump instruction, and reverse it.

# Invoke the root check helper
invoke-static {}, Lcom/security/RootCheck;->isRooted()Z
move-result v0

# If result is true (v0 = 1), jump to exit block
if-eqz v0, :cond_rooted_exit

# Continue loading application
const-string v0, "Device clean. Starting app..."

# Invoke the root check helper
invoke-static {}, Lcom/security/RootCheck;->isRooted()Z
move-result v0

# Force v0 to register as false (0) regardless of root status
const/4 v0, 0x0

# Will never branch to exit
if-eqz v0, :cond_rooted_exit

# Continue loading application
const-string v0, "Device clean. Starting app..."

After editing the Smali instruction, the attacker compiles the directory back into an APK using apktool b, signs it with a debugging key, and installs the modified client onto their test device.

Dynamic Instrumentation with Frida

While patching Smali requires rebuilding the app, Frida allows attackers to manipulate runtime logic without modifying the binary. By running a Frida server on a rooted phone or emulator, they can hook the Java class loader and intercept calls in memory.

For example, if a banking application enforces SSL pinning to prevent Man-in-the-Middle (MitM) inspection, the following script can be injected to intercept the trust manager validation and force it to trust any certificate:

Java.perform(function () {
    console.log("[*] Injected: Disabling SSL Pinning...");
    
    var TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl');
    TrustManagerImpl.checkTrustedRecursive.implementation = function(a1, a2, a3, a4, a5, a6) {
        console.log("[+] SSL Pinning Bypassed successfully.");
        return []; // Return empty array of untrusted chains to sign success
    };
});

Layered Defense: How to Harden Your Android Build

You cannot prevent your app from being decompiled. However, you can employ a defense-in-depth model that makes reverse engineering too complex and expensive to execute effectively.

1. Native Library Obfuscation (DexGuard / R8 Custom Rules)

Implement custom R8/ProGuard configuration rules to compress and encrypt class tables. For high-security environments, utilize commercial tools like DexGuard to perform metadata encryption, string encryption, and control flow flattening.

2. Play Integrity API & Hardware Attestation

Integrate Google's **Play Integrity API** to check that your app is running on a genuine, non-rooted Android device and has not been repackaged. Additionally, generate keys inside the Android Keystore with SECURITY_LEVEL_STRONGBOX to ensure cryptographic operations occur in a dedicated hardware secure element that is immune to software-level memory hooks.

3. RASP (Runtime Application Self-Protection)

Incorporate check loops that actively detect if the device is rooted, if a debugger is attached (Debug.isDebuggerConnected()), if Frida port 27042 is open in the background, or if your package signature mismatches your signing certificate. Crash the application immediately if any tampering indicator triggers.

4. Server-Side Session Enforcement

Every business-critical validation rule - credit limit, transaction authorization, interest calculation, payment split fees - must be recalculated on your API backend. Treat the Android client as a presentation layer only. Design your endpoints to assume the client is fully compromised. Read more in our fintech API security guide.

Related reading

Blog: Hardcoded API Keys · Securing Flutter & React Native Apps · iOS vs Android Security · SSL Pinning Bypass

Guides: Mobile App Pentest Nigeria · Pentest Tools & Methodology · Web App Pentest Nigeria

Services: APK to API · Mobile App Penetration Testing · API Security · Vulnerability Assessment