Reverse Engineering (4/5): network protocols, APIs and mobile apps

For most developers, the most useful reverse engineering is not assembly — it is understanding what an app sends over the wire. Typical reasons: integrating with an undocumented device or legacy system, debugging your own app's traffic, or security-testing an API you are authorised to test. Part 4 of the Reverse Engineering for Developers series covers capturing traffic, decoding binary protocols, and taking apart Android and iOS apps.

Capturing traffic

For HTTPS, install the proxy's CA certificate on the test device. Since Android 7, apps don't trust user-installed CAs by default; for your own debug builds, add a network_security_config.xml that allows user CAs, or use an emulator with the CA installed at system level.

Decoding an unknown binary protocol

1. Capture many samples, one action at a time (login, send message, change setting), and label each.
2. Diff them: bytes that never change are magic or version fields; bytes that increment are sequence numbers or timestamps; bytes that change with input are payload.
3. Find length fields: 2–4 bytes equal to the remaining size, big- or little-endian.
4. Measure entropy: high entropy means compression or encryption — you must find the key in the client (parts 2–3).
5. Recognise common encodings: Protocol Buffers (try protoc --decode_raw < msg.bin), MessagePack, CBOR, TLV.
6. Write a parser: a Wireshark Lua dissector or a Kaitai Struct spec turns your notes into a documented format.
7. Validate by replaying: a minimal Python client that sends your own message and gets the expected response.

Android apps

• Unpack: apktool d app.apk gives you AndroidManifest.xml, resources and smali.
• Decompile: jadx-gui app.apk produces readable Java/Kotlin. Search for base URLs, Retrofit annotations such as @POST, OkHttpClient, and hardcoded keys.
• Native libraries: lib/arm64-v8a/*.so files are ELF — open them in Ghidra and look for JNI exports like Java_com_example_....
• Runtime: Frida on a rooted test device or emulator hooks Java methods directly with Java.perform(...).

iOS apps

IPAs downloaded from the App Store are encrypted (FairPlay); you analyse your own builds or work on a dedicated test device. Tools: class-dump for Objective-C headers, Ghidra for the Mach-O, Frida with ObjC.classes for hooking, and objection, a toolkit built on Frida.

The reference standard

The OWASP MASTG (Mobile Application Security Testing Guide) is the most complete free manual for testing Android and iOS apps — including traffic interception, certificate pinning and reverse engineering techniques. Pair it with the MASVS checklist when reviewing your team's app.

Risks and caveats

• Terms of service: calling someone else's unofficial API may breach their ToS and can be blocked at any time; don't build a product on it without an agreement.
• Personal data: capture files can contain tokens and passwords — scrub them before sharing.
• Test only with permission, within bug bounty or contract scope.

How to apply it

• Dev: route your own app through mitmproxy, document every endpoint in an OpenAPI file, then decompile the APK with jadx and check for hardcoded secrets.
• Tech Lead: add a "jadx + grep for secrets" step to the release checklist; everything in the client — API keys, hidden endpoints, feature flags — is readable.
• PM: when integrating an undocumented device, budget time for protocol decoding and ask the vendor for documentation first — it is usually cheaper than reversing it.