owasp-mstg VS smali

I found a more detailed explanation of it: https://github.com/julepka/owasp-mstg/blob/master/Document/0...

> Generally, you should provide compiled code with as little explanation as possible. Some metadata, such as debugging information, line numbers, and descriptive function or method names, make the binary or bytecode easier for the reverse engineer to understand, but these aren't needed in a release build and can therefore be safely omitted without impacting the app's functionality.

I'm not a big fan of the reasoning, as it's security through obscurity. Which is not the worst tradeoff, but these days it just makes public bug bounties (and other public auditing) end up being less of an interesting prospect for improving security.

In the past I've used 2 different methods. First was simply modifying the smali code to change values to what I want. For instance, instead of saving media to the internal SD card, I would save it to the external (for a 4WD GPS), or change the maximum amount of downloads from 10000 to 1000000.

If you access the smali github wiki, you will find this definition:

Next we need to decode/decompile the APK. So navigate to where you downloaded the APK and using Apktool decode Smart Audiobook Player using the decode argument. So our command will be apktool decode ak.alizandro.smartaudiobookplayer_2021-06-06.apk It will make a folder called ak.alizandro.smartaudiobookplayer_2021-06-06 which will contain all of the smali code (the 'assembly' language for DEX files - someone correct me with a better explanation please), the manifest.xml file of the APK, and all of the resources needed to compile our app back into a working APK file.

If interested in reversing, you’ll need tools such as (https://ibotpeaches.github.io/Apktool/ ) and dex2jar (https://github.com/pxb1988/dex2jar) and jd-GUI (http://java-decompiler.github.io/) and I also highly recommend using smali (https://github.com/JesusFreke/smali) rather than trying to analyze the machine code if jd-GUI fails to recompile something back to the pseudo-Java. There’s actually a very good LinkedIn learning video on how to use all these tools together called Learning Android Malware Analysis, just get the trial or w/e and do the course then cancel.