smali VS owasp-mastg

In the past I've used 2 different methods. First was simply modifying the smali code to change values to what I want. For instance, instead of saving media to the internal SD card, I would save it to the external (for a 4WD GPS), or change the maximum amount of downloads from 10000 to 1000000.

If you access the smali github wiki, you will find this definition:

Next we need to decode/decompile the APK. So navigate to where you downloaded the APK and using Apktool decode Smart Audiobook Player using the decode argument. So our command will be apktool decode ak.alizandro.smartaudiobookplayer_2021-06-06.apk It will make a folder called ak.alizandro.smartaudiobookplayer_2021-06-06 which will contain all of the smali code (the 'assembly' language for DEX files - someone correct me with a better explanation please), the manifest.xml file of the APK, and all of the resources needed to compile our app back into a working APK file.

If interested in reversing, you’ll need tools such as (https://ibotpeaches.github.io/Apktool/ ) and dex2jar (https://github.com/pxb1988/dex2jar) and jd-GUI (http://java-decompiler.github.io/) and I also highly recommend using smali (https://github.com/JesusFreke/smali) rather than trying to analyze the machine code if jd-GUI fails to recompile something back to the pseudo-Java. There’s actually a very good LinkedIn learning video on how to use all these tools together called Learning Android Malware Analysis, just get the trial or w/e and do the course then cancel.

The OWASP Mobile Application Security (MAS) flagship project provides a robust security standard for mobile apps, known as the OWASP MASVS, along with a comprehensive testing guide (OWASP MASTG). These resources cover the processes, techniques, and tools used during a mobile app security test, ensuring consistent and complete results.

https://mas.owasp.org/ :

> The OWASP Mobile Application Security (MAS) flagship project provides a security standard for mobile apps (OWASP MASVS) and a comprehensive testing guide (OWASP MASTG) that covers the processes, techniques, and tools used during a mobile app security test, as well as an exhaustive set of test cases

Have a look at the OWASP Mobile Application Testing Guide https://github.com/OWASP/owasp-mastg

owasp-mastg

Be aware that this kind of tools shouldn't be seen as a substitute for a manual and thorough pentesting of the application. As u/StoryOfDavid suggested decompiling the application (I usually use jadx for this) and using Wireshark to check the network traffic are good ways to start assessing the security of your application. If you want to be thorough I suggest going through the OWASP-MSTG guide (now renamed to MASTG) which provides a categorization of possible security issues, with a description of the problem and actionable ways to statically/dynamically analyze your application.

Check out OWASP, they have plenty documentation about threat modeling and attack vectors for mobile apps. Regarding jailbreak detection, see the following: https://github.com/OWASP/owasp-mstg/blob/master/Document/0x06j-Testing-Resiliency-Against-Reverse-Engineering.md