> For the complete documentation index, see [llms.txt](https://heapbytes.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heapbytes.gitbook.io/notes/apk-pentesting/static-analysis.md).

# Static analysis

<figure><img src="/files/nDGnCFlOd8d0cOZRQUAM" alt=""><figcaption><p>CREDIT - TCM security</p></figcaption></figure>

## Jadx

{% embed url="<https://www.briskinfosec.com/tooloftheday/toolofthedaydetail/JADX>" %}

We can decompile code to JAVA using jadx.

<figure><img src="/files/0jsboVCrrzQgpkvm7bmq" alt=""><figcaption></figcaption></figure>

## Qark

<https://github.com/linkedin/qark>

## MobSF

<https://github.com/MobSF/Mobile-Security-Framework-MobSF>

<figure><img src="/files/rwvCw6yrqQ3mQY0Xb99r" alt=""><figcaption></figcaption></figure>

### Online website

{% embed url="<https://mobsf.live/>" %}

### Docker install

```bash
docker pull opensecurity/mobile-security-framework-mobsf:latest
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
```

## Grep process

For ease of static analysis (since there are many files), we can have few keywords and grep those words to see how many files are intresting to lookout for.

<figure><img src="/files/dxtQrl1wVxtOswifkyGI" alt=""><figcaption><p>example</p></figcaption></figure>

<figure><img src="/files/Gcd993vQrLV9uy4puln1" alt=""><figcaption><p>exmaple</p></figcaption></figure>

### Few things too look out

```bash
╰─➤  cat resources/AndroidManifest.xml | grep -i backup
        android:allowBackup="true"
        
╰─➤  cat resources/AndroidManifest.xml | grep -iE 'exported="true"'                                                                     1 ↵
            android:exported="true"
            
╰─➤  cat resources/AndroidManifest.xml | grep -iE 'debuggable' --color                                                                       1 ↵
            android:debuggable="true"

╰─➤  cat resources/AndroidManifest.xml | grep -i 'android.permission' --color        
            <uses-permission android:name="android.permission.INTERNET"/>
```

### Allowbackup=true

This is considered a security issue because people could backup your app via ADB and then get private data of your app into their PC.

1. Shared preference.
2. directory returned by getFilesDir().
3. getDataBase(path) also includes files created by SQLiteOpenHelper.
4. files in directories created with getDir(Sring, int).
5. files on external storage returned by getExternalFilesDir (String type).

### exported=true

We can basically export that activity from anywhere inside android, creating new app & calling the activity there or using adb to call that activity.

E.g: \
There's a mobile app that uses OTP (2AUTH) ... but the home screen/dashboard activity is exported=true. You can start the dashboard activity & can bypass the OTP screen.&#x20;

{% embed url="<https://developer.android.com/privacy-and-security/risks/android-exported>" %}

### debuggable=true

This allows attacker to hook their debugger in the app (similar work in Dynamic Analysis)

### uses-permission

This basically teslls what permission the app requires for running/app ask to end user.