Reverse Engineering Mobile Applications GMOB Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   During dynamic analysis of an Android app, an analyst discovers that the app stores sensitive data in a SQLite database that is encrypted with a key derived from a hardcoded string in the app's code. The analyst needs to extract the data for the report. Which approach is most efficient?

   • AUse a brute-force attack on the database encryption
   • BExtract the hardcoded key from the decompiled code and use it to decrypt the database
   • CUse Frida to hook the database encryption function and dump the decrypted data at runtime
   • DUse a memory dump to extract the decrypted database from the app's memory
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is reviewing an Android APK that has been obfuscated with ProGuard. The analyst needs to understand the app's logic but the class and method names are meaningless. Which approach is most effective for static analysis?

   • AUse Hopper to decompile the APK into assembly code
   • BUse jadx to decompile the APK and then use the 'deobfuscation' feature to rename classes and methods based on usage
   • CUse apktool to decode the APK and manually rename all classes and methods
   • DUse Frida to hook every method and log the call stack
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An analyst is reverse engineering a heavily obfuscated Android app that uses native code for its core logic. The analyst has identified that the app uses anti-debugging and anti-emulator techniques. The analyst needs to understand the native code's functionality and bypass the protections. Which combination of tools and techniques is most effective?

   • AUse apktool to decode the APK, then use jadx to decompile the Java code, and finally use Hopper to analyze the native library.
   • BUse jadx to decompile the Java code and then use apktool to modify the smali code to remove the anti-debugging checks.
   • CUse a custom emulator that hides its fingerprint and use a debugger to step through the native code.
   • DUse Frida to bypass anti-debugging and anti-emulator checks, then use Hopper to analyze the native library statically.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is performing dynamic analysis of an iOS app that uses certificate pinning and also detects if the device is jailbroken. The analyst has a jailbroken device and wants to intercept HTTPS traffic. Which combination of tools is most effective?

   • AUse a jailbreak tweak to disable jailbreak detection and use SSL Kill Switch to disable certificate pinning, then route traffic through a proxy
   • BUse a non-jailbroken device with a proxy and a custom CA
   • CUse Frida to hook both jailbreak detection and certificate pinning functions, then use a proxy
   • DInstall a custom CA certificate and use a proxy
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is analyzing an Android app that uses native code for critical functions. The analyst has already used jadx to decompile the Java code and found that the app loads a native library called 'libcore.so'. The analyst now needs to inspect the native library's functions and look for potential buffer overflows. Which tool is most appropriate?

   • AHopper
   • Bjadx
   • CFrida
   • Dapktool
   Reveal Solution Discussion Select an answer first