Reverse Engineering Android Apps With ACVTool

The talk looks at why reverse engineering modern Android apps is hard, since large commercial packages ship with many dex files, split APKs and heavily obfuscated bytecode. It starts with how Android packages are structured and with the usual tooling around decompilers, disassemblers and proxies.

The main focus is ACVTool, a tool first developed at the University of Luxembourg to measure code coverage for apps without source code. The updated 2024 version supports multi-dex apps, swaps APKTool for a lighter repackaging step so manifests and resources are less likely to break, and can measure coverage of a single feature. The app is instrumented, exercised on a device or emulator, and the collected coverage is turned into an HTML report. Two examples are shown: a Firebase login app the speaker wrote, where about 6% of the code remained after shrinking away unused classes, and a dice-rolling app analysed by building a graph of executed methods from entry points such as click and sensor handlers.

The takeaway is that runtime coverage can narrow down what to read in a large decompiled app. The shrinking technique is still experimental and fails on many applications, so it is best treated as an aid for focusing analysis on the code that actually executes.