<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-mobile-binary-analysis
description: >-
  Reverse engineer compiled mobile application binaries including ARM disassembly,
  native library inspection, symbol analysis, string extraction, and anti-tampering
  mechanism identification for Android NDK and iOS Mach-O binaries.
domain: cybersecurity
subdomain: mobile-security
tags:
  - binary-analysis
  - reverse-engineering
  - arm
  - ndk
  - mach-o
  - ghidra
  - radare2
  - strings
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1407.001", "T1406"]
  owasp-mobile: ["M9", "M7"]
  tools: ["ghidra", "radare2", "rizin", "objdump", "nm", "strings", "class-dump"]
---

# Performing Mobile Binary Analysis

## Overview

Mobile binary analysis examines compiled native code—Android NDK shared libraries
(.so) and iOS Mach-O executables—for vulnerabilities, hardcoded secrets, anti-
tampering mechanisms, cryptographic implementations, and hidden functionality
not visible in Java/Swift decompilation.

## Prerequisites

```bash
# Ghidra: https://ghidra-sre.org/ (NSA, free)
# radare2
pip install r2pipe
apt install radare2       # or brew install radare2
# class-dump (iOS): https://github.com/nygard/class-dump
```

## Workflow

### Step 1: Binary Identification

```bash
# Android: find native libraries
find apktool_out/lib/ -name '*.so' | while read f; do
  echo "=== $f ==="
  file "$f"
  readelf -h "$f" | grep -E 'Class|Machine|Entry'
done

# iOS: identify binary type
file extracted/Payload/App.app/AppBinary
otool -h extracted/Payload/App.app/AppBinary   # Mach-O header
otool -l extracted/Payload/App.app/AppBinary | grep -A2 LC_ENCRYPTION
# encrypted = 1 means FairPlay DRM — need to decrypt first
```

### Step 2: Symbol and String Analysis

```bash
# Android .so — symbols
readelf -s libnative.so | grep FUNC | head -30
nm -D libnative.so | grep -i 'encrypt\|decrypt\|key\|auth'

# iOS Mach-O — symbols
nm AppBinary | grep -i 'encrypt\|key\|password\|token'
otool -tV AppBinary | head -50            # Disassembly

# Strings extraction
strings -a libnative.so | grep -iE 'key|secret|password|token|http'
strings -a AppBinary | grep -iE 'key|secret|password|api|url'

# iOS class dump
class-dump extracted/Payload/App.app/AppBinary > classes.h
grep -i 'encrypt\|crypto\|key\|auth\|token' classes.h
```

### Step 3: Radare2 Analysis

```bash
# Open binary
r2 -A libnative.so

# r2 commands
aaa                          # Full analysis
afl                          # List functions
afl~encrypt                  # Filter functions
pdf @sym.Java_com_target_encrypt  # Disassemble function
iz                           # List strings in data section
izz                          # List all strings
/x 414553                    # Search hex pattern (AES)
axt @sym.func                # Cross-references to function
VV @sym.func                 # Visual graph mode
```

### Step 4: Ghidra Decompilation

```bash
# Headless analysis
analyzeHeadless /tmp/ghidra_project proj \
  -import libnative.so \
  -postScript ExportDecompilation.java \
  -scriptPath /path/to/scripts

# GUI: Import binary → Auto-analyze → Navigate to functions
# Key areas to review:
# - JNI_OnLoad (Android initialization)
# - Functions with crypto-related names
# - String references to URLs, keys, tokens
```

### Step 5: Security Check Analysis

```bash
# Check binary protections
# Android
readelf -l libnative.so | grep GNU_STACK     # NX (no-exec stack)
readelf -d libnative.so | grep NEEDED         # Dependencies
readelf -d libnative.so | grep SONAME
checksec --file=libnative.so                   # PIE, RELRO, Stack Canary

# iOS
otool -l AppBinary | grep -A5 LC_SEGMENT | grep -E 'segname|initprot'
otool -l AppBinary | grep PIE                  # ASLR/PIE
codesign -d -vvvv App.app                      # Code signing
```

### Step 6: Anti-Tampering Detection

```bash
# Search for integrity checks
strings libnative.so | grep -iE 'checksum|integrity|tamper|verify|signature'

# Search for debugger detection
strings libnative.so | grep -iE 'ptrace|debugger|TracerPid|sysctl'

# Search for Frida detection
strings libnative.so | grep -iE 'frida|xposed|substrate|gadget'

# Search for emulator detection
strings libnative.so | grep -iE 'goldfish\|ranchu\|generic\|emulator\|genymotion'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Missing NX | Binary headers | Executable stack |
| No PIE | Binary headers | Fixed load address |
| Debug symbols | Symbol table | Full debug info in release |
| Hardcoded secrets | Strings | Embedded keys in native code |

```yaml
title: Mobile Binary Analysis Detection
id: e9401fa0-8042-4dff-9573-506d150a408a
status: experimental
description: Detects suspicious activity related to performing mobile binary analysis techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1407.001
  - attack.t1406
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] All native binaries identified and cataloged
- [ ] Symbol tables analyzed for sensitive functions
- [ ] String extraction completed for secrets
- [ ] Binary protections checked (NX, PIE, RELRO, canary)
- [ ] Anti-tampering/anti-debug mechanisms identified
- [ ] Key functions decompiled in Ghidra/radare2

## References

- [OWASP MASTG — Binary Analysis](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0007/)
- [Ghidra](https://ghidra-sre.org/)
- [radare2](https://rada.re/n/)
- [MITRE T1407.001](https://attack.mitre.org/techniques/T1407/001/)
