HACKING PROJECT · mobile · Advanced
Android/iOS App Decompilation Pipeline
Deliver an automated, cross-platform pipeline that turns a mobile binary into normalized, searchable, decompiled source and metadata.
Reverse engineers and app-security reviewers repeat the same manual steps for every sample — unzip, decompile DEX to Java, disassemble to smali, extract the manifest, pull strings and native libs — which is slow, inconsistent, and error-prone at scale. For iOS, the toolchain (class-dump, Hopper/Ghidra, decrypting IPAs) is even more fragmented. Teams lack a unified, automated pipeline that normalizes both platforms into a comparable, searchable output.
**What you'll build**
Build a modular decompilation pipeline that accepts an APK or IPA and orchestrates the right tools per platform: for Android, jadx/apktool/androguard for Java/smali/manifest/resources; for iOS, IPA extraction, class-dump/Ghidra headless, and Mach-O parsing. Normalize outputs into a structured project directory plus an indexed, searchable database of symbols, strings, URLs, and secrets. Expose a CLI and a browsable report with cross-artifact search and diffing between app versions.
**Objective** — Deliver an automated, cross-platform pipeline that turns a mobile binary into normalized, searchable, decompiled source and metadata.
**Expected outcome** — A pipeline tool that, given an APK/IPA, produces a structured decompiled workspace plus a searchable index and secrets/URL inventory.
**Difficulty** — Advanced — orchestrating heterogeneous RE tools, headless disassembly, iOS binary handling, and normalization is non-trivial.
**Primary category** — Reverse Engineering; Secondary = Mobile AppSec, Malware Analysis
**Security domains** — Primary = Malware Analysis; Secondary = Security Research, Red Team, DevSecOps
**Technical focus** — APK/IPA decompilation, DEX-to-Java and smali disassembly, Mach-O/class-dump analysis, secrets/URL extraction, symbol indexing, version diffing, RE automation, headless Ghidra scripting
**Core technologies** — Languages: Python, Java, Bash; Frameworks/Libraries: androguard, jadx (CLI), apktool, Ghidra headless API; Security Tools: jadx, apktool, Ghidra, class-dump, radare2, MobSF (reference); Cloud/Infra: Docker, job queue (Celery/RQ); AI/Data: optional LLM for code summarization, embeddings for semantic search; Databases: PostgreSQL/Elasticsearch for symbol and string indexing
**Where it's valued** — Threat-intel firms, AV/EDR vendors, security research labs, app-security consultancies, mobile fraud teams
**Careers it builds toward** — Reverse Engineer, Malware Researcher, Mobile Security Engineer, Application Security Analyst
**Framework alignment**
• MITRE ATT&CK: Supports analysis of Obfuscated Files or Information (T1406), Software Packing/anti-analysis review; primarily an analysis enabler rather than an attack technique itself
• NIST CSF 2.0: Identify (software composition/artifact analysis), Detect (secret/IOC discovery)
• OWASP: MASVS-CODE, MASVS-RESILIENCE (anti-RE control assessment), MASVS-CRYPTO (hardcoded key discovery)
• CIS Controls v8: 2 (Software Inventory), 16 (Application Software Security)
**Innovation** — Improved Existing Solution — individual tools are mature, but a normalized, cross-platform, searchable, diffable pipeline has real research and product value. Scores: Innovation 6/10, Startup 5/10, Enterprise-Readiness 6/10, Patent = Possible.