Checking bytecode on Android: a detailed analysis for developers and users

When it comes to checking bytecode on Android, many users and novice developers are faced with a misunderstanding: what it is, why you need it and how it is done correctly. In fact, bytecode is an intermediate representation of application code that is executed by a virtual machine Dalvik or ART (Android Runtime). Checking this code allows you to identify hidden threats, optimize performance, or even modify applications to suit your needs.

In this article we will take a detailed look at what bytecode is in the context of Android, what tools are used to analyze it (from dex2jar to JADX), and why this is not relevant only for developers, but also for ordinary users who want to make sure that the APKs they install are safe. We'll also look at practical scenarios, from decompiling applications to finding vulnerabilities and bypassing restrictions.

If you've ever wondered how tools like Apktool work or why some applications require verification before installation, this material will provide comprehensive answers. And for those who plan to engage in reverse engineering or security testing, here you will find step-by-step guide and useful tips.

What is bytecode on Android and how does it work

Bytecode on Android is low-level code that is generated from Java/Kotlin source code at the compilation stage. Unlike machine code, which is executed directly by the processor, bytecode is interpreted by the virtual machine. On Android, two key technologies are responsible for this:

• 🔹 Dalvik —an old virtual machine (before Android 5.0) that worked with files .dex (Dalvik Executable).
• 🔹 ART (Android Runtime) —a modern runtime environment (with Android 5.0+) that uses .oatfiles and compiles the bytecode into machine code in advance (AOT compilation).

When you compile an Android application, the source code is first converted into bytecode (files .class), and then into .dexformat. This process includes several stages:

1. Compiling Java/Kotlin into JVM bytecode (.class).
2. Converting .class to .dex using a tool dx (or d8 in new versions).
3. Packaging .dexfiles in APK along with resources.

It is the .dexfiles that contain bytecode, which later is executed on the device. Checking this code allows you to analyze the logic of the application, look for vulnerabilities, or even. modify its behavior.

Why check the bytecode: 5 real reasons

Checking bytecode on Android may seem unnecessary for the average user, but in practice it solves many problems - from security to optimization. Here are the main scenarios when such analysis becomes critical:

• 🛡️ Search for malicious code. Many viruses and spyware disguise themselves as legitimate APKs. Bytecode analysis helps to identify suspicious calls (for example, sending SMS to premium numbers or accessing tolls). contacts without permission).
• 🔍 Reverse engineering. Developers often check the bytecode of competitors to understand how certain functions are implemented (for example, encryption algorithms or network protocols).
• ⚡ Performance optimization. for “heavy” operations (for example, unnecessary loops or non-optimal calls) that slow down the application.
• 🔓 Bypassing restrictions. Some applications block functionality by region or Android version. Modifying the bytecode allows you to remove these restrictions.
• 📦 Checking licenses and piracy. Companies analyze the bytecode of their APKs to find code leaks or hacked versions.

Case study: in 2023, security researchers discovered more than 300 applications on Google Play that secretly collected user data. All of them were identified through bytecode analysis. malicious functions were hidden in encrypted strings and dynamically loaded libraries.

Tools for checking bytecode: from simple to professional

There are many tools for analyzing bytecode on Android - from simple decompilers to full-fledged IDEs with debugging support The choice depends on your goals:

For most tasks, JADX or Apktoolis enough. For example, to check an APK for malicious code:

1. Download JADX from the official GitHub.
2. Drag the APK file into the app window.
3. Examine the decompiled code for suspicious classes (for example, SmsManager or TelephonyManager without permission).

Attention! Some tools (for example, Ghidra) require deep knowledge of assembler and ARM/x86 architecture. For beginners, it is better to start with JADX or Bytecode Viewer.

Step-by-step guide: how to check APK bytecode

Let's look at the process of checking bytecode using the example of APK decompilation using JADXThis method is suitable for most tasks - from searching for vulnerabilities to modifying applications.

Step 1: Installing tools

Download the latest version JADX s official repository (versions available for Windows, Linux and macOS) Unpack the archive into a convenient folder. installed Java 8 or later (check with the command java -version in the terminal).

Step 2: APK decompilation

Run JADX (file jadx-gui for the graphical interface or jadx for the command line). Drag the APK file into the app window. In a few seconds you will see the package structure and decompiled code.

Example command for terminal:

jadx -d output_dir app.apk

Step 3: Code Analysis

Pay attention to the following elements:

• 📌 Manifest (AndroidManifest.xml) - check the declared permissions (<uses-permission>For example, if the application requests READ_SMS for no obvious reason, this is suspicious.
• 📌 Classes with network requests — look for calls HttpURLConnection, OkHttpClient or WebView with suspicious URLs.
• 📌 Encryption and storage of data —check how the application works with SharedPreferences or database SQLite (whether passwords are stored in clear text).

Step 4: Checking for viruses (optional)

Use online services like VirusTotal to scan the APK. Download the file and study antivirus reports. Pay attention to warnings about Trojan, Adware or Riskware.

⚠️ Attention! Bytecode modification may violate the digital signature of the APK, which will lead to installation errors. To fix this, you will have to re-sign the file using jarsigner or Apktool.

Dangers and risks when working with bytecode

Checking and modifying bytecode is a powerful tool, but it is fraught there are several serious risks that are important to know about in advance:

1. Violation of license agreements. Many apps prohibit reverse engineering in their EULA. For example, Netflix or banking applications can block an account for attempting to decompile.
2. Viruses in modified APKs. If you downloaded an APK from an untrusted source and try to modify it, you risk introducing malicious code by accident.
3. Instability. Even small changes in the bytecode can lead to crashes or unpredictable behavior of the application.
4. Legal implications. In some countries, reverse engineering is protected by law (for example, for security research), but distributing modified versions of applications may be considered piracy.

Critical: Never extract the APK of banking apps or services with two-factor authentication (for example, Google Authenticator). Even if you do not make changes, analyzing such code can lead to compromise of your data.

If you are involved in security testing, use special test sites (for example, Damn Vulnerable Hybrid Mobile App) or open sources. For personal purposes, it is better to limit the analysis without modifications.

Practical examples: what can be found in bytecode

Let's look at a few real cases where bytecode analysis helped identify problems or optimize application performance.

Case 1: Searching for hidden advertising

Many “free” applications contain aggressive advertising that is not always visible in the interface. When decompiling the APK, you can find:

• 🔗 Calls to libraries like com.google.android.gms.ads or com.unity3d.ads.
• 🕵️ Timers that show ads at certain intervals (look for Handler.postDelayed).
• 📱 Hidden WebViewloading advertising banners in the background.

Example of code that may indicate hidden advertising:

AdRequest adRequest = new AdRequest.Builder().build();
mAdView.loadAd(adRequest);

Case 2: Bypassing regional restrictions

Some applications (for example, streaming services) block content by geolocation. In bytecode you can. find:

• 🌍 Country checks via TelephonyManager.getNetworkCountryIso().
• 🔒 API requests with region transfer (for example, ?country=US).
• 📡 Using VPN detectors (look for classes like VpnDetector).

Modifying these checks (for example, replacing the returned country value), you can bypass the restrictions. However, this may violate the rules of the service.

Case 3: Search for data leaks

In 2022, an analysis of the bytecode of the popular messenger revealed that it sent IMEI and MAC address devices to the server without encryption. This was found based on the following criteria:

• 📡 Calls HttpURLConnection with the transfer of raw data.
• 🔑 Absence HTTPS or encryption SSL/TLS.
• 📱 Collection of identifiers through TelephonyManager.getDeviceId().

⚠️ Attention! If you find a data leak in a popular application, report it to the developers through bug bounty apps (for example, HackerOneDistributing such information publicly can lead to legal problems.

FAQ: Frequently asked questions about checking bytecode on Android

apksigner verify --print-certs app.apk