Reverse Engineering
Static analysis tools automate the deterministic subset of what a reverse engineer checks by hand — manifest parsing, string scanning, signature verification. This covers where that automation reaches its limits, and the standard toolchain (apktool, jadx, otool, class-dump) used to go further manually.
| Tool | Platform | Used for |
|---|---|---|
| apktool | Android | Decoding resources and the manifest from an APK |
| jadx | Android | Reading decompiled Java from DEX bytecode |
| dexdump | Android | Inspecting raw DEX bytecode directly |
| otool | iOS | Inspecting Mach-O binary load commands and linked libraries |
| class-dump | iOS | Recovering Objective-C class/method signatures from a binary |
Featured Resources
Related Resources
APK Security Scanner
Static analysis APK security scanner. Detect dangerous permissions, hardcoded secrets, insecure exported components, cleartext traffic, and weak signing.
IPA Security Scanner
Static analysis IPA security scanner. Detect ATS misconfigurations, hardcoded secrets, dangerous entitlements, and jailbreak indicators from any IPA.
Go Deeper in the Reference Database
OWASP Mobile Top 10
The ten most critical mobile app security risks (OWASP Mobile Top 10, 2024), explained with Strata's own detection mapping for each category.
T1404: Exploit OS Vulnerability
An adversary technique where an unpatched operating-system vulnerability is used to escalate privileges beyond what the app or attacker should have.
T1476: Deliver Malicious App via Other Means
An adversary technique for distributing a malicious or trojanized application outside of an authorized app store.
Other Categories
Mobile Application Security
Static and dynamic analysis of Android and iOS applications, and the OWASP Mobile Top 10 framework findings map to.
Repository Security
Secret detection, dependency review, SAST patterns, and the access-control practices that keep a codebase auditable.
CI/CD Security
Pipeline trust boundaries, branch protection, artifact integrity, and deployment gating for GitHub Actions and GitLab CI.
Secure SDLC
Treating security requirements as a design constraint from the start, not a review gate at the end.
Vulnerability Management
Turning raw findings into a prioritized, trackable backlog — beyond what a severity score alone can tell you.
Software Supply Chain
Dependency provenance, build artifact integrity, and the trust boundaries every third-party package introduces.
Engineering Leadership
Making application security legible to the people who manage teams and answer for organizational risk.