Android
APK triage without a device: packaged assets, puzzle codecs, JNI, and, by the end, evaluating the DEX that builds the answer.
Day by day
Exported Trust
Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (plain)
STTMDeep Link Drift
Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (reverse)
STTMIntent Injection
Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (base64)
STTMPending Intent Relay
Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (xor)
STTMBackup Spill
Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (split)
STTMProvider Paths
Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (hex)
STTMWebView Bridge
Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (caesar)
STTMCleartext Session
Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (reverse)
STTMTrust Everyone
Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (base64)
STTMNetwork Config Split
Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (split)
STTMLocal Secrets
Static APK inspection, reading a packaged asset, XOR decoding
STTMSQLite Assumptions
Static APK inspection, reading a packaged puzzle asset, matching Mastery deliveries to their questions
STTMKeystore Misuse
Static APK inspection, reading a packaged puzzle asset, matching Mastery deliveries to their questions
STTMPredictable Crypto
Static APK inspection, reading a packaged asset, character-code shift ("caesar") decoding
STTMNative Library Secrets
Static APK inspection, ELF parsing (sections, symbols), reading a JNI function's x86-64 disassembly, following a pointer into .rodata
STTMJNI Boundary
APK structure, JNI native libraries, static string extraction
STTMName Collapse
APK structure, character permutations
STTMEncrypted Strings
APK asset analysis, single-byte XOR
STTMReflection Maze
APK asset analysis, recognising a decoy codec label
STTMLoaded Later
APK asset analysis, DEX file format (header checksums, string/type/field/class tables, static field values), JAR manifest digests
STTMDebug Me If You Can
APK asset analysis, puzzle codec routing, anti-debug concepts (read, not run)
STTMRoot of Trust
APK asset analysis, puzzle codec routing, root-detection concepts (read, not run)
STTMHook Line and Signal
APK assets, DEX reading (baksmali, jadx), static call-graph evaluation, a bounded Dalvik interpreter, decoy code
STTMEmulator Alibi
APK assets, DEX reading (baksmali, jadx), a bounded Dalvik interpreter, secondary DEX loaded from assets, JNI native code (x86-64), mixed-control Masteries
STTMIntegrity Signals
APK structure, the v1 and v2 puzzle assets, a bounded static Dalvik interpreter, mixed-control Masteries
STTMSplit Decision
Split APK bundles (.apks: a ZIP of base.apk plus feature splits), the v1 and v2 puzzle assets, jadx reading, a bounded static Dalvik interpreter, mixed-control Masteries
STTMDependency Surface
APK triage (manifest, DEX string table, assets), the v1 puzzle asset and its codecs, mixed-control Masteries
STTMProtocol Reconstruction
STTMWhite Box Key Recovery
APK triage (puzzle asset, DEX strings), recovering an additive key schedule from a known plaintext prefix, the v2 static interpreter for the timed modes
STTMLayered Protections
APK triage (DEX string table, assets), stacked encodings (Base64, a position-keyed XOR, byte reversal), recovering a key schedule from a known prefix, a branch-aware evaluator for a small x86-64 JNI function
STTMMobile Arena Gauntlet
APK triage without a device; static evaluation of the DEX method that builds the answer; the earlier days' controls (JNI native code, a secondary DEX, reflection) modelled offline
STTM