Mobile Malware: Android Basics

• Android apps ship as an APK (a ZIP archive). Key contents:
• classes.dex — compiled Dalvik bytecode (DEX), the app's code.
• AndroidManifest.xml — components, and requested permissions.
• resources.arsc, res/, lib/ (native .so), META-INF/ (signing).
• Permissions are the first triage: SMS, Accessibility Service, device admin, "draw over other apps," install packages = high risk.
• Tools:
• jadx: DEX -> readable Java (decompiler + GUI). Primary tool.
• apktool: unpack/repack, decode manifest and resources to smali.