Security

Target: Mobiflix Android App (com.mobiflix.mobile) Date: July 18, 2026 Researcher: thamjeed Environment: Fedora WSL2 on Windows 11, Physical Android device (Xiaomi POCO, Android 13, arm64) Scope: Educational — understanding mobile app architecture, API design, native library obfuscation, and dynamic instrumentation techniques. Overview This document is a complete, step-by-step writeup of reverse engineering an Android streaming application from scratch. The goal was to understand: Where the app fetches its content from How the app protects its API endpoints What encryption scheme is used to hide configuration How certificate pinning is implemented and bypassed The full API surface area of the backend The process combined static analysis (decompiling the APK and reading Java/smali code) with dynamic analysis (Frida instrumentation, mitmproxy traffic interception). ...