AwesomeREA.org

Learning resource

AndroidReverse101

A Chinese-language Android reverse-engineering course by Evil0ctal, planned as 100 daily lessons. It starts from number systems, ARM assembly, the Dalvik/ART runtime and APK loading, then covers APK and DEX structure, Smali editing and repackaging, Frida and Xposed hooking, JNI and native-library analysis, traffic analysis, obfuscation and app hardening, with commands and code for tools such as jadx, apktool, readelf, GDB/LLDB, Frida and Burp Suite. A Crackmes folder adds copies of OWASP's UnCrackable and r2pay practice apps, and a community Indonesian translation follows the published lessons.

Targets
App
Category
Learning resources
Relationship
Learning resource
Sources reviewed

Requirements & limits

  • Reviewed at commit 9b72d20 (2025-12-31), the merge of a community Indonesian translation; the Chinese lessons and crackmes were committed between 22 and 25 February 2025, and there are no releases. The README outlines 100 days in three phases, but the tree holds 44 lessons (Days 1–41, 60, 70 and 100), and the Indonesian translation covers the same 44, many in shortened form.
  • No outside target files are needed to begin: the Day 20 lesson supplies crackme source for learners to compile, and the Crackmes folder commits five practice APKs, UnCrackable-Level1.apk, UnCrackable-Level2.apk, UnCrackable-Level3.apk, r2pay-v0.9.apk and r2pay-v1.0.apk, whose Git blobs are identical to the crackmes in OWASP's MASTG repository. Only Level 1 has a written walkthrough; the README's Crackme 2 link points to a file that is not in the tree.
  • Lessons assume a desktop host with adb and an Android device, and name tools including jadx, apktool, baksmali, readelf, GDB/LLDB, IDA Pro, Ghidra, Frida with frida-server on the device, Burp Suite and Wireshark; the Xposed lesson starts from a device rooted with Magisk.
  • Many phase-two lessons and the Day 70 and Day 100 exercises are framed around modifying third-party apps, including defeating licence, paid-feature, root-detection, certificate-pinning and anti-debugging checks. The README and lessons carry no note on legal use or authorization; this record reproduces none of those steps.
  • The repository is MIT-licensed (copyright 2025 Evil0ctal); the crackmes come from OWASP's CC BY-SA 4.0 MASTG repository, and the tools named keep their own terms. This collection read the README, the lesson tree, the Level 1 walkthrough and a sample of lessons without working through them or running the crackmes. The lessons mention AI only as a reverse-engineering subject, and no REA connection is established.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · Evil0ctal/AndroidReverse101 · Revision 9b72d20
  2. https://github.com/Evil0ctal/AndroidReverse101/tree/9b72d20439155893ab2ce1b8af56af41c17d0411
  3. AndroidReverse101/%E7%AC%AC%E4%B8%80%E9%98%B6%E6%AE%B5_%E8%AE%A1%E7%AE%97%E6%9C%BA%E5%9F%BA%E7%A1%80_%E9%80%86%E5%90%91%E6%A6%82%E8%AE%BA/Day_20_CTF_%E9%80%86%E5%90%91%E6%8C%91%E6%88%98_%E5%88%9D%E7%BA%A7.md GitHub · Evil0ctal/AndroidReverse101 · Revision 9b72d20
  4. AndroidReverse101/%E7%AC%AC%E4%BA%8C%E9%98%B6%E6%AE%B5_APK%E9%80%86%E5%90%91%E5%9F%BA%E7%A1%80/Day_31_Xposed_%E5%85%A5%E9%97%A8.md GitHub · Evil0ctal/AndroidReverse101 · Revision 9b72d20
  5. Crackmes/Android/Level_01/README.md GitHub · Evil0ctal/AndroidReverse101 · Revision 9b72d20
  6. AndroidReverse101_Indonesian GitHub · Evil0ctal/AndroidReverse101 · Revision 9b72d20
  7. LICENSE GitHub · Evil0ctal/AndroidReverse101 · Revision 9b72d20
  8. Crackmes/Android GitHub · OWASP/mastg · Revision 02ffd85

More in References and learning

All 51 entries in References and learning