Developer Shares Lessons From Authorized Reverse Engineering of an Android App

A developer describes testing a consumer Android app and its backend under written permission, limited to their own account and hardware they were allowed to use. They pulled the APK from a non-rooted device and found a release build with debugging disabled, which pushed the work toward static analysis and black-box testing. The app turned out to be built with Flutter, so its logic sat in compiled native code that was hard to read. Login succeeded with the developer's own account, but protected endpoints required specific version headers beyond the auth token. The developer also notes that the API's error messages helped map its structure, and that defining scope and reporting rules in advance helped avoid mistakes.