As Android developers, we know that our app is insulated from other apps in the device by the Android Application Sandboxing model. But the reality is that this sandbox only protects your data. Your APK is completely exposed to other apps, including resources, assets, and code. I wanted to know how much reverse-engineering I could do from within an app, so I built an app that can run on your phone and inspect any other app’s resources, looking at image assets and reading string values. It can even load another app’s code, and execute it. All this happens without leaving the device, without classic reverse-engineering tools on a developer machine.
I’ll walk through the APIs that expose your resources, and show how to put them into action. I will demonstrate how we can inspect, and even execute, another app's code. You will come away with a better understanding of what is and is not protected by the Android Application Sandbox, and which parts of your app are freely available for reverse-engineering.