GoMobSec · anatomy of a scan

A scan, stage by stage

The scan line runs the eleven stages in order. Beside it, each stage plays its own animation: the app taken apart for the static stages, then the running app, its traffic, the malware scanners, its personal data and the AI review.

Stage · scan lineGOMOBSEC0102030405060708091011MASVSAPKAI
What it tests · the app, taken apart
GOMOBSEC · TEST DEVICEMASVSRUNTIMEPROXY 06Native libraries lib/*.so 05Third-party SDKs bundled libraries 04Resources and assets res/, assets/ 03Bytecode classes.dex 02Manifest AndroidManifest.xml 01Signature META-INF/
TEST DEVICEAPPAGENTKeystore and cryptojavax.crypto.CipherCRYPTO · AES/ECB, hardcoded keyShared preferencesshared_prefs/*.xmlSTORAGE · token in plain textSQLite databasesdatabases/*.dbSTORAGE · PII in plain-text tableFilesfiles/, external storageSTORAGE · world-readable fileSystem logandroid.util.LogSTORAGE · password in the logApp processroot and tamper checksRESILIENCE · root check bypassed
TEST DEVICEINSPECTApp APIapi.example.comAUTH · reads other users' recordsAuth serviceauth.example.comNETWORK · weak TLS still acceptedAnalytics endpointcollect.example.netNETWORK · device ID over plain HTTP
RISKAPKSignature scanknown-malware signaturesno signature matchesRule matchingGoMobSec rule setloads code from assets at runtimePacker detectionpackers, obfuscators, compilerobfuscator with string encryptionBehaviour scoringcall-graph behavioursreads SMS, then opens a socketrisk 42 / 100 · medium
ON DEVICEAPP · BUNDLED SDKSLocationContactsAdvertising IDEmailANALYTICSADSCRASHAnalyticsanalytics endpointPRIVACY · precise location sentAd networkad network endpointPRIVACY · ad ID sent before consentCrash reportingcrash reporting endpointPRIVACY · email inside crash logsPrivacy declarationsdata safety form and privacy manifestPRIVACY · location use not declared
CorrelateClassifierRemediationReport writerQA validatorReportDOCXXLSXSARIFJSON
App under testTool head, app parts and MASVS lamps working nowMASVS groups already coveredFinding, on the tray and on the part it came fromFalse positive suppressed by AI reasoning
  1. Ingestion
  2. Decompilation
  3. Static analysis
  4. Dependency check
  5. Threat intel
  6. Dynamic analysis
  7. Network analysis
  8. Malware analysis
  9. Privacy analysis
  10. AI reasoning
  11. Report
Decompilation is where the app comes apart: the manifest, bytecode and resources are unpacked so static analysis can read them. Dependency check reads the bundled SDKs, threat intel looks up the package hashes, malware analysis scans bytecode and native libraries, and privacy analysis checks resources and SDKs for trackers and PII. Dynamic and network analysis test the running app on a test device. AI reasoning then reviews every finding, and the report maps what remains to the eight OWASP MASVS groups (lamps, left to right: STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY). Finding counts are illustrative.