APK / IPA
Definition
Android Package and iOS App Store package, the installable bundles for the two platforms. APK is a ZIP containing AndroidManifest.xml, classes.dex and resources. IPA is a ZIP containing Payload/<App>.app with the Mach-O binary, Info.plist and resources.
- APK contents
- AndroidManifest.xml, classes.dex, resources, packaged as a ZIP
- IPA contents
- Payload/<App>.app with Mach-O binary, Info.plist, resources
- Container format
- Both are ZIP archives
- Platforms
- APK for Android, IPA for iOS
Common questions
What can an examiner learn just from unpacking an APK or IPA without running it?+
Static examination of the manifest or Info.plist reveals declared permissions, entitlements, version information, and bundled resources, while classes.dex or the Mach-O binary can be disassembled to review the app's code paths without ever executing the app on a device.
Why does the difference between classes.dex and a Mach-O binary matter for analysis tooling?+
classes.dex is Dalvik bytecode requiring Android-specific decompilers, while the Mach-O binary is native ARM machine code requiring iOS or Mach-O-aware disassemblers, so the same investigator generally needs separate toolchains to analyse the two package types.
Related terms
- ART
- Android Runtime, the AOT-compiling successor to the Dalvik virtual machine since Android 5.0 Lollipop. Apps compile to OAT files on install for...
- FBE
- File-Based Encryption, the per-file key scheme that replaced Full-Disk Encryption (FDE) from Android 7.0 Nougat onward. Splits files into Credential Encrypted (CE)...
- Secure Enclave
- The dedicated security coprocessor on iPhone 5s and later, running a separate microkernel and holding the per-class encryption keys, the passcode verifier...
- TCC.db
- Transparency, Consent and Control database at /var/mobile/Library/TCC/TCC.db on iOS. Records which apps the user has granted access to camera, microphone, photos, contacts,...
- WAL
- Write-Ahead Log, the SQLite journaling mode that writes new pages to a sibling .db-wal file before checkpointing them into the main database....