> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/cool-stuff/i-reverse-engineered-this-android-application-and-heres-what-i-found-netmirror.md).

# I Reverse Engineered this Android Application and here’s what i found! - Netmirror

<figure><img src="https://cdn-images-1.medium.com/max/800/1*zgOjrt8HN6Mvzw3qsK44rw.png" alt=""><figcaption></figcaption></figure>

Yo, everyone, This is Alham Rizvi and welcome to another crazy write-up. Today I wasted like 3 hours analyzing the decompiled and reverse-engineered code of a modded application from an OTT platform called NetMirror. The results got pretty interesting.

I’ve only partially analyzed it so far, but I already found several major issues inside the APK. So buckle up and get ready to read the full breakdown of this analysis.

> ***WARNING: This document details critical security findings from static analysis of a modified/pirated APK distributed as “netmirror.” If you have this application installed, uninstall it immediately.***

#### Overview

**netmirror** is distributed as a free, modded OTT (Over-The-Top) screen mirroring application. Upon decompiling the APK using JADX, it becomes clear that beneath its streaming functionality lies a deeply invasive data collection and device control framework.

This writeup documents **9 critical security findings** identified through static analysis. The application collects camera data, precise GPS coordinates, Wi-Fi IP address, installed app lists none of which are necessary for a OTT app. On rooted devices, it achieves full system compromise.

**This is not a legitimate streaming application. It seems like a spyware.**

#### Tools & Methodology

Tool Purpose **JADX-GUI** APK decompilation and Java source reconstruction **AndroidManifest.xml analysis** Permission and component enumeration **Static code analysis** Reviewing decompiled Java for malicious logic

The APK was decompiled and all source files, resources, and the manifest were reviewed. No dynamic analysis (runtime execution) was performed — all findings are based on static inspection of the decompiled source.

#### Application Metadata

Property Value App Name netmirror Category Modded / Pirated APK `minSdkVersion` 16 (Android 4.1 Jelly Bean and above) `targetSdkVersion` 32 (Android 12) Root Access Detected **YES** Embedded Third-Party Frameworks Aptoide Remote Installer, Rakam Analytics Decompilation Errors 11+ errors (obfuscation artifacts)

#### Dangerous Permissions (AndroidManifest.xml)

The following permissions are declared in the app’s manifest. They are grouped by severity:

<figure><img src="https://cdn-images-1.medium.com/max/800/1*oWgyKXL0Zjphllg4gZoI1Q.png" alt=""><figcaption></figcaption></figure>

#### 🔴 Critical — No legitimate justification for a streaming app

```
<uses-permission android:name="android.permission.CAMERA"/>
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
<uses-permission android:name="android.permission.INSTALL_PACKAGES"/>
<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES"/>
<uses-permission android:name="android.permission.REQUEST_DELETE_PACKAGES"/>
```

#### 🟠 High — Sensitive user data access

```
<uses-permission android:name="android.permission.GET_ACCOUNTS"/>
<uses-permission android:name="android.permission.MANAGE_ACCOUNTS"/>
<uses-permission android:name="android.permission.AUTHENTICATE_ACCOUNTS"/>
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
<uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
<uses-permission android:name="android.permission.QUERY_ALL_PACKAGES"/>
```

#### 🟡 Standard — Expected for network apps (but suspicious in combination)

```
<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
<uses-permission android:name="android.permission.CHANGE_WIFI_MULTICAST_STATE"/>
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
<uses-permission android:name="android.permission.WAKE_LOCK"/>
```

> ***Note:** The combination of all the above is what makes this dangerous. Individually, some permissions have legitimate use cases. Together, they form a complete surveillance and remote access toolkit.*

#### Critical Findings

#### Finding 1 — Covert Camera Access

**Severity: CRITICAL**

The app declares `android.hardware.camera` as a **required** hardware feature — meaning it refuses to install on devices without a camera. It also requests the `CAMERA` permission. A screen-mirroring or OTT streaming application has **zero legitimate need** for camera access.

**Evidence from AndroidManifest.xml (user screenshot on top):**

```
<uses-feature
    android:name="android.hardware.camera"
    android:required="true"/>
```

```
<uses-permission android:name="android.permission.CAMERA"/>
```

**Impact:** On Android versions below 10, camera access can be invoked without visible recording indicators in certain conditions. Combined with `FOREGROUND_SERVICE`, the camera can remain active while the app runs in the background.

***

#### Finding 2 — GPS Location Tracking via LocationManager

<figure><img src="https://cdn-images-1.medium.com/max/800/1*j057IVU0KqqqAs19rz6DCw.png" alt=""><figcaption></figcaption></figure>

**Severity: CRITICAL**

The decompiled class `io.rakam.api.d` (part of the embedded Rakam analytics SDK) actively invokes Android's `LocationManager` to silently collect the device's precise GPS coordinates. It iterates through all available location providers and extracts the most recent location fix.

<figure><img src="https://cdn-images-1.medium.com/max/800/1*K9TggxI3q0YN_WymsjZ3TA.jpeg" alt=""><figcaption></figcaption></figure>

**Evidence from decompiled source (class `C9228d`):**

```
// Fetching all providers
try {
    providers = locationManager.getProviders(true);
} catch (SecurityException e2) {
    C9229e.m29884e().m29888g("Failed to get most recent location", e2);
    providers = null;
}
```

```
// Iterating and extracting last known location
ArrayList<Location> arrayList = new ArrayList<>();
Iterator<String> it = providers.iterator();
while (it.hasNext()) {
    try {
        lastKnownLocation = locationManager.getLastKnownLocation(it.next());
    } catch (IllegalArgumentException e3) {
        lastKnownLocation = null;
    } catch (SecurityException e4) {
        lastKnownLocation = null;
    }
    if (lastKnownLocation != null) {
        arrayList.add(lastKnownLocation);
    }
}
```

**Impact:** The app silently collects and logs the device’s physical GPS location. A pirated OTT/streaming application has absolutely no need to know where you physically are. This data is likely exfiltrated to remote analytics servers.

***

#### Finding 3 — Root Shell Exploitation

**Severity: CRITICAL**

<figure><img src="https://cdn-images-1.medium.com/max/800/1*jBmP7t33VO9lhP0oqWl5fg.jpeg" alt=""><figcaption></figcaption></figure>

The application contains code that invokes `Shell.startRootShell()` — a method used to execute commands with root (superuser) privileges. After executing a shell command, it inspects the output for the string `"uid=0"`, which is the Linux identifier for the root user. Upon finding it, the app logs `"Access Given"`, confirming it successfully detected and exploited elevated privileges.

**Evidence from decompiled source:**

```
Shell.startRootShell().add(command);
commandWait(Shell.startRootShell(), command);
```

```
for (String str : hashSet) {
    log(str);
    if (str.toLowerCase().contains("uid=0")) {
        log("Access Given");
        return true;
    }
}
return false;
```

**Impact:** On rooted devices, this grants the application unrestricted access to the entire Android system. It can read any file, modify system settings, extract credentials from other apps, and install/remove any application — all without user interaction or notification.

#### Finding 4 — Silent APK Install & Delete

**Severity: MEDIUM MAYBE**

The manifest declares three permissions that together constitute a dropper/malware distribution capability:

* `INSTALL_PACKAGES` — Install any APK silently
* `REQUEST_INSTALL_PACKAGES` — Trigger package installation flows
* `REQUEST_DELETE_PACKAGES` — Silently uninstall any app

**Evidence from AndroidManifest.xml:**

```
<uses-permission android:name="android.permission.INSTALL_PACKAGES"/>
<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES"/>
<uses-permission android:name="android.permission.REQUEST_DELETE_PACKAGES"/>
```

**Impact:** Combined with root access (Finding 3) and the embedded Aptoide remote installer (Finding 9), this allows the app or its remote operator to install additional malware payloads or remove security apps from the device without the user’s knowledge or consent.

#### Finding 5 — IP Address Harvesting

**Severity: HIGH**

A dedicated method `getAddress()` uses `WifiManager` to extract the device's local Wi-Fi IP address and convert it into a human-readable `InetAddress` object.

<figure><img src="https://cdn-images-1.medium.com/max/800/1*uF0eGt2iTZaYHdN9FujYNA.png" alt=""><figcaption></figcaption></figure>

**Evidence from decompiled source:**

```
InetAddress getAddress() throws UnknownHostException {
    int ipAddress = ((WifiManager) this.context.getSystemService("wifi"))
                        .getConnectionInfo()
                        .getIpAddress();
    return InetAddress.getByAddress(new byte[]{
        (byte) (ipAddress & 255),
        (byte) ((ipAddress >> 8) & 255),
        (byte) ((ipAddress >> 16) & 255),
        ...
    });
}
```

**Impact:** Combined with GPS location (Finding 2) and network state permissions, the app can construct a complete network and physical fingerprint of the victim’s device and home network.

***

#### Finding 6— Boot Persistence Mechanism

**Severity: HIGH**

The app registers a receiver for the `BOOT_COMPLETED` broadcast intent, ensuring it automatically restarts every time the device is powered on.

```
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
```

**Impact:** This is a classic persistence technique used by spyware and adware. Even if the user force-stops the app, it will silently restart the next time the phone boots. The user cannot prevent the app from running simply by not opening it — it wakes itself up automatically.

#### Finding 7— Embedded Remote APK Installer

**Severity: CRITICAL**

The decompiled source contains a component, This is a remote application installation framework that operates over a socket connection and allows a remote party to push APKs to the device silently.

<figure><img src="https://cdn-images-1.medium.com/max/800/1*_jZg5tRTMT24Gfy84op1hg.jpeg" alt=""><figcaption></figcaption></figure>

**Evidence from decompiled source:**

```
// from class: cm.aptoide.pt.install.remote.RemoteInstallationSenderManager.3
private boolean closed = false;
```

```
public void sendAppId(ReceiverDevice receiverDevice, String str) {
    SocketClientThread socketClientThread = new SocketClientThread(receiverDevice, str);
    this.clientServerThread = socketClientThread;
    socketClientThread.execute(new Void[0]);
}
```

```
public void stopDiscoveringAptoideTVServices() {
    new AsyncTask<Void, Void, Void>() {
        private boolean closed = false;
        ...
    }
}
```

**Impact:** This component allows a remote server or attacker on the same network to push arbitrary APK packages to the victim’s device over a TCP socket connection — completely invisibly. This is the infrastructure for a **remote access trojan (RAT)**-style delivery mechanism embedded directly in the app.

#### Risk Summary

<figure><img src="https://cdn-images-1.medium.com/max/800/1*ftwELS9i4gBHmdl_hdWzSw.png" alt=""><figcaption></figcaption></figure>

#### Indicators of Compromise

If you have had netmirror installed, look for these indicators:

* Unexpected battery drain (background location/camera polling)
* Unusual mobile data usage (data exfiltration to remote servers)
* Apps you didn’t install appearing on the device (dropper activity)
* The app appearing in running services even after force-stop
* Unfamiliar accounts appearing in device account settings

**Suspicious package namespaces found in decompiled code:**

* `io.rakam` — Rakam analytics (covert data collection SDK)
* `cm.aptoide.pt` — Aptoide remote installer
* `androidx.appcompat.app.n` — obfuscated location collection class

***

#### Recommendations

#### Immediate Actions

1. **Uninstall netmirror immediately** via Settings → Apps → netmirror → Uninstall
2. **Revoke all permissions** before uninstalling: Settings → Apps → netmirror → Permissions → Revoke all
3. **Check for unknown installed apps** — the dropper may have already installed secondary payloads
4. **Change passwords** for any Google accounts on the device
5. **Review account activity** in Google Account → Security → Recent activity

#### If your device is rooted

1. **Consider a full factory reset:** root access means the app may have persisted system-level changes that survive a normal uninstall
2. **Re-flash stock firmware** if you suspect deep system compromise

#### Going forward

* **Only install apps from Google Play Store** or verified, reputable sources
* **Never install modded/pirated APKs** — they are a primary vector for spyware distribution
* **Use a mobile security scanner** (e.g., Malwarebytes for Android) to scan sideloaded APKs before installing
* **Check app permissions before granting** — a streaming app never needs camera or GPS access

#### Disclaimer

This writeup is published for **educational and public safety purposes**. The reverse engineering was conducted solely through static analysis (decompilation) of a publicly circulating APK. No systems were compromised in the production of this report. The goal is to warn users about the risks of installing modified applications from unofficial sources.

> Sharing this report openly is encouraged. Pirated and modded APKs are a major and underappreciated vector for consumer spyware. The more people understand what these apps actually do, the safer the ecosystem becomes.

*Writeup produced via static analysis using JADX-GUI. All code snippets are from decompiled output and are reproduced here for security research and public awareness purposes.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/cool-stuff/i-reverse-engineered-this-android-application-and-heres-what-i-found-netmirror.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.