How I passed eMAPT

6 min readFeb 22, 2025

Hello everyone, In this blog, I will share my experiences about eMAPT. On 17th January, I took the exam. But before I read many blogs about candidates’ experiences and what they have experienced during the exam. First, I just sniffed the blogs and resources that I might come across during the exam. It’s important to read other people’s experiences. You should know what you can get in the exam. First of all, it’s important to know about Android architecture. You will not get the iOS part, but if you are a mobile hacker, :) I suggest you learn after eMAPT if you want to pass the exam. OK, I know it’s not only passing the exam but also understanding the objective and the architecture, how the APKs interact, and the vulnerability. After reading you will become familiar with android. But let me give you one good suggestion that you should look to: https://owasp.org/www-project-mobile-top-10/. It will give you an idea about the vulnerability of mobile. Many people are knowing that I am a full stack reverse engineer so when I started to learn about mobile I started to learn some coding in Android studio to understand the android architecture. After building the APK, I just started reverse engineering the APK for a general idea. I love starting from scratch and reversing everything to understand something; that’s my workflow. It is also for the computer; when you want to understand about the computer, you can reverse it until you come from the point where you started. So that’s what I did during the learning process. I know there are not many resources about this, but I suggest you learn with AI. I did that, of course, without understanding that you will not be able to input relevant information that you want to have. Read about mobile vulnerabilities, then try them yourself. You don’t need to master Java or Kotlin right away most people know a bit of some language they like. Logic stays the same; only the syntax changes, so adapt what you know. Use Android Studio and write step by step, building your understanding. Forget what eMAPT says it’s about what you can solve with your own experience. ‘Know’ is learning the theory; ‘How’ is doing it yourself. Together, they’re like life: knowing shows you the path, doing makes you walk it. It’s not just about the code it’s about overcoming your doubts and growing through action. What I have seen in the exam was not complicated; you just need to follow the methodology typical for pentesting because your goal is to pentest the application. I will give below some useful resources that you should take a look.

If you understand Android Studio and Android APKs, you understand how to analyze the file with reverse engineering tools. You know what you should know to explore the vulnerability; you are good to go.

About the exam

The eMAPT exam lasts for seven days and focuses only on Android applications, even though the training covers both Android and iOS. During the exam, you will be given two vulnerable applications. Your task is to identify the vulnerabilities and then develop a malicious application that exploits them. To pass, you must submit your .apk file and the PoC (Proof of Concept) code of your exploit within the given time. Unlike other security exams, you are not required to submit a penetration test report.

Analysis and Logical Approach

As I mentioned, you will be given two applications. My advice is to thoroughly analyze every detail examine what is present, what is missing, and try to understand the functions. Identify any connections within the application and take notes, as these will be useful later. This is how I worked, for example when analyzing an application, I always took notes because I knew they would come in handy in the future. Once you have fully analyzed the first application and are confident in your findings, move on to the second one. Analyze it carefully, take notes, and proceed slowly. You have 7 days, which is more than enough. Speed is not important; accuracy and logical reasoning matter the most. Every line of code can unlock new possibilities. Once you gain the necessary know-how, everything will start falling into place like a chain reaction. It is also beneficial to be familiar with reverse engineering tools. For example, JADX is great for decompiling Java-based applications, while MobSF is a powerful tool for static analysis. Another important file to check is the AndroidManifest.xml examine what is present, what is missing, and whether there are any vulnerabilities. You can refer to the resources I have shared with you to understand what to look for in this file. Again, proceed slowly but logically. Take notes at every step, try to understand the functions, and pay attention to vulnerabilities. You can check out courses like TCM Security, but my recommendation is to first understand Android APKs and their vulnerabilities before purchasing a voucher (since it is valid for 6 months). Learn how APKs are structured once you grasp that, everything else will follow naturally. If you find yourself struggling to understand certain aspects, then you can look into courses. A simple Google search for “TCM Security Mobile” will lead you to relevant resources. However, my strongest advice is to read, take notes, and practice it will be highly beneficial for your learning process.

Yes, as I mentioned before, when I learn something new, I follow a similar approach to writing a “Hello, World!” program in C. Then, I analyze the file structure down to the smallest detail to understand how it works. I enjoy both dismantling and building. However, redistributing something I have created teaches me not only how to construct it but also how to distribute it properly. Because everything follows a method, and working logically is essential; knowing how things function is important. A similar approach can be applied to APK analysis. When analyzing an application, the first step is to run it in its most basic form and observe its behavior just like writing a “Hello, World!” program. Then, it is essential to deeply examine its file structure, manifest content, permissions, code structure, dynamic behavior, encryption, and method calls to fully understand how it operates. I follow a process of both deconstruction and reconstruction:

First, I analyze and break it down into its components to understand how it works. Then, I modify, rebuild, and run it again. This approach helps me learn reverse engineering while also understanding how software can be distributed and optimized. Because everything follows a method, and working logically is fundamental. Without understanding how an APK works, analyzing it or testing its security would be incomplete.

Finally, don’t get excited. Stay cool and collected, like a soldier who is focused and disciplined, and like a detective who pays close attention to every detail. Carefully look over everything; don’t miss anything. Even though seven days might not seem like much, they’re more than enough if you plan well. Reading isn’t enough; you have to really understand. A lot of people fail because they quickly read through ideas without understanding what they mean. You can’t just know things in an academic way; you have to use what you know. You can’t have a body without a soul or a soul without a body. Similarly, you can’t learn anything without putting it into practice. Don’t think of the process as a chore, but as a way to learn new things. Look at, question, test, and make sense of the data. Everything else will just fit into place once you understand how it works.

If you have any questions or you did not understand, you can always ask me.

Resources:

Link: https://certs.ine.com/b419ef26-85ef-4db5-91f9-bf82f3d234b3#acc.KjmrsHFQ

How I passed eMAPT

About the exam

Analysis and Logical Approach

Resources:

Written by Ahmet Göker

No responses yet