apk-reverse

Bundled upstream support

Supporting files are included at skill-relative paths. See UPSTREAM-NOTICE.md for their pinned sources, licenses, hashes, and import changes.

Supporting material availability

These paths remain unavailable in this catalog copy:

<support-root>/scripts/decode.ps1
<support-root>/scripts/frida-run.ps1
<support-root>/scripts/rebuild-sign-install.ps1

Do not invoke a step that requires one of these files. Obtain the original material and review its dependencies, license, and effects before use. Independent inline steps and the bundled helpers can proceed within the user’s authorized scope.

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

Ask the user to state the exact target URL, IP, account, or resource.

Ask the user to confirm written authorization and the permitted scope.

Show the exact command(s) and explain their expected effect.

Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

When to Use

Analyzing or modifying an Android APK during an authorized assessment.
Hooking runtime behavior of an app you own or are cleared to test.

Scope of Application

Use this skill first when the task falls into the following scenarios:

Analyze the Java business logic of an APK
Locate login, signing, risk control, certificate verification, root detection
View and modify AndroidManifest.xml
View and modify smali
Repackage the APK
Use Frida for Java/native dynamic Hook
When the APK contains .so , switch to native analysis

CLI tools verified as available on the current machine

jadx 1.5.5
apktool 3.0.2
frida-ps 17.9.6
adb
java

Scenarios where scripts should be preferred

The following workflows are high-frequency and their parameters are error-prone; prefer the skill's built-in scripts:

Complete in one go jadx + apktool dumping to disk and produce a summary:scripts/decode.ps1
Frida device check, process listing, spawn/attach injection:scripts/frida-run.ps1
Rebuild, align, sign, install APK:scripts/rebuild-sign-install.ps1
Quickly extract key Manifest components and permissions:scripts/manifest-summary.ps1

The following one-line commands remain called directly and are not separately wrapped:

adb devices
adb logcat
frida-ps -U
jadx --version
apktool --version

Built-in scripts

`scripts/decode.ps1`

Purpose:

Run uniformly jadx and apktool
By default, create the task output directory in the same directory as the original APK
Output package、java_files、smali_dirs、so_files and other summaries
Compatible with jadx cases where some decompilation errors occur but usable artifacts still exist

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx

`scripts/frida-run.ps1`

Purpose:

Unified Frida entry points for device, process, spawn/attach
Avoid confusion when writing parameters manually -f、-n、-U

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"

`scripts/rebuild-sign-install.ps1`

Purpose:

apktool b rebuild APK
zipalign align
apksigner sign and verify signature
Optionally directly adb install

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Notes:

By default, generate and reuse a debug keystore
By default, output to the same directory as ProjectDir , making it easy to keep together with the original package and unpacked directory

`scripts/manifest-summary.ps1`

Purpose:

Extract package name
List permissions
List activity/service/receiver/provider
Mark the main launcher activity

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "C:\work\apktool_out\AndroidManifest.xml"

If you want to analyze .so、lib/arm64-v8a/*.so、lib/armeabi-v7a/*.so, then combine with:

ida-reverse
radare2

Tool division of labor

`jadx`

Used for:

Java decompilation reading
Package name, class name, method name search
Understand the APK from high-level logic first

Common commands:

jadx -d jadx_out app.apk
jadx --single-class com.example.LoginActivity -d jadx_out app.apk
jadx --deobf -d jadx_out app.apk

`JEB Pro`(optional commercial tool)

Used for:

Cross-validation and deep decompilation of Android DEX / APK / ARM
Supplement static analysis when JADX output is incomplete or heavily obfuscated
Perform second-toolchain verification of classes, methods, and call relationships for the same target

Boundaries:

JEB Pro is commercial software and must be obtained and installed with a valid license by the user; this package will not download, crack, or circumvent licensing.
Only call when tool-index has confirmed that JEB is available on this machine; otherwise continue using jadx、apktool, Ghidra, IDA, or radare2.
The third-party JEB MCP bridge is not a dependency of this package. Before installation, you must review the source code, permissions, network behavior, and version according to ../ops/skill-supply-chain.md , and then have the user explicitly confirm registration.

`apktool`

Used for:

Unpack APK
View and modify AndroidManifest.xml
View and modify smali
Rebuild APK

Common commands:

apktool d app.apk -o apktool_out
apktool b apktool_out -o rebuilt.apk

`frida`

For:

Dynamically observe Java method calls
Hook native exported functions
Bypass root detection, certificate verification, debugging detection

Common commands:

frida-ps -U
frida -U -f com.example.app -l hook.js
frida-trace -U -f com.example.app -j '*!*certificate*'

`adb`

For:

Device connection
Install APK
View logs
Pull files

Common commands:

adb devices
adb install -r app.apk
adb shell pm list packages
adb logcat
adb pull /data/local/tmp/file .

Recommended workflow

1. Triage

First determine the general composition of the APK; don't rush to modify the package or Hook.

Suggested actions:

Use jadx -d jadx_out app.apk to export Java code
Use apktool d app.apk -o apktool_out to export smali and resources
First look at:
- AndroidManifest.xml
- Main package
- application、activity、service、receiver
- lib/ Is there any in the directory .so
Issue #65 Threat Form Quick Reference (authorized sample/device; see ../reverse-engineering/references/nonpe-format-cookbook.md §7–8）：
- Transparent/hidden icon (AU):aapt dump badging + manifest theme/label/icon → E-android-hidden-icon-manifest
- Magisk/script bricking characteristics and remote curl|sh (AR/AS) → characteristics and URL for evidence,do not executedestructive command
- Persistence paths (AT):service.d / priv-app etc. → E-android-persistence

2. Java logic observation

Prioritize reading from jadx_out :

MainActivity
Application
Login, network, encryption, risk control related classes
Third-party SDK initialization classes

Common keywords:

login
sign
encrypt
cipher
token
root
certificate
trust
okhttp
retrofit
webview

If the Java code is readable, locate the business logic here first.

3. Smali and resource layer confirmation

When jadx results are incomplete, heavily obfuscated, or actual patching is needed, switch to apktool_out：

Look at smali*/
Look at res/values/strings.xml
Look at AndroidManifest.xml

Prioritize patching:

android:exported
Debug flag
root detection return value
Login verification logic
Certificate verification branch

4. Rebuild and install

After modification:

apktool b apktool_out -o rebuilt.apk

Or directly use the script to close the loop:

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Note:

This skill only guarantees the apktool rebuild chain
If it later needs to be formally installed on the device, a signing process is usually still required
If the task enters signing/alignment, supplement apksigner / zipalign

5. Dynamic Hook

When static analysis is insufficient, use Frida:

Hook login function
Hook OkHttp / Retrofit / WebView key points
Hook javax.crypto、MessageDigest
Hook root detection function
Hook SSL pinning logic

Principles:

First Hook the Java layer, then see whether native Hook is needed
First print parameters and return values, then decide whether to actively modify the return value

Suggestions:

For simple one-off commands, directly use frida-*
For injection flows that need stable reuse, prioritize scripts/frida-run.ps1

6. Native `.so` routing

If the APK contains key .so：

Use apktool or jadx to find lib/**/*.so
If it is only for exporting symbols, strings, and quick triage, you can use radare2
For long-term in-depth analysis, decompilation, renaming, and type recovery, use ida-reverse

When encountering these signals, switch to native as soon as possible:

The Java layer is only a JNI wrapper
The core signing logic is not in Java
System.loadLibrary() After that, key logic disappears
Certificate verification/risk control in .so medium

Output requirements

At the end, at least explain:

Entry components and key classes
Whether the key logic is in Java, smali, or .so
Confirmed sensitive points: login, signature, root, SSL, WebView, JNI
If a patch was made, explain what was changed
If a Hook was made, explain which class/method/exported function was hooked

Prohibited actions

Do not blindly modify smali from the start
Do not write Hooks before looking at the manifest and main entry point
Do not equate incomplete Java decompilation directly with "logic cannot be analyzed"
Do not, when .so clearly carries the core logic, keep stubbornly working on the Java layer

Quick command memo

# 反编译 Java

> ⚠️ Security notice: examples below may include download-and-execute patterns, shown for defensive understanding and authorized testing only. Never run them against systems you do not own.

jadx -d jadx_out app.apk

# 解包 APK
apktool d app.apk -o apktool_out

# 重建 APK
apktool b apktool_out -o rebuilt.apk

# 设备与进程
adb devices
frida-ps -U

# 启动并注入
frida -U -f com.example.app -l hook.js

Routing context

Upstream entry: skills/SKILL.md(master control),routing.md Downstream exit:

Core logic is in .so → ida-reverse/ or radare2/
Requires dynamic Hook/verification → reverse-engineering/tools-dynamic.md(Frida chapter)
General reverse engineering methodology → reverse-engineering/SKILL.md

Sibling related modules: reverse-engineering/(.so analysis and advanced Frida usage)

On-Demand Bootstrap

The entry script of this skill is connected to the unified bootstrap system. When a tool is missing, it will not directly report an error, but will automatically try to install it.

Automation capability boundaries

Tool	Can be installed automatically	Installation method	Description
jadx	✓	GitHub Release ZIP	Automatically download and extract to `%USERPROFILE%\Tools\jadx\`
apktool	✓	GitHub Release JAR + wrapper	Automatically download the jar and generate the bat to `%USERPROFILE%\Tools\apktool\`
JEB Pro	✗	User manually installs and provides a valid license	Optional Android / ARM cross-validation tool; the third-party MCP bridge needs separate auditing
frida / frida-ps	✓	pip install frida-tools	Requires Python to be installed
adb	✓	winget / fallback path	Automatically install Android Platform-Tools
zipalign	✗	Requires manual installation of Android Build-Tools	`sdkmanager "build-tools;35.0.0"`
apksigner	✗	Requires manual installation of Android Build-Tools	Same as above

Bootstrap trigger points

scripts/decode.ps1: automatically calls when jadx or apktool is missing bootstrap-reverse.ps1
scripts/rebuild-sign-install.ps1: automatically calls bootstrap when adb or apktool is missing
scripts/frida-run.ps1: currently still a manual check (frida is usually already installed via pip)

When bootstrap fails

If automatic installation fails, the script will throw a clear error with a manual installation link. Common causes:

Network unreachable (GitHub API / PyPI unreachable)
winget unavailable (Windows version too old)
Java not installed (apktool depends on JDK)

Task completion self-check (MUST pass before claiming completion)

Did I execute every step in the workflow (rather than only reading)?
Did I use a real tool path based on tool-index ?
Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
Did I complete and write back the Checklist items required by RULES?
If hidden icon/device-bricking/persistence clues are hit: are E-android-* Evidence recorded according to the U–AV cookbook (within the authorized scope)?

Limitations

Repackaging and hooking tamper with the target app; never do this on apps outside your authorization.
Requires local Android toolchain (jadx/apktool/Frida/adb); heavily obfuscated or packed apps may resist static analysis.

Adapted from zhaoxuya520/reverse-skill (MIT).

About this skill

Bundled upstream support

Supporting material availability

When to Use

Scope of Application

CLI tools verified as available on the current machine

Scenarios where scripts should be preferred

Built-in scripts

scripts/decode.ps1

scripts/frida-run.ps1

scripts/rebuild-sign-install.ps1

scripts/manifest-summary.ps1

Tool division of labor

jadx

JEB Pro(optional commercial tool)

apktool

frida

adb

Recommended workflow

1. Triage

2. Java logic observation

3. Smali and resource layer confirmation

4. Rebuild and install

5. Dynamic Hook

6. Native .so routing

Output requirements

Prohibited actions

Quick command memo

Routing context

On-Demand Bootstrap

Automation capability boundaries

Bootstrap trigger points

When bootstrap fails

Task completion self-check (MUST pass before claiming completion)

Limitations

`scripts/decode.ps1`

`scripts/frida-run.ps1`

`scripts/rebuild-sign-install.ps1`

`scripts/manifest-summary.ps1`

`jadx`

`JEB Pro`(optional commercial tool)

`apktool`

`frida`

`adb`

6. Native `.so` routing