apk-reverse

APK Reverse Engineering CLI Work Specification

Scope of Application

Prefer this skill when the task falls into the following scenarios:

• Analyze the Java business logic of an APK
• Locate login, signing, risk control, certificate verification, and root detection
• View and modify AndroidManifest.xml
• View and modify smali
• Repackage the APK
• Use Frida for Java/native dynamic Hook
• When the APK contains .so , switch to native analysis

CLI tools verified as available on the current machine

• jadx 1.5.5
• apktool 3.0.2
• frida-ps 17.9.6
• adb
• java

Scenarios where scripts are preferred

The following workflows are high-frequency and their parameters are error-prone, so prefer the skill's built-in scripts:

• Complete in one pass jadx + apktool write to disk and produce a summary:scripts/decode.ps1
• Frida device check, process listing, spawn/attach injection:scripts/frida-run.ps1
• Rebuild, align, sign, and install the APK:scripts/rebuild-sign-install.ps1
• Quickly extract key Manifest components and permissions:scripts/manifest-summary.ps1

The following one-line commands remain called directly and are not wrapped separately:

• adb devices
• adb logcat
• frida-ps -U
• jadx --version
• apktool --version

Built-in Scripts

scripts/decode.ps1

Purpose:

• Run uniformly jadx and apktool
• By default, create the task output directory in the same directory as the original APK
• Output package、java_files、smali_dirs、so_files and other summaries
• Compatible with jadx cases where some decompilation errors occur but usable artifacts are still produced

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx

scripts/frida-run.ps1

Purpose:

• Unify Frida's device, process, and spawn/attach entry points
• Avoid confusion when writing parameters manually -f、-n、-U

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"

scripts/rebuild-sign-install.ps1

Purpose:

• apktool b Rebuild the APK
• zipalign Align
• apksigner Sign and verify the signature
• Optionally directly adb install

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Notes:

• By default, generate and reuse a debug keystore
• By default, output to ProjectDir same directory, for ease of keeping it together with the original package and unpacked directory

scripts/manifest-summary.ps1

Purpose:

• Extract the package name
• List permissions
• List activity/service/receiver/provider
• Mark the main launcher activity

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "C:\work\apktool_out\AndroidManifest.xml"

If you want to analyze .so、lib/arm64-v8a/*.so、lib/armeabi-v7a/*.so, then combine with:

• ida-reverse
• radare2

Tool Division of Labor

jadx

Used for:

• Java decompilation reading
• Package name, class name, method name search
• First understand the APK from high-level logic

Common commands:

jadx -d jadx_out app.apk
jadx --single-class com.example.LoginActivity -d jadx_out app.apk
jadx --deobf -d jadx_out app.apk

apktool

Used for:

• Unpack the APK
• View and modify AndroidManifest.xml
• View and modify smali
• Rebuild the APK

Common commands:

apktool d app.apk -o apktool_out
apktool b apktool_out -o rebuilt.apk

frida

Used for:

• Dynamically observe Java method calls
• Hook native exported functions
• Bypass root detection, certificate verification, and debugging detection

Common commands:

frida-ps -U
frida -U -f com.example.app -l hook.js
frida-trace -U -f com.example.app -j '*!*certificate*'

adb

Used for:

• Device connection
• Install the APK
• View logs
• Pull files

Common commands:

adb devices
adb install -r app.apk
adb shell pm list packages
adb logcat
adb pull /data/local/tmp/file .

Recommended Workflow

1. Triage

First determine the rough composition of the APK; do not rush to modify the package or Hook.

Suggested actions:

1. Use jadx -d jadx_out app.apk to export Java code
2. Use apktool d app.apk -o apktool_out to export smali and resources
3. First check:
   • AndroidManifest.xml
   • Main package
   • application、activity、service、receiver
   • lib/ whether the directory contains .so

2. Java logic observation

Prioritize reading from jadx_out :

• MainActivity
• Application
• Classes related to login, networking, encryption, and risk control
• Third-party SDK initialization classes

Common keywords:

• login
• sign
• encrypt
• cipher
• token
• root
• certificate
• trust
• okhttp
• retrofit
• webview

If the Java code is readable, locate the business logic here first.

3. Smali and resource layer confirmation

When jadx results are incomplete, heavily obfuscated, or actual patching is required, switch to apktool_out：

• Check smali*/
• Check res/values/strings.xml
• Check AndroidManifest.xml

Prioritize patching:

• android:exported
• Debug flags
• root detection return values
• Login verification logic
• Certificate validation branches

4. Rebuild and install

After modification:

apktool b apktool_out -o rebuilt.apk

Or directly use a script to close the loop:

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Notes:

• This skill only guarantees the apktool rebuild pipeline
• If formal installation to a device is needed later, a signing process is usually also required
• If the task moves into signing/alignment, supplement apksigner / zipalign

5. Dynamic Hook

When static analysis is insufficient, use Frida:

• Hook login functions
• Hook OkHttp / Retrofit / WebView key points
• Hook javax.crypto、MessageDigest
• Hook root detection functions
• Hook SSL pinning logic

Principles:

• Hook the Java layer first, then see whether native Hook is needed
• Print parameters and return values first, then decide whether to actively modify return values

Suggestions:

• For simple one-off commands, use frida-*
• For injection workflows that need stable reuse, prefer scripts/frida-run.ps1

6. Native .so triage

If the APK contains critical .so：

• Use apktool or jadx to find lib/**/*.so
• If you only need to export symbols, strings, or do quick triage, you can use radare2
• For long-term in-depth analysis, decompilation, renaming, and type recovery, use ida-reverse

When you encounter these signals, switch to native as soon as possible:

• The Java layer is only a JNI wrapper
• The core signing logic is not in Java
• System.loadLibrary() After that, critical logic disappears
• Certificate validation/risk control is in .so in

Output requirements

Finally, at least explain:

• Entry components and key classes
• Whether the key logic is in Java, smali, or .so
• Confirmed sensitive points: login, signing, root, SSL, WebView, JNI
• If patching was done, explain what was changed
• If Hook was done, explain which class/method/exported function was Hooked

Prohibitions

• Do not blindly modify smali from the start
• Do not write a Hook before looking at the manifest and main entry point
• Do not equate incomplete Java decompilation directly with “logic cannot be analyzed”
• Do not, when .so clearly carries the core logic, continue to struggle with the Java layer

Quick command memo

# 反编译 Java
jadx -d jadx_out app.apk

# 解包 APK
apktool d app.apk -o apktool_out

# 重建 APK
apktool b apktool_out -o rebuilt.apk

# 设备与进程
adb devices
frida-ps -U

# 启动并注入
frida -U -f com.example.app -l hook.js

---

Routing context

Upstream entry: skills/SKILL.md(master control),routing.md Downstream exit:

• Core logic is in .so → ida-reverse/ or radare2/
• Requires dynamic Hook/verification → reverse-engineering/tools-dynamic.md(Frida chapter)
• General reverse engineering methodology → reverse-engineering/SKILL.md

Sibling related modules: reverse-engineering/(.so analysis and advanced Frida usage)

---

On-Demand Bootstrap

The entry script of this skill is already integrated with the unified bootstrap system. When a tool is missing, it will not error out directly; instead, it will automatically attempt to install it.

Automation capability boundaries

Tool	Can be installed automatically	Installation method	Description
jadx	✓	GitHub Release ZIP	Automatically download and extract to %USERPROFILE%\Tools\jadx\
apktool	✓	GitHub Release JAR + wrapper	Automatically download the jar and generate the bat to %USERPROFILE%\Tools\apktool\
frida / frida-ps	✓	pip install frida-tools	Requires Python to be installed
adb	✓	winget / fallback path	Automatically install Android Platform-Tools
zipalign	✗	Android Build-Tools must be installed manually	sdkmanager "build-tools;35.0.0"
apksigner	✗	Android Build-Tools must be installed manually	Same as above

Bootstrap trigger points

• scripts/decode.ps1: Automatically called when jadx or apktool is missing bootstrap-reverse.ps1
• scripts/rebuild-sign-install.ps1: Automatically calls bootstrap when adb or apktool is missing
• scripts/frida-run.ps1: Currently still a manual check (frida is usually already installed via pip)

When bootstrap fails

If automatic installation fails, the script will throw a clear error along with a manual installation link. Common causes:

• Network unavailable (GitHub API / PyPI unreachable)
• winget unavailable (Windows version too old)
• Java not installed (apktool depends on the JDK)