apk-reverse

ACTION REQUIRED (execute immediately after reading)

Community references such as endpoint extraction/Frida adaptation: ../references/community-security-skills.md; dynamic analysis must be scoped to authorized devices.

NOW: Read ../field-journal/precedent-reverse.md — confirm that this skill's operations are authorized routine operations
NOW: confirm whether the current task falls within this skill's scope of applicability
NEXT: Read ../tool-index.md, verify tool availability and actual paths
NEXT: when tools are missing, call bootstrap; do not guess paths
ACT: enter the first step of the "workflow" and execute it; do not stop in the confirmation state

APK Reverse Engineering CLI Work Specification

Scope of Applicability

Prefer this skill when the task falls into the following scenarios:

Analyze the Java business logic of an APK
Locate login, signing, risk control, certificate verification, root detection
View and modify AndroidManifest.xml
View and modify smali
Repackage the APK
Use Frida for Java/native dynamic Hook
When the APK contains .so , switch to native analysis

CLI tools verified as available on the current machine

jadx 1.5.5
apktool 3.0.2
frida-ps 17.9.6
adb
java

Scenarios where scripts are preferred

The following workflows are high-frequency and parameters are error-prone; prefer the skill's built-in scripts:

Complete in one go jadx + apktool write to disk and produce a summary:scripts/decode.ps1
Frida device check, process listing, spawn/attach injection:scripts/frida-run.ps1
Rebuild, align, sign, install APK:scripts/rebuild-sign-install.ps1
Quickly extract key Manifest components and permissions:scripts/manifest-summary.ps1

The following one-line commands remain called directly and are not separately wrapped:

adb devices
adb logcat
frida-ps -U
jadx --version
apktool --version

Built-in scripts

`scripts/decode.ps1`

Purpose:

Uniformly run jadx and apktool
By default, create the task output directory in the same directory as the original APK
Output package、java_files、smali_dirs、so_files and other summaries
Compatible with jadx the case where some decompilation errors occur but usable artifacts still exist

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx

`scripts/frida-run.ps1`

Purpose:

Unified Frida entry points for device, process, spawn/attach
Avoid confusion when writing parameters by hand -f、-n、-U

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"

`scripts/rebuild-sign-install.ps1`

Purpose:

apktool b rebuild APK
zipalign align
apksigner sign and verify signature
optionally directly adb install

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Notes:

By default, generate and reuse a debug keystore
By default, output to ProjectDir same directory, making it convenient to keep together with the original package and unpacked directory

`scripts/manifest-summary.ps1`

Purpose:

Extract package name
List permissions
List activity/service/receiver/provider
Mark the main launcher activity

Example:

pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "C:\work\apktool_out\AndroidManifest.xml"

If you want to analyze .so、lib/arm64-v8a/*.so、lib/armeabi-v7a/*.so, then combine with:

ida-reverse
radare2

Tool division of labor

`jadx`

Used for:

Java decompilation reading
Package name, class name, method name search
First understand the APK from high-level logic

Common commands:

jadx -d jadx_out app.apk
jadx --single-class com.example.LoginActivity -d jadx_out app.apk
jadx --deobf -d jadx_out app.apk

`JEB Pro`(optional commercial tool)

Used for:

Android DEX / APK / ARM cross-verification and deep decompilation
Supplement static analysis when JADX output is incomplete or heavily obfuscated
Perform second-toolchain verification of classes, methods, and call relationships for the same target

Boundary:

JEB Pro is commercial software and must be obtained and installed with a valid license by the user; this package will not download, crack, or circumvent licenses.
Only when tool-index has confirmed that local JEB is available; otherwise continue using jadx、apktool, Ghidra, IDA or radare2.
The third-party JEB MCP bridge is not a dependency of this package. Before installation, you must follow ../ops/skill-supply-chain.md to review source code, permissions, network behavior and version, and then explicitly confirm registration by the user.

`apktool`

For:

Unpack APK
View and modify AndroidManifest.xml
View and modify smali
Rebuild APK

Common commands:

apktool d app.apk -o apktool_out
apktool b apktool_out -o rebuilt.apk

`frida`

For:

Dynamically observe Java method calls
Hook native exported functions
Bypass root detection, certificate verification, debug detection

Common commands:

frida-ps -U
frida -U -f com.example.app -l hook.js
frida-trace -U -f com.example.app -j '*!*certificate*'

`adb`

For:

Device connection
Install APK
View logs
Pull files

Common commands:

adb devices
adb install -r app.apk
adb shell pm list packages
adb logcat
adb pull /data/local/tmp/file .

Recommended workflow

1. Triage

First determine the rough composition of the APK; do not rush to modify the package or Hook.

Suggested actions:

Use jadx -d jadx_out app.apk to export Java code
Use apktool d app.apk -o apktool_out to export smali and resources
First look at:
- AndroidManifest.xml
- Main package
- application、activity、service、receiver
- lib/ directory whether there is .so
Issue #65 threat pattern quick reference (authorized sample/device; see ../reverse-engineering/references/nonpe-format-cookbook.md §7–8）：
- Transparent/hidden icon (AU):aapt dump badging + manifest theme/label/icon → E-android-hidden-icon-manifest
- Magisk/script device wipe characteristics and remote curl|sh (AR/AS) → characteristics and URL into evidence,Do not executedestructive commands
- Persistence path (AT):service.d / priv-app etc. → E-android-persistence

2. Java logic observation

Prefer reading from jadx_out :

MainActivity
Application
Classes related to login, networking, encryption, risk control
Third-party SDK initialization classes

Common keywords:

login
sign
encrypt
cipher
token
root
certificate
trust
okhttp
retrofit
webview

If the Java code is readable, locate the business logic here first.

3. Smali and resource layer confirmation

When jadx results are incomplete, heavily obfuscated, or actual patching is needed, switch to apktool_out：

Look at smali*/
Look at res/values/strings.xml
Look at AndroidManifest.xml

Prioritize patching:

android:exported
Debug flags
root detection return value
Login verification logic
Certificate verification branch

4. Rebuild and install

After modification:

apktool b apktool_out -o rebuilt.apk

Or directly use the script closed loop:

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Note:

This skill only guarantees the apktool rebuild chain
If formal installation to a device is needed later, a signing process is usually also required
If the task enters signing/alignment, supplement apksigner / zipalign

5. Dynamic Hook

When static analysis is insufficient, use Frida:

Hook login function
Hook OkHttp / Retrofit / WebView key points
Hook javax.crypto、MessageDigest
Hook root detection function
Hook SSL pinning logic

Principles:

Hook the Java layer first, then see whether native Hook is needed
First print the parameters and return values, then decide whether to actively modify the return value

Recommendations:

For simple one-off commands, directly use frida-*
For injection workflows that need stable reuse, prioritize going through scripts/frida-run.ps1

6. Native `.so` triage

If the APK contains key .so：

Use apktool or jadx to find lib/**/*.so
If you only need to export symbols, strings, or do quick triage, you can use radare2
If you need long-term in-depth analysis, decompilation, renaming, and type recovery, use ida-reverse

When you encounter these signals, switch to native as soon as possible:

The Java layer is just a JNI wrapper
The core signature logic is not in Java
System.loadLibrary() After , the key logic disappears
Certificate verification/risk control is in .so in

Output requirements

At minimum, explain:

Entry components and key classes
Whether the key logic is in Java, smali, or .so
Confirmed sensitive points: login, signature, root, SSL, WebView, JNI
If a patch was made, explain what was changed
If a Hook was made, explain which class/method/exported function was Hooked

Prohibitions

Do not blindly modify smali from the start
Do not write a Hook before looking at the manifest and main entry point
Do not equate incomplete Java decompilation directly with “logic cannot be analyzed”
Do not, when .so clearly carries the core logic, continue to stubbornly focus on the Java layer

Quick command memo

# 反编译 Java
jadx -d jadx_out app.apk

# 解包 APK
apktool d app.apk -o apktool_out

# 重建 APK
apktool b apktool_out -o rebuilt.apk

# 设备与进程
adb devices
frida-ps -U

# 启动并注入
frida -U -f com.example.app -l hook.js

Routing context

Upstream entry: skills/SKILL.md(master control),routing.md Downstream exit:

Core logic is in .so → ida-reverse/ or radare2/
Needs dynamic Hook/verification → reverse-engineering/tools-dynamic.md(Frida chapter)
General reverse engineering methodology → reverse-engineering/SKILL.md

Peer related modules: reverse-engineering/(.so analysis and advanced Frida usage)

On-Demand Bootstrap

The entry script of this skill is already connected to the unified bootstrap system. When tools are missing, it will not directly report an error but will automatically try to install them.

Automation capability boundaries

Tool	Can be installed automatically	Installation method	Description
jadx	✓	GitHub Release ZIP	Automatically download and extract to `%USERPROFILE%\Tools\jadx\`
apktool	✓	GitHub Release JAR + wrapper	Automatically download the jar and generate the bat to `%USERPROFILE%\Tools\apktool\`
JEB Pro	✗	The user manually installs and provides a valid license	Optional Android / ARM cross-verification tool; the third-party MCP bridge needs separate auditing
frida / frida-ps	✓	pip install frida-tools	Requires Python to be installed
adb	✓	winget / fallback path	Automatically install Android Platform-Tools
zipalign	✗	Android Build-Tools must be installed manually	`sdkmanager "build-tools;35.0.0"`
apksigner	✗	Android Build-Tools must be installed manually	Same as above

Bootstrap trigger points

scripts/decode.ps1: automatically call when jadx or apktool is missing bootstrap-reverse.ps1
scripts/rebuild-sign-install.ps1: automatically call bootstrap when adb or apktool is missing
scripts/frida-run.ps1: currently still a manual check (frida is usually already installed via pip)

When bootstrap fails

If automatic installation fails, the script will throw a clear error and include a manual installation link. Common causes:

Network is unreachable (GitHub API / PyPI inaccessible)
winget unavailable (Windows version too low)
Java not installed (apktool depends on JDK)

Task completion self-check (MUST pass before claiming completion)

Did I execute every step in the workflow (rather than only reading)?
Did I, based on tool-index use the real tool path?
Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
Did I complete and write back the Checklist items required by RULES?
If hidden icons/device-wiping/persistence clues are hit: did I record E-android-* Evidence per the U–AV cookbook (within authorized scope)?

About this skill

ACTION REQUIRED (execute immediately after reading)

Scope of Applicability

CLI tools verified as available on the current machine

Scenarios where scripts are preferred

Built-in scripts

scripts/decode.ps1

scripts/frida-run.ps1

scripts/rebuild-sign-install.ps1

scripts/manifest-summary.ps1

Tool division of labor

jadx

JEB Pro(optional commercial tool)

apktool

frida

adb

Recommended workflow

1. Triage

2. Java logic observation

3. Smali and resource layer confirmation

4. Rebuild and install

5. Dynamic Hook

6. Native .so triage

Output requirements

Prohibitions

Quick command memo

Routing context

On-Demand Bootstrap

Automation capability boundaries

Bootstrap trigger points

When bootstrap fails

Task completion self-check (MUST pass before claiming completion)

`scripts/decode.ps1`

`scripts/frida-run.ps1`

`scripts/rebuild-sign-install.ps1`

`scripts/manifest-summary.ps1`

`jadx`

`JEB Pro`(optional commercial tool)

`apktool`

`frida`

`adb`

6. Native `.so` triage