Static Analysis Methods for Android Binaries: A Complete Guide to the Android Reverse-Engineering Skill

The Android Reverse-Engineering Skill provides a command-line toolkit that decompiles APKs, extracts sensitive API calls, and traces call flows to enable comprehensive static analysis of Android binaries without dynamic execution.

This guide explores the static analysis methods available in the SimoneAvogadro/android-reverse-engineering-skill repository. The skill bundles shell scripts and reference documentation that transform raw Android application packages (APKs) into actionable security intelligence through decompilation, pattern matching, and control-flow tracing.

Overview of the Static Analysis Pipeline

The skill implements a three-stage pipeline for statically analyzing Android binaries. First, scripts/decompile.sh converts Dalvik bytecode into readable Java or Kotlin source. Next, scripts/find-api-calls.sh scans that source for sensitive Android API patterns defined in references/api-extraction-patterns.md. Finally, analysts use references/call-flow-analysis.md to trace execution paths and understand the context surrounding each API invocation.

Decompilation of Dalvik Bytecode

Decompilation is the foundational step that makes static analysis of Android binaries possible. The skill abstracts the complexity of Dalvik bytecode translation through a unified wrapper script.

Using JADX for High-Fidelity Decompilation

The default decompilation engine is JADX, which recovers Java source code from classes.dex with high accuracy. The script scripts/decompile.sh handles JADX invocation and output formatting.

# Decompile an APK using JADX (default)

APK_PATH=/path/to/target.apk
OUT_DIR=decompiled_sources

./plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/decompile.sh "$APK_PATH" "$OUT_DIR"

This produces a directory structure containing reconstructed Java files in sources/. For advanced JADX options, see references/jadx-usage.md.

Using Fernflower as an Alternative Engine

When JADX produces incomplete output, the skill supports Fernflower, an analytical decompiler included with IntelliJ IDEA. The same wrapper script can toggle engines based on environment variables or flags.

# Example of invoking Fernflower variant (see script internals)

DECOMPILER_ENGINE=fernflower ./plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/decompile.sh "$APK_PATH" "$OUT_DIR"

Configuration details for Fernflower-specific flags are documented in references/fernflower-usage.md.

API Call Extraction and Pattern Matching

Once source code is available, the next static analysis method identifies sensitive Android API usage. The script scripts/find-api-calls.sh implements regex-based pattern matching against the decompiled sources.

# Scan decompiled sources for sensitive API calls

./plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/find-api-calls.sh "$OUT_DIR" > suspicious_apis.txt

The script references regex patterns defined in references/api-extraction-patterns.md, which catalog known permission-protected methods such as LocationManager.requestLocationUpdates, SmsManager.sendTextMessage, and Camera.open. This extraction generates a prioritized list of potentially dangerous code paths requiring deeper investigation.

Call-Flow and Control-Flow Analysis

Identifying API calls is insufficient for security assessment; understanding the execution context is critical. The skill provides methodology documentation in references/call-flow-analysis.md for tracing how data reaches the sensitive APIs discovered in the previous step.

This static analysis method involves:

1. Back-tracing invocations to identify which user actions or broadcast receivers trigger the API call
2. Data-flow analysis to determine if user-controlled input reaches the API without sanitization
3. Conditional guard inspection to verify whether permission checks or authentication gates protect the API invocation

Unlike automated scripts, this phase requires manual review guided by the patterns in references/call-flow-analysis.md, enabling analysts to construct an accurate control-flow graph of the application.

Environment Setup and Dependency Validation

Before executing the static analysis pipeline, the skill verifies that all required tools are available. The script scripts/check-deps.sh functions as a pre-flight check for the environment.

# Validate dependencies before analysis

./plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/check-deps.sh

This script checks for:

• Java Runtime (required for running JADX and Fernflower)
• JADX (primary decompiler)
• Fernflower (alternative decompiler)
• Shell utilities (grep, sed, awk for pattern matching)

If dependencies are missing, the script outputs installation instructions tailored to the detected operating system.

Complete Static Analysis Workflow Example

The following command sequence demonstrates the complete static analysis of an Android binary using the skill's methods:

# Define paths

SKILL_ROOT=./plugins/android-reverse-engineering/skills/android-reverse-engineering
TARGET_APK=/path/to/application.apk
OUTPUT_DIR=./analysis_output

# Step 1: Verify environment

$SKILL_ROOT/scripts/check-deps.sh

# Step 2: Decompile the APK

$SKILL_ROOT/scripts/decompile.sh "$TARGET_APK" "$OUTPUT_DIR/sources"

# Step 3: Extract sensitive API calls

$SKILL_ROOT/scripts/find-api-calls.sh "$OUTPUT_DIR/sources" > "$OUTPUT_DIR/potential_risks.txt"

# Step 4: Manual call-flow analysis (guided by reference documentation)

# Review $OUTPUT_DIR/potential_risks.txt, then trace contexts using methodology from:

# $SKILL_ROOT/references/call-flow-analysis.md

This workflow transforms a raw APK into a structured security report, identifying sensitive API usage and providing the contextual analysis necessary for vulnerability assessment.

Summary

• Decompilation: The scripts/decompile.sh wrapper converts Dalvik bytecode to Java source using JADX or Fernflower, enabling readable static analysis of Android binaries.
• API Extraction: scripts/find-api-calls.sh scans decompiled sources against regex patterns defined in references/api-extraction-patterns.md to identify permission-protected Android APIs.
• Call-Flow Analysis: The methodology in references/call-flow-analysis.md supports manual tracing of execution paths to understand the context of sensitive API invocations.
• Dependency Management: scripts/check-deps.sh validates that Java, JADX, and other required tools are present before analysis begins.
• Integration: These methods form a cohesive pipeline that analyzes APKs without dynamic execution, producing actionable security intelligence from static sources.

Frequently Asked Questions

What is the difference between JADX and Fernflower in this skill?

JADX is the default decompiler in scripts/decompile.sh, optimized for Android Dalvik bytecode and producing highly readable Java source with minimal configuration. Fernflower serves as an analytical alternative when JADX output is incomplete; it is the decompiler bundled with IntelliJ IDEA and excels at reconstructing complex control structures. The skill supports both to ensure robust decompilation coverage across different APK obfuscation schemes.

How does the API call extraction script identify sensitive Android APIs?

The scripts/find-api-calls.sh utility performs regex-based pattern matching against decompiled source directories. It references the pattern definitions stored in references/api-extraction-patterns.md, which catalog known permission-protected methods such as LocationManager.requestLocationUpdates, SmsManager.sendTextMessage, and Camera.open. When matches are found, the script outputs the file path, line number, and matched API signature, creating a prioritized list for security review.

Can this static analysis pipeline run without an Android emulator?

Yes, the entire pipeline is designed for static analysis without dynamic execution. The workflow relies on decompiling APKs into source code (scripts/decompile.sh) and analyzing those sources through pattern matching and manual review (scripts/find-api-calls.sh and references/call-flow-analysis.md). No emulator, device, or runtime instrumentation is required, making the analysis suitable for CI/CD environments and automated security scanning.

How do I extend the regex patterns for custom API detection?

To add custom detection patterns, edit the references/api-extraction-patterns.md file and append your regex definitions following the existing format. Each pattern should target specific method signatures or class names relevant to your audit requirements. After updating the patterns, rerun scripts/find-api-calls.sh against your decompiled sources; the script automatically incorporates all regex definitions from the reference file without requiring code changes to the script itself.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}