# Building Automated APK Reverse Engineering Pipelines with Jadx, Apktool, and Frida Hooks

> Automate APK reverse engineering with Jadx, Apktool, and Frida hooks. Discover how to build efficient pipelines using the reverse-skill repository for seamless decompilation and dynamic analysis.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: tutorial
- Published: 2026-08-09

---

**The reverse-skill repository provides a platform-agnostic routing engine that automates APK decompilation using Jadx and Apktool, followed by dynamic instrumentation via Frida hooks, all orchestrated through a unified CLI interface.**

Building automated APK reverse engineering pipelines with Jadx, Apktool, and Frida hooks requires a coordinated toolchain that handles static analysis, dynamic instrumentation, and secure execution contexts. The **reverse-skill** repository implements exactly this workflow through a modular architecture that routes tasks, bootstraps dependencies, and enforces security contracts. This guide walks through the specific scripts and configuration files that enable fully automated Android binary analysis.

## Architecture Overview and Routing Layer

The **reverse-skill** engine operates on a routing-based architecture defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). This configuration file contains rules that recognize APK-related keywords such as `apk`, `smali`, `jadx`, and `apktool`, automatically routing requests to the [`apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/apk-reverse/SKILL.md) capability.

Before any operation executes, the router validates **auth.status** and **network_profile** contracts through `skills/scripts/case-init.ps1`. This gating mechanism prevents unauthorized execution and ensures the environment meets security requirements. The tool discovery phase runs `skills/scripts/refresh-tool-index.ps1` (and its Bash counterpart) to enumerate supported utilities, marking Jadx and Frida as bootstrap-capable entries when present.

## Bootstrapping the Toolchain

When the pipeline detects missing dependencies, it invokes `skills/scripts/bootstrap-reverse.ps1` (or the `.sh` variant for Linux/macOS). The bootstrap manifest at [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) defines installation procedures, specifying Jadx installation from the GitHub release `skylot/jadx` and Frida installation via `pipx`.

Run the bootstrap once to prepare your environment:

```powershell

# PowerShell – install Jadx & Frida if missing

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/bootstrap-reverse.ps1 -Capability @('jadx','frida')

```

## Static Analysis Pipeline with Jadx and Apktool

The static analysis phase extracts resources and generates readable Java/Kotlin source code. The core script [`skills/apk-reverse/scripts/decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/decode.sh) orchestrates this workflow by first ensuring Jadx availability through the `ensure_tool "jadx"` function, then invoking both Apktool and Jadx.

The script performs three critical operations:

- **Resource extraction** via Apktool to recover [`AndroidManifest.xml`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AndroidManifest.xml) and asset files
- **Smali bytecode** generation for low-level analysis
- **Java source recovery** via Jadx using the `-d` flag to specify output directories

Execute the static pipeline with:

```bash

# Bash – decode an APK (default: run both apktool & jadx)

chmod +x skills/apk-reverse/scripts/decode.sh
./skills/apk-reverse/scripts/decode.sh MyApp.apk --name MyApp --out out_dir

```

This produces two output directories:
- `out_dir/jadx` – Decompiled Java/Kotlin source files
- `out_dir/apktool` – Disassembled Smali code and resources

## Dynamic Instrumentation with Frida Hooks

For runtime analysis, `skills/apk-reverse/scripts/frida-run.ps1` provides a unified CLI wrapper around Frida. The script handles device discovery, process enumeration, and hook injection through a single interface.

Key capabilities include:

- **Device enumeration** via the `-ListDevices` flag
- **Process listing** using `frida-ps` equivalent functionality
- **Spawn and attach** modes with `-Spawn` and `-Usb` parameters
- **Script injection** via the `-ScriptPath` argument

The script ultimately executes `frida -U -f com.example.app -l test.js --no-pause` under the hood, abstracting away the complex CLI syntax.

Run dynamic instrumentation with:

```powershell

# PowerShell – list devices, then inject a hook

pwsh -File "skills/apk-reverse/scripts/frida-run.ps1" -ListDevices
pwsh -File "skills/apk-reverse/scripts/frida-run.ps1" -Usb -Spawn -Package com.example.myapp -ScriptPath "C:\hooks\log_ssl.js"

```

## End-to-End Automation Example

The **master router** at `skills/scripts/master-route.ps1` combines static and dynamic phases into a single automated pipeline. It parses natural language hints, selects the appropriate skill, and executes the full workflow according to the case timeline.

Run the complete pipeline with one command:

```powershell

# PowerShell – combines static and dynamic steps

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 `
    -Hint "decompile APK with jadx apktool smali" `
    -CaseName "myapp-demo" `
    -PackageRoot "C:\reverse-skill"

```

This invocation reads the hint, triggers [`decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/decode.sh) for static analysis, then configures `frida-run.ps1` for dynamic instrumentation as defined in the routing configuration.

## Evidence Collection and Reporting

Results from both static decompilation (`jadx_out=…`) and dynamic instrumentation stream to standard output, ready for downstream processing. The pipeline integrates with [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md) to tie technical outputs to forensic evidence collection standards. Output directories follow a predictable structure that supports automated evidence packaging and chain-of-custody documentation.

## Summary

- **Routing Engine**: The [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) file maps APK-related keywords to the `apk-reverse` skill, enabling automatic task detection.
- **Static Pipeline**: [`skills/apk-reverse/scripts/decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/decode.sh) automates resource extraction via Apktool and source recovery via Jadx with a single command.
- **Dynamic Hooks**: `skills/apk-reverse/scripts/frida-run.ps1` abstracts Frida CLI complexity for device management and script injection.
- **Bootstrap System**: `skills/scripts/bootstrap-reverse.ps1` and [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) handle automatic installation of Jadx and Frida.
- **Security Gates**: Pre-execution contracts in `skills/scripts/case-init.ps1` enforce authentication and network profile requirements before running tools.

## Frequently Asked Questions

### How does the reverse-skill router determine which tools to run for APK analysis?

The router inspects the hint string provided to `skills/scripts/master-route.ps1` and matches it against patterns in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). Keywords like "jadx", "apktool", "smali", or "apk" trigger the `apk-reverse` skill, which then executes [`decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/decode.sh) for static analysis or `frida-run.ps1` for dynamic instrumentation based on the specific request parameters.

### Can I run the APK decompilation pipeline on Linux or macOS instead of Windows?

Yes. The repository provides platform-agnostic scripts, including [`skills/apk-reverse/scripts/decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/decode.sh) (Bash) and [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) (Bash). While `frida-run.ps1` is PowerShell-based, PowerShell Core runs on Linux and macOS, or you can use the equivalent Frida CLI commands directly after bootstrapping through the shell scripts.

### What security validations occur before the pipeline executes?

Before any tool runs, `skills/scripts/case-init.ps1` validates the **auth.status** contract to ensure the user has proper authorization, and the **network_profile** contract to verify the environment meets security policies. These gates prevent execution in unauthorized contexts or insecure network configurations.

### How do I add custom Frida scripts to the automated pipeline?

Place your JavaScript hook files in a known directory, then pass the absolute path to the `-ScriptPath` parameter when invoking `skills/apk-reverse/scripts/frida-run.ps1`. The script handles the Frida CLI syntax automatically, executing `frida -U -f <package> -l <script> --no-pause` to inject your hooks into the target application process.