Building Automated APK Reverse Engineering Pipelines with Jadx, Apktool, and Frida Hooks

The reverse-skill repository provides a platform-agnostic routing engine that automates APK decompilation using Jadx and Apktool, followed by dynamic instrumentation via Frida hooks, all orchestrated through a unified CLI interface.

Building automated APK reverse engineering pipelines with Jadx, Apktool, and Frida hooks requires a coordinated toolchain that handles static analysis, dynamic instrumentation, and secure execution contexts. The reverse-skill repository implements exactly this workflow through a modular architecture that routes tasks, bootstraps dependencies, and enforces security contracts. This guide walks through the specific scripts and configuration files that enable fully automated Android binary analysis.

Architecture Overview and Routing Layer

The reverse-skill engine operates on a routing-based architecture defined in skills/config/routing.json. This configuration file contains rules that recognize APK-related keywords such as apk, smali, jadx, and apktool, automatically routing requests to the apk-reverse/SKILL.md capability.

Before any operation executes, the router validates auth.status and network_profile contracts through skills/scripts/case-init.ps1. This gating mechanism prevents unauthorized execution and ensures the environment meets security requirements. The tool discovery phase runs skills/scripts/refresh-tool-index.ps1 (and its Bash counterpart) to enumerate supported utilities, marking Jadx and Frida as bootstrap-capable entries when present.

Bootstrapping the Toolchain

When the pipeline detects missing dependencies, it invokes skills/scripts/bootstrap-reverse.ps1 (or the .sh variant for Linux/macOS). The bootstrap manifest at skills/scripts/bootstrap-manifest.json defines installation procedures, specifying Jadx installation from the GitHub release skylot/jadx and Frida installation via pipx.

Run the bootstrap once to prepare your environment:

# PowerShell – install Jadx & Frida if missing

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/bootstrap-reverse.ps1 -Capability @('jadx','frida')

Static Analysis Pipeline with Jadx and Apktool

The static analysis phase extracts resources and generates readable Java/Kotlin source code. The core script skills/apk-reverse/scripts/decode.sh orchestrates this workflow by first ensuring Jadx availability through the ensure_tool "jadx" function, then invoking both Apktool and Jadx.

The script performs three critical operations:

• Resource extraction via Apktool to recover AndroidManifest.xml and asset files
• Smali bytecode generation for low-level analysis
• Java source recovery via Jadx using the -d flag to specify output directories

Execute the static pipeline with:

# Bash – decode an APK (default: run both apktool & jadx)

chmod +x skills/apk-reverse/scripts/decode.sh
./skills/apk-reverse/scripts/decode.sh MyApp.apk --name MyApp --out out_dir

This produces two output directories:

• out_dir/jadx – Decompiled Java/Kotlin source files
• out_dir/apktool – Disassembled Smali code and resources

Dynamic Instrumentation with Frida Hooks

For runtime analysis, skills/apk-reverse/scripts/frida-run.ps1 provides a unified CLI wrapper around Frida. The script handles device discovery, process enumeration, and hook injection through a single interface.

Key capabilities include:

• Device enumeration via the -ListDevices flag
• Process listing using frida-ps equivalent functionality
• Spawn and attach modes with -Spawn and -Usb parameters
• Script injection via the -ScriptPath argument

The script ultimately executes frida -U -f com.example.app -l test.js --no-pause under the hood, abstracting away the complex CLI syntax.

Run dynamic instrumentation with:

# PowerShell – list devices, then inject a hook

pwsh -File "skills/apk-reverse/scripts/frida-run.ps1" -ListDevices
pwsh -File "skills/apk-reverse/scripts/frida-run.ps1" -Usb -Spawn -Package com.example.myapp -ScriptPath "C:\hooks\log_ssl.js"

End-to-End Automation Example

The master router at skills/scripts/master-route.ps1 combines static and dynamic phases into a single automated pipeline. It parses natural language hints, selects the appropriate skill, and executes the full workflow according to the case timeline.

Run the complete pipeline with one command:

# PowerShell – combines static and dynamic steps

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 `
    -Hint "decompile APK with jadx apktool smali" `
    -CaseName "myapp-demo" `
    -PackageRoot "C:\reverse-skill"

This invocation reads the hint, triggers decode.sh for static analysis, then configures frida-run.ps1 for dynamic instrumentation as defined in the routing configuration.

Evidence Collection and Reporting

Results from both static decompilation (jadx_out=…) and dynamic instrumentation stream to standard output, ready for downstream processing. The pipeline integrates with skills/ops/evidence-finding-path.md to tie technical outputs to forensic evidence collection standards. Output directories follow a predictable structure that supports automated evidence packaging and chain-of-custody documentation.

Summary

• Routing Engine: The skills/config/routing.json file maps APK-related keywords to the apk-reverse skill, enabling automatic task detection.
• Static Pipeline: skills/apk-reverse/scripts/decode.sh automates resource extraction via Apktool and source recovery via Jadx with a single command.
• Dynamic Hooks: skills/apk-reverse/scripts/frida-run.ps1 abstracts Frida CLI complexity for device management and script injection.
• Bootstrap System: skills/scripts/bootstrap-reverse.ps1 and bootstrap-manifest.json handle automatic installation of Jadx and Frida.
• Security Gates: Pre-execution contracts in skills/scripts/case-init.ps1 enforce authentication and network profile requirements before running tools.

Frequently Asked Questions

How does the reverse-skill router determine which tools to run for APK analysis?

The router inspects the hint string provided to skills/scripts/master-route.ps1 and matches it against patterns in skills/config/routing.json. Keywords like "jadx", "apktool", "smali", or "apk" trigger the apk-reverse skill, which then executes decode.sh for static analysis or frida-run.ps1 for dynamic instrumentation based on the specific request parameters.

Can I run the APK decompilation pipeline on Linux or macOS instead of Windows?

Yes. The repository provides platform-agnostic scripts, including skills/apk-reverse/scripts/decode.sh (Bash) and skills/scripts/bootstrap-reverse.sh (Bash). While frida-run.ps1 is PowerShell-based, PowerShell Core runs on Linux and macOS, or you can use the equivalent Frida CLI commands directly after bootstrapping through the shell scripts.

What security validations occur before the pipeline executes?

Before any tool runs, skills/scripts/case-init.ps1 validates the auth.status contract to ensure the user has proper authorization, and the network_profile contract to verify the environment meets security policies. These gates prevent execution in unauthorized contexts or insecure network configurations.

How do I add custom Frida scripts to the automated pipeline?

Place your JavaScript hook files in a known directory, then pass the absolute path to the -ScriptPath parameter when invoking skills/apk-reverse/scripts/frida-run.ps1. The script handles the Frida CLI syntax automatically, executing frida -U -f <package> -l <script> --no-pause to inject your hooks into the target application process.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}