# How to Rebuild, Sign, and Install a Modified APK with reverse-skill

> Rebuild sign and install a modified APK easily using the reverse skill PowerShell script. Automate apktool rebuilds zipalign signatures and ADB installs in one command.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-02

---

**Use the `rebuild-sign-install.ps1` PowerShell script from the reverse-skill repository to automate the complete Android APK pipeline, executing apktool rebuilds, zipalign optimization, apksigner signatures, and ADB installation in a single auditable command.**

The reverse-skill framework provides a dedicated **apk-reverse** skill that orchestrates the entire Android modification workflow through declarative metadata and automation scripts. By abstracting tool discovery, keystore management, and device communication into reproducible PowerShell modules, the repository eliminates manual configuration errors when patching APKs.

## Understanding the apk-reverse Skill Architecture

The skill’s architecture operates through three distinct layers defined in the source tree:

1. **Skill definition** – [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md) (lines 20-28) declares applicability rules, required tools, and the high-level workflow, including authorization checks against [`../field-journal/precedent-reverse.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/../field-journal/precedent-reverse.md).
2. **Tool index** – [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) maintains an auto-generated catalogue of locally-installed binaries (`jadx`, `apktool`, `adb`, `zipalign`, `apksigner`).
3. **Automation scripts** – `skills/apk-reverse/scripts/rebuild-sign-install.ps1` contains the concrete implementation of the rebuild-sign-install chain, including Frida-based dynamic analysis hooks.

Because every step references the skill’s declarative metadata, the same workflow can be invoked from any AI-agent (Claude Code, Codex CLI, Cursor) without hard-coding paths or guessing tool locations.

## The Rebuild-Sign-Install Pipeline

The core workflow implemented in `rebuild-sign-install.ps1` (lines 118-140) follows four deterministic stages:

### Stage 1: Rebuild the Unsigned APK

The script invokes `apktool b` against the project directory, producing an unsigned APK containing your modified smali code and AndroidManifest.xml changes.

### Stage 2: ZIP Alignment

Using `zipalign`, the script optimizes the APK's ZIP structure for runtime memory efficiency, creating an intermediate aligned artifact that satisfies Android’s package manager requirements.

### Stage 3: Signature Generation

The `Ensure-DebugKeystore` function generates a debug keystore on-the-fly if `debug.keystore` is missing, then `apksigner` applies a v1/v2 signature to the aligned package. This eliminates the need to manually create or manage signing certificates during development.

### Stage 4: Device Installation

If the `-Install` switch is present, the script pushes the signed APK via `adb install` (or `adb install -r` when `-Reinstall` is specified). The `Get-ToolPath` function resolves the ADB binary location, defaulting to the first available device unless `-DeviceSerial` explicitly targets a specific emulator or physical device.

## Pre-Execution: Tool Validation and Bootstrap

Before the pipeline executes, the script performs path resolution (lines 35-104) by consulting [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) to locate `apktool`, `zipalign`, `apksigner`, and `adb`. If any binary is missing, the auto-bootstrap routine in `skills/scripts/bootstrap-reverse.ps1` (lines 75-95) triggers automatically, downloading and configuring the required Android SDK components without user intervention.

## Practical Usage Examples

### Decode the Original APK

Before modification, extract the source using the decode helper:

```powershell
pwsh -File "skills/apk-reverse/scripts/decode.ps1" `
    -ApkPath "C:\samples\original.apk" -Clean

```

This populates `apktool_out/` with smali code, resources, and manifests ready for editing.

### Modify Smali or Manifest

Edit files under the `apktool_out/` directory (e.g., `smali/com/example/MainActivity.smali` or [`AndroidManifest.xml`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AndroidManifest.xml)) using your preferred text editor or IDE.

### Execute the Full Pipeline

Run the rebuild-sign-install script to compile, align, sign, and push the modified APK:

```powershell
pwsh -File "skills/apk-reverse/scripts/rebuild-sign-install.ps1" `
    -ProjectDir "C:\samples\apktool_out" `
    -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

```

**Key parameters explained:**

- **`-ProjectDir`** – Path to the directory produced by `apktool d` containing your modifications.
- **`-Install`** – Enables ADB installation after signing.
- **`-Reinstall`** – Uses `adb install -r` to replace an existing package with the same bundle ID.
- **`-DeviceSerial`** – Optional target device identifier; omit to use the first connected device.

### Verify the Signature Manually

To confirm the APK was signed correctly after the build:

```powershell
& "$env:LOCALAPPDATA\Android\Sdk\build-tools\35.0.0\apksigner.bat" `
    verify --print-certs "C:\samples\app-signed.apk"

```

## Traceability and Output Artifacts

According to the task-completion checklist in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md) (lines 104-110), the script produces traceable output by printing the absolute paths to three intermediate files: `unsigned_apk`, `aligned_apk`, and `signed_apk`. Upon successful installation, it also reports the target device serial, creating a complete audit trail for the modification workflow.

## Summary

- **reverse-skill** provides a declarative **apk-reverse** skill that automates APK modification through `skills/apk-reverse/scripts/rebuild-sign-install.ps1`.
- The pipeline executes `apktool b` → `zipalign` → `apksigner` → `adb install` in sequence.
- Missing tools (`apktool`, `adb`, `apksigner`) are auto-bootstrapped via `skills/scripts/bootstrap-reverse.ps1` (lines 75-95).
- The script auto-generates debug keystores using `Ensure-DebugKeystore` and resolves binary paths via `Get-ToolPath`.
- Output paths and device serials are logged to satisfy the skill’s traceability requirements defined in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md).

## Frequently Asked Questions

### What tools does reverse-skill automatically install?

The **auto-bootstrap** routine in `skills/scripts/bootstrap-reverse.ps1` detects and installs `apktool`, `adb`, `zipalign`, and `apksigner` when they are missing from the system PATH. This ensures the rebuild-sign-install pipeline can execute on fresh environments without manual Android SDK configuration.

### Where does the debug keystore come from?

The `Ensure-DebugKeystore` function within `rebuild-sign-install.ps1` generates a standard Android debug keystore on-the-fly if no `debug.keystore` file exists in the expected location. This keystore is compatible with `apksigner` and allows immediate installation on development devices, though you should replace it with a production certificate for release builds.

### Can I use my own signing certificate instead of the debug keystore?

Yes. While the script defaults to auto-generating a debug keystore via `Ensure-DebugKeystore`, you can modify the `$KeystorePath` and `$KeystorePassword` parameters in the script or pass custom arguments to the `apksigner` invocation block (lines 118-140) to use your own JKS or PKCS12 keystore with production credentials.

### How do I verify the APK was signed correctly after rebuilding?

Use the `apksigner verify` command with the `--print-certs` flag to inspect the certificate fingerprints and signature scheme versions. The script outputs the final signed APK path, which you can pass directly to the Android SDK's `apksigner` binary to confirm validity before distribution.