How to Rebuild, Sign, and Install a Modified APK with reverse-skill

Use the rebuild-sign-install.ps1 PowerShell script from the reverse-skill repository to automate the complete Android APK pipeline, executing apktool rebuilds, zipalign optimization, apksigner signatures, and ADB installation in a single auditable command.

The reverse-skill framework provides a dedicated apk-reverse skill that orchestrates the entire Android modification workflow through declarative metadata and automation scripts. By abstracting tool discovery, keystore management, and device communication into reproducible PowerShell modules, the repository eliminates manual configuration errors when patching APKs.

Understanding the apk-reverse Skill Architecture

The skill’s architecture operates through three distinct layers defined in the source tree:

1. Skill definition – skills/apk-reverse/SKILL.md (lines 20-28) declares applicability rules, required tools, and the high-level workflow, including authorization checks against ../field-journal/precedent-reverse.md.
2. Tool index – skills/tool-index.md maintains an auto-generated catalogue of locally-installed binaries (jadx, apktool, adb, zipalign, apksigner).
3. Automation scripts – skills/apk-reverse/scripts/rebuild-sign-install.ps1 contains the concrete implementation of the rebuild-sign-install chain, including Frida-based dynamic analysis hooks.

Because every step references the skill’s declarative metadata, the same workflow can be invoked from any AI-agent (Claude Code, Codex CLI, Cursor) without hard-coding paths or guessing tool locations.

The Rebuild-Sign-Install Pipeline

The core workflow implemented in rebuild-sign-install.ps1 (lines 118-140) follows four deterministic stages:

Stage 1: Rebuild the Unsigned APK

The script invokes apktool b against the project directory, producing an unsigned APK containing your modified smali code and AndroidManifest.xml changes.

Stage 2: ZIP Alignment

Using zipalign, the script optimizes the APK's ZIP structure for runtime memory efficiency, creating an intermediate aligned artifact that satisfies Android’s package manager requirements.

Stage 3: Signature Generation

The Ensure-DebugKeystore function generates a debug keystore on-the-fly if debug.keystore is missing, then apksigner applies a v1/v2 signature to the aligned package. This eliminates the need to manually create or manage signing certificates during development.

Stage 4: Device Installation

If the -Install switch is present, the script pushes the signed APK via adb install (or adb install -r when -Reinstall is specified). The Get-ToolPath function resolves the ADB binary location, defaulting to the first available device unless -DeviceSerial explicitly targets a specific emulator or physical device.

Pre-Execution: Tool Validation and Bootstrap

Before the pipeline executes, the script performs path resolution (lines 35-104) by consulting skills/tool-index.md to locate apktool, zipalign, apksigner, and adb. If any binary is missing, the auto-bootstrap routine in skills/scripts/bootstrap-reverse.ps1 (lines 75-95) triggers automatically, downloading and configuring the required Android SDK components without user intervention.

Practical Usage Examples

Decode the Original APK

Before modification, extract the source using the decode helper:

pwsh -File "skills/apk-reverse/scripts/decode.ps1" `
    -ApkPath "C:\samples\original.apk" -Clean

This populates apktool_out/ with smali code, resources, and manifests ready for editing.

Modify Smali or Manifest

Edit files under the apktool_out/ directory (e.g., smali/com/example/MainActivity.smali or AndroidManifest.xml) using your preferred text editor or IDE.

Execute the Full Pipeline

Run the rebuild-sign-install script to compile, align, sign, and push the modified APK:

pwsh -File "skills/apk-reverse/scripts/rebuild-sign-install.ps1" `
    -ProjectDir "C:\samples\apktool_out" `
    -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Key parameters explained:

• -ProjectDir – Path to the directory produced by apktool d containing your modifications.
• -Install – Enables ADB installation after signing.
• -Reinstall – Uses adb install -r to replace an existing package with the same bundle ID.
• -DeviceSerial – Optional target device identifier; omit to use the first connected device.

Verify the Signature Manually

To confirm the APK was signed correctly after the build:

& "$env:LOCALAPPDATA\Android\Sdk\build-tools\35.0.0\apksigner.bat" `
    verify --print-certs "C:\samples\app-signed.apk"

Traceability and Output Artifacts

According to the task-completion checklist in skills/apk-reverse/SKILL.md (lines 104-110), the script produces traceable output by printing the absolute paths to three intermediate files: unsigned_apk, aligned_apk, and signed_apk. Upon successful installation, it also reports the target device serial, creating a complete audit trail for the modification workflow.

Summary

• reverse-skill provides a declarative apk-reverse skill that automates APK modification through skills/apk-reverse/scripts/rebuild-sign-install.ps1.
• The pipeline executes apktool b → zipalign → apksigner → adb install in sequence.
• Missing tools (apktool, adb, apksigner) are auto-bootstrapped via skills/scripts/bootstrap-reverse.ps1 (lines 75-95).
• The script auto-generates debug keystores using Ensure-DebugKeystore and resolves binary paths via Get-ToolPath.
• Output paths and device serials are logged to satisfy the skill’s traceability requirements defined in SKILL.md.

Frequently Asked Questions

What tools does reverse-skill automatically install?

The auto-bootstrap routine in skills/scripts/bootstrap-reverse.ps1 detects and installs apktool, adb, zipalign, and apksigner when they are missing from the system PATH. This ensures the rebuild-sign-install pipeline can execute on fresh environments without manual Android SDK configuration.

Where does the debug keystore come from?

The Ensure-DebugKeystore function within rebuild-sign-install.ps1 generates a standard Android debug keystore on-the-fly if no debug.keystore file exists in the expected location. This keystore is compatible with apksigner and allows immediate installation on development devices, though you should replace it with a production certificate for release builds.

Can I use my own signing certificate instead of the debug keystore?

Yes. While the script defaults to auto-generating a debug keystore via Ensure-DebugKeystore, you can modify the $KeystorePath and $KeystorePassword parameters in the script or pass custom arguments to the apksigner invocation block (lines 118-140) to use your own JKS or PKCS12 keystore with production credentials.

How do I verify the APK was signed correctly after rebuilding?

Use the apksigner verify command with the --print-certs flag to inspect the certificate fingerprints and signature scheme versions. The script outputs the final signed APK path, which you can pass directly to the Android SDK's apksigner binary to confirm validity before distribution.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}