# Mobile Reverse Engineering Tools in reverse-skill: Complete Toolchain Guide

> Explore the zhaoxuya520/reverse-skill repository for mobile reverse engineering. Discover essential tools like jadx, apktool, frida, adb, radare2, and IDA for Android APK analysis.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: tutorial
- Published: 2026-08-11

---

**The reverse-skill repository uses a CLI-centric toolchain featuring jadx, apktool, frida, adb, radare2, IDA-reverse, and optional JEB Pro for Android APK reverse engineering.**

This guide breaks down the specific tools bundled in the `apk-reverse` skill within zhaoxuya520/reverse-skill, explaining how each utility fits into the static and dynamic analysis workflow. All tool specifications, version numbers, and automation scripts are drawn directly from the source documentation in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md).

## Core Static Analysis Tools

Static analysis tools decompile APKs without executing code, revealing source structure, resources, and native libraries.

### jadx: Java Decompilation

**jadx** (version 1.5.5) converts DEX bytecode into readable Java source. It enables quick class and method searches and generates project overviews for rapid orientation.

```bash
jadx -d jadx_out app.apk

```

This command dumps all decompiled Java files into the `jadx_out` directory. According to the source in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md) (lines 32-35), jadx serves as the primary entry point for understanding application logic.

### apktool: APK Unpacking and Smali Editing

**apktool** (version 3.0.2) decodes resources, extracts [`AndroidManifest.xml`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AndroidManifest.xml), and produces editable smali bytecode. It supports full rebuild cycles for modified applications.

```bash
apktool d app.apk -o apktool_out

```

The decode operation creates a complete directory structure containing resources, manifest, and smali code. When modifications are complete, the rebuild pipeline proceeds as follows:

```bash
apktool b apktool_out -o rebuilt.apk
zipalign -v 4 rebuilt.apk aligned.apk
apksigner sign --ks mykeystore.jks aligned.apk

```

This sequence re-assembles, aligns, and signs the patched APK for installation.

## Dynamic Analysis and Instrumentation

Dynamic tools execute and monitor applications in real-time, enabling runtime behavior inspection and security control bypasses.

### frida: Runtime Hooking and Instrumentation

**frida** (frida-tools 17.9.6) provides comprehensive dynamic instrumentation for Java and native code. It enumerates devices and processes, spawns or attaches to apps, and hooks method calls to bypass root detection or SSL pinning.

**Attach and inject a custom hook:**

```bash
frida -U -f com.example.app -l hook.js

```

This starts the target app on a USB-connected device (`-U`) and injects [`hook.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/hook.js).

**Trace certificate-related method calls:**

```bash
frida-trace -U -f com.example.app -j '*!*certificate*'

```

This traces every Java method containing "certificate" in its name—valuable for SSL pinning analysis.

### adb: Device Communication Bridge

**adb** (Android Debug Bridge) handles device listing, APK installation, file transfer, and remote shell execution.

```bash
adb devices

```

Lists all reachable Android devices and emulators via USB or network.

## Native Binary Analysis Tools

When APKs contain `.so` shared libraries, specialized native analysis tools become essential.

### radare2: Quick Native Triage

**radare2** offers rapid symbol extraction, string analysis, and disassembly for ARM binaries without the overhead of commercial suites.

```bash
r2 -A libexample.so

```

Once loaded, run auto-analysis and disassemble a target symbol:

```

aaa
pdf @ sym_target

```

This workflow appears in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md) lines 126-128 as the recommended first step for native library investigation.

### IDA-reverse: Deep Disassembly and Type Recovery

**IDA-reverse** provides advanced disassembly, decompilation, and type recovery for complex native binaries. It complements radare2 when deeper analysis exceeds open-source capabilities.

### JEB Pro: Optional Commercial Validation

**JEB Pro** enables cross-validation of DEX/APK and ARM binaries, handles heavily obfuscated code, and produces richer decompilation output. Installation requires manual setup with a valid license, as noted in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md) lines 147-153.

## Automation Scripts

The repository includes PowerShell wrappers that orchestrate the complete toolchain, checking `tool-index` for binary existence and triggering bootstrap installation when needed.

| Script | Purpose | Path |
|--------|---------|------|
| `decode.ps1` | Automated jadx + apktool decoding pipeline | `skills/apk-reverse/scripts/decode.ps1` |
| `frida-run.ps1` | Unified Frida device discovery and script injection | `skills/apk-reverse/scripts/frida-run.ps1` |
| `rebuild-sign-install.ps1` | APK rebuild, zip-align, signing, and optional ADB installation | `skills/apk-reverse/scripts/rebuild-sign-install.ps1` |

## Tool Selection Workflow

Choose tools based on analysis phase and target component:

1. **Initial reconnaissance** — jadx for Java source overview
2. **Resource extraction** — apktool for manifest and asset inspection
3. **Runtime behavior analysis** — frida for hooking and tracing
4. **Native library investigation** — radare2 for triage, IDA-reverse for deep analysis
5. **Obfuscation handling** — JEB Pro for advanced decompilation

## Summary

- **jadx 1.5.5** and **apktool 3.0.2** handle static Java decompilation and APK unpacking
- **frida 17.9.6** enables dynamic instrumentation of Java and native code
- **adb** provides essential device communication
- **radare2** and **IDA-reverse** analyze `.so` libraries at different depth levels
- **JEB Pro** offers commercial-grade validation for obfuscated binaries
- PowerShell scripts in `skills/apk-reverse/scripts/` automate the complete workflow

## Frequently Asked Questions

### What versions of jadx and apktool does reverse-skill specify?

The `apk-reverse` skill documentation in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md) specifies **jadx version 1.5.5** and **apktool version 3.0.2**. These versions appear in the tool enumeration section (lines 32-35) and are validated by the repository's bootstrap logic when scripts check `tool-index`.

### Can frida hook both Java methods and native functions?

Yes. According to the source documentation, **frida** supports dynamic instrumentation for **both Java and native code** (N-API). The `frida-run.ps1` script wraps both capabilities, and example commands demonstrate Java method tracing with `-j` patterns and native hooking through standard Frida scripts.

### How does reverse-skill handle APK signing after modification?

The `rebuild-sign-install.ps1` script automates the complete signing pipeline. It invokes **apktool** to rebuild the APK, **zipalign** for alignment optimization, and **apksigner** with a provided keystore. The script optionally installs the result via **adb** if a device is connected.

### Is JEB Pro required to use the reverse-skill mobile toolchain?

No. **JEB Pro** is entirely optional. The core workflow operates with open-source tools (jadx, apktool, frida, radare2). JEB Pro appears in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md) lines 147-153 as a cross-validation option for heavily obfuscated code, requiring manual installation and a valid license.