Mobile Reverse Engineering Tools in reverse-skill: Complete Toolchain Guide

The reverse-skill repository uses a CLI-centric toolchain featuring jadx, apktool, frida, adb, radare2, IDA-reverse, and optional JEB Pro for Android APK reverse engineering.

This guide breaks down the specific tools bundled in the apk-reverse skill within zhaoxuya520/reverse-skill, explaining how each utility fits into the static and dynamic analysis workflow. All tool specifications, version numbers, and automation scripts are drawn directly from the source documentation in skills/apk-reverse/SKILL.md.

Core Static Analysis Tools

Static analysis tools decompile APKs without executing code, revealing source structure, resources, and native libraries.

jadx: Java Decompilation

jadx (version 1.5.5) converts DEX bytecode into readable Java source. It enables quick class and method searches and generates project overviews for rapid orientation.

jadx -d jadx_out app.apk

This command dumps all decompiled Java files into the jadx_out directory. According to the source in skills/apk-reverse/SKILL.md (lines 32-35), jadx serves as the primary entry point for understanding application logic.

apktool: APK Unpacking and Smali Editing

apktool (version 3.0.2) decodes resources, extracts AndroidManifest.xml, and produces editable smali bytecode. It supports full rebuild cycles for modified applications.

apktool d app.apk -o apktool_out

The decode operation creates a complete directory structure containing resources, manifest, and smali code. When modifications are complete, the rebuild pipeline proceeds as follows:

apktool b apktool_out -o rebuilt.apk
zipalign -v 4 rebuilt.apk aligned.apk
apksigner sign --ks mykeystore.jks aligned.apk

This sequence re-assembles, aligns, and signs the patched APK for installation.

Dynamic Analysis and Instrumentation

Dynamic tools execute and monitor applications in real-time, enabling runtime behavior inspection and security control bypasses.

frida: Runtime Hooking and Instrumentation

frida (frida-tools 17.9.6) provides comprehensive dynamic instrumentation for Java and native code. It enumerates devices and processes, spawns or attaches to apps, and hooks method calls to bypass root detection or SSL pinning.

Attach and inject a custom hook:

frida -U -f com.example.app -l hook.js

This starts the target app on a USB-connected device (-U) and injects hook.js.

Trace certificate-related method calls:

frida-trace -U -f com.example.app -j '*!*certificate*'

This traces every Java method containing "certificate" in its name—valuable for SSL pinning analysis.

adb: Device Communication Bridge

adb (Android Debug Bridge) handles device listing, APK installation, file transfer, and remote shell execution.

adb devices

Lists all reachable Android devices and emulators via USB or network.

Native Binary Analysis Tools

When APKs contain .so shared libraries, specialized native analysis tools become essential.

radare2: Quick Native Triage

radare2 offers rapid symbol extraction, string analysis, and disassembly for ARM binaries without the overhead of commercial suites.

r2 -A libexample.so

Once loaded, run auto-analysis and disassemble a target symbol:

aaa
pdf @ sym_target

This workflow appears in skills/apk-reverse/SKILL.md lines 126-128 as the recommended first step for native library investigation.

IDA-reverse: Deep Disassembly and Type Recovery

IDA-reverse provides advanced disassembly, decompilation, and type recovery for complex native binaries. It complements radare2 when deeper analysis exceeds open-source capabilities.

JEB Pro: Optional Commercial Validation

JEB Pro enables cross-validation of DEX/APK and ARM binaries, handles heavily obfuscated code, and produces richer decompilation output. Installation requires manual setup with a valid license, as noted in skills/apk-reverse/SKILL.md lines 147-153.

Automation Scripts

The repository includes PowerShell wrappers that orchestrate the complete toolchain, checking tool-index for binary existence and triggering bootstrap installation when needed.

Script	Purpose	Path
decode.ps1	Automated jadx + apktool decoding pipeline	skills/apk-reverse/scripts/decode.ps1
frida-run.ps1	Unified Frida device discovery and script injection	skills/apk-reverse/scripts/frida-run.ps1
rebuild-sign-install.ps1	APK rebuild, zip-align, signing, and optional ADB installation	skills/apk-reverse/scripts/rebuild-sign-install.ps1

Tool Selection Workflow

Choose tools based on analysis phase and target component:

1. Initial reconnaissance — jadx for Java source overview
2. Resource extraction — apktool for manifest and asset inspection
3. Runtime behavior analysis — frida for hooking and tracing
4. Native library investigation — radare2 for triage, IDA-reverse for deep analysis
5. Obfuscation handling — JEB Pro for advanced decompilation

Summary

• jadx 1.5.5 and apktool 3.0.2 handle static Java decompilation and APK unpacking
• frida 17.9.6 enables dynamic instrumentation of Java and native code
• adb provides essential device communication
• radare2 and IDA-reverse analyze .so libraries at different depth levels
• JEB Pro offers commercial-grade validation for obfuscated binaries
• PowerShell scripts in skills/apk-reverse/scripts/ automate the complete workflow

Frequently Asked Questions

What versions of jadx and apktool does reverse-skill specify?

The apk-reverse skill documentation in skills/apk-reverse/SKILL.md specifies jadx version 1.5.5 and apktool version 3.0.2. These versions appear in the tool enumeration section (lines 32-35) and are validated by the repository's bootstrap logic when scripts check tool-index.

Can frida hook both Java methods and native functions?

Yes. According to the source documentation, frida supports dynamic instrumentation for both Java and native code (N-API). The frida-run.ps1 script wraps both capabilities, and example commands demonstrate Java method tracing with -j patterns and native hooking through standard Frida scripts.

How does reverse-skill handle APK signing after modification?

The rebuild-sign-install.ps1 script automates the complete signing pipeline. It invokes apktool to rebuild the APK, zipalign for alignment optimization, and apksigner with a provided keystore. The script optionally installs the result via adb if a device is connected.

Is JEB Pro required to use the reverse-skill mobile toolchain?

No. JEB Pro is entirely optional. The core workflow operates with open-source tools (jadx, apktool, frida, radare2). JEB Pro appears in skills/apk-reverse/SKILL.md lines 147-153 as a cross-validation option for heavily obfuscated code, requiring manual installation and a valid license.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}