# Key Scripts for APK Reverse Engineering in reverse-skill: A Complete Guide

> Master APK reverse engineering with reverse-skill's key scripts. Automate decompilation, rebuilding, and dynamic instrumentation for a complete workflow.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-25

---

**The reverse-skill repository provides three core Bash scripts—[`decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/decode.sh), [`rebuild-sign-install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/rebuild-sign-install.sh), and [`frida-run.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/frida-run.sh)—that automate the complete APK reverse engineering workflow from decompilation to dynamic instrumentation.**

The `reverse-skill` toolkit offers a self-contained, portable solution for Android APK analysis. Located in `skills/apk-reverse/scripts/`, these scripts handle **static analysis**, **modification**, and **runtime instrumentation** without requiring manual tool configuration. Each script auto-detects dependencies and integrates with the repository's Kali bootstrap helper for one-command setup.

## decode.sh: Decompiling APKs with jadx and apktool

The first step in any APK reverse engineering workflow is extracting readable code and resources. In [`skills/apk-reverse/scripts/decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/decode.sh), this is implemented as a unified wrapper around **jadx** (for Java decompilation) and **apktool** (for Smali/resource extraction).

The script accepts an APK file and generates a task root directory with three components:

- `jadx/` — Human-readable Java source files (`.java`)
- `apktool/` — Smali bytecode, [`AndroidManifest.xml`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AndroidManifest.xml), and resource files
- Logs and metadata for quick analysis

The script also outputs statistics including package name, Java file count, Smali directory count, and native library (`.so`) detection. This helps analysts immediately assess app complexity.

```bash

# Decompile example.apk into ./out/myapp/

bash skills/apk-reverse/scripts/decode.sh example.apk --name myapp --out ./out

```

After execution, `./out/myapp/` contains the complete source tree for static analysis or modification.

## rebuild-sign-install.sh: Rebuilding and Deploying Modified APKs

Once you've edited Smali code, injected patches, or modified resources, [`skills/apk-reverse/scripts/rebuild-sign-install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/rebuild-sign-install.sh) handles the **rebuild → zip-align → sign → install** pipeline.

The script executes this sequence:

1. `apktool b` — Rebuilds the modified project into an unsigned APK
2. `zipalign` — Optimizes the zip structure for runtime performance
3. `apksigner` — Signs with a debug keystore (auto-generated if missing)
4. `adb install` — Optionally pushes to a connected device

```bash

# Rebuild from modified apktool directory and install

bash skills/apk-reverse/scripts/rebuild-sign-install.sh \
    ./out/myapp/apktool \
    --out ./out \
    --name myapp \
    --install \
    --device <serial>

```

Output is a production-ready `myapp-signed.apk`. The `--install` flag triggers `adb install -r` for reinstall scenarios during iterative testing.

## frida-run.sh: Dynamic Runtime Instrumentation

For runtime analysis, [`skills/apk-reverse/scripts/frida-run.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/frida-run.sh) provides a Frida wrapper that abstracts device management and script injection. According to the reverse-skill source code, this script:

- Detects and selects target devices via `adb devices`
- Launches the target application with Frida attached
- Loads user-supplied JavaScript instrumentation payloads
- Supports automatic Frida tool installation via [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh)

```bash

# Attach hook.js to running application

bash skills/apk-reverse/scripts/frida-run.sh \
    --app com.example.myapp \
    --script ./hooks/hook.js \
    --device <serial>

```

This enables memory dumping, SSL pinning bypass, method hooking, and other dynamic analysis techniques without modifying the APK itself.

## Dependency Management and Bootstrap Integration

All three scripts integrate with [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) for automatic tool installation. The scripts detect missing binaries (`apktool`, `jadx`, `apksigner`, `adb`, `frida`) and prompt installation via the bootstrap helper.

This architecture makes reverse-skill immediately usable on fresh Kali Linux environments with a single command:

```bash

# Install all dependencies

bash kali/scripts/bootstrap-reverse.sh

# Begin APK analysis

bash skills/apk-reverse/scripts/decode.sh target.apk

```

## Supporting Reference Files

The repository includes complementary documentation for advanced usage:

| File | Purpose |
|------|---------|
| [`skills/apk-reverse/references/apk-security-checklist.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/apk-security-checklist.md) | Security assessment checklist for pre/post-modification review |
| [`skills/apk-reverse/references/frida-cookbook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/frida-cookbook.md) | Common Frida scripts and Android-specific patterns |

## Summary

- **[`decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/decode.sh)** — Decompiles APKs with jadx and apktool, producing the foundation for static analysis
- **[`rebuild-sign-install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/rebuild-sign-install.sh)** — Rebuilds, aligns, signs, and deploys modified APKs in one command
- **[`frida-run.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/frida-run.sh)** — Wraps Frida for dynamic runtime instrumentation without APK modification
- **Bootstrap integration** — All scripts auto-detect and install missing dependencies via [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh)

These three scripts implement the complete APK reverse engineering lifecycle as maintained in the zhaoxuya520/reverse-skill repository.

## Frequently Asked Questions

### What tools does reverse-skill require for APK analysis?

The toolkit requires **jadx**, **apktool**, **Android SDK build tools** (for `zipalign` and `apksigner`), **adb**, and **Frida**. The [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) script automatically installs these on Kali Linux if missing.

### Can I use these scripts on operating systems other than Kali Linux?

Yes. While [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) targets Kali package managers, the scripts themselves are standard Bash. Manually install the required tools on macOS, Ubuntu, or other distributions, and the scripts function identically.

### How does frida-run.sh handle multiple connected devices?

The script accepts a `--device` parameter for explicit serial number selection. When omitted, it prompts for device selection from `adb devices` output. The implementation includes automatic Frida server management and clean disconnection.

### Is the debug keystore generated by rebuild-sign-install.sh suitable for production?

No. The auto-generated debug keystore enables rapid testing only. For distribution, replace with a proper release keystore using the script's keystore configuration options or sign separately after rebuild.