Key Scripts for APK Reverse Engineering in reverse-skill: A Complete Guide

The reverse-skill repository provides three core Bash scripts—decode.sh, rebuild-sign-install.sh, and frida-run.sh—that automate the complete APK reverse engineering workflow from decompilation to dynamic instrumentation.

The reverse-skill toolkit offers a self-contained, portable solution for Android APK analysis. Located in skills/apk-reverse/scripts/, these scripts handle static analysis, modification, and runtime instrumentation without requiring manual tool configuration. Each script auto-detects dependencies and integrates with the repository's Kali bootstrap helper for one-command setup.

decode.sh: Decompiling APKs with jadx and apktool

The first step in any APK reverse engineering workflow is extracting readable code and resources. In skills/apk-reverse/scripts/decode.sh, this is implemented as a unified wrapper around jadx (for Java decompilation) and apktool (for Smali/resource extraction).

The script accepts an APK file and generates a task root directory with three components:

• jadx/ — Human-readable Java source files (.java)
• apktool/ — Smali bytecode, AndroidManifest.xml, and resource files
• Logs and metadata for quick analysis

The script also outputs statistics including package name, Java file count, Smali directory count, and native library (.so) detection. This helps analysts immediately assess app complexity.

# Decompile example.apk into ./out/myapp/

bash skills/apk-reverse/scripts/decode.sh example.apk --name myapp --out ./out

After execution, ./out/myapp/ contains the complete source tree for static analysis or modification.

rebuild-sign-install.sh: Rebuilding and Deploying Modified APKs

Once you've edited Smali code, injected patches, or modified resources, skills/apk-reverse/scripts/rebuild-sign-install.sh handles the rebuild → zip-align → sign → install pipeline.

The script executes this sequence:

1. apktool b — Rebuilds the modified project into an unsigned APK
2. zipalign — Optimizes the zip structure for runtime performance
3. apksigner — Signs with a debug keystore (auto-generated if missing)
4. adb install — Optionally pushes to a connected device

# Rebuild from modified apktool directory and install

bash skills/apk-reverse/scripts/rebuild-sign-install.sh \
    ./out/myapp/apktool \
    --out ./out \
    --name myapp \
    --install \
    --device <serial>

Output is a production-ready myapp-signed.apk. The --install flag triggers adb install -r for reinstall scenarios during iterative testing.

frida-run.sh: Dynamic Runtime Instrumentation

For runtime analysis, skills/apk-reverse/scripts/frida-run.sh provides a Frida wrapper that abstracts device management and script injection. According to the reverse-skill source code, this script:

• Detects and selects target devices via adb devices
• Launches the target application with Frida attached
• Loads user-supplied JavaScript instrumentation payloads
• Supports automatic Frida tool installation via bootstrap-reverse.sh

# Attach hook.js to running application

bash skills/apk-reverse/scripts/frida-run.sh \
    --app com.example.myapp \
    --script ./hooks/hook.js \
    --device <serial>

This enables memory dumping, SSL pinning bypass, method hooking, and other dynamic analysis techniques without modifying the APK itself.

Dependency Management and Bootstrap Integration

All three scripts integrate with kali/scripts/bootstrap-reverse.sh for automatic tool installation. The scripts detect missing binaries (apktool, jadx, apksigner, adb, frida) and prompt installation via the bootstrap helper.

This architecture makes reverse-skill immediately usable on fresh Kali Linux environments with a single command:

# Install all dependencies

bash kali/scripts/bootstrap-reverse.sh

# Begin APK analysis

bash skills/apk-reverse/scripts/decode.sh target.apk

Supporting Reference Files

The repository includes complementary documentation for advanced usage:

File	Purpose
skills/apk-reverse/references/apk-security-checklist.md	Security assessment checklist for pre/post-modification review
skills/apk-reverse/references/frida-cookbook.md	Common Frida scripts and Android-specific patterns

Summary

• decode.sh — Decompiles APKs with jadx and apktool, producing the foundation for static analysis
• rebuild-sign-install.sh — Rebuilds, aligns, signs, and deploys modified APKs in one command
• frida-run.sh — Wraps Frida for dynamic runtime instrumentation without APK modification
• Bootstrap integration — All scripts auto-detect and install missing dependencies via kali/scripts/bootstrap-reverse.sh

These three scripts implement the complete APK reverse engineering lifecycle as maintained in the zhaoxuya520/reverse-skill repository.

Frequently Asked Questions

What tools does reverse-skill require for APK analysis?

The toolkit requires jadx, apktool, Android SDK build tools (for zipalign and apksigner), adb, and Frida. The bootstrap-reverse.sh script automatically installs these on Kali Linux if missing.

Can I use these scripts on operating systems other than Kali Linux?

Yes. While bootstrap-reverse.sh targets Kali package managers, the scripts themselves are standard Bash. Manually install the required tools on macOS, Ubuntu, or other distributions, and the scripts function identically.

How does frida-run.sh handle multiple connected devices?

The script accepts a --device parameter for explicit serial number selection. When omitted, it prompts for device selection from adb devices output. The implementation includes automatic Frida server management and clean disconnection.

Is the debug keystore generated by rebuild-sign-install.sh suitable for production?

No. The auto-generated debug keystore enables rapid testing only. For distribution, replace with a proper release keystore using the script's keystore configuration options or sign separately after rebuild.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}