# Primary Tools for APK Reverse Engineering in reverse-skill: A Complete Toolchain Guide > Master APK reverse engineering with reverse-skill's toolchain. Explore jadx apktool frida adb apksigner and zipalign for decode modify rebuild sign and install. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: how-to-guide - Published: 2026-09-02 --- **The reverse-skill repository orchestrates a comprehensive APK reverse engineering toolchain comprising jadx, apktool, frida, adb, apksigner, and zipalign, automated via PowerShell scripts to enable the complete decode-modify-rebuild-sign-install lifecycle.** The `zhaoxuya520/reverse-skill` project structures Android security analysis through dedicated skill definitions, with **APK reverse engineering** capabilities centralized in the `skills/apk-reverse/` directory. This framework consolidates industry-standard utilities—mapped through `skills/scripts/lib/ToolDiscovery.ps1`—into reproducible pipelines defined in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md). ## Static Analysis and Decompilation Tools ### JADX for Java Source Recovery **JADX** serves as the primary decompiler within the framework, translating Dalvik bytecode (`classes.dex`) into readable Java and Kotlin source code. The `skills/apk-reverse/scripts/decode.ps1` wrapper invokes this tool during the initial static analysis phase, extracting high-level source representations necessary for understanding application logic without execution. ### Optional Commercial Analysis with JEB Pro For scenarios requiring advanced decompilation capabilities, the toolchain optionally supports **JEB Pro**, a licensed Android and ARM decompiler used for cross-validation of complex obfuscation schemes. While not required for basic operation, this tool provides enhanced disassembly accuracy when available, complementing the open-source analysis workflow. ## Resource Extraction and Repackaging Utilities ### Apktool for Smali Disassembly **Apktool** handles the extraction of application resources, XML manifests, and Smali assembly code, creating a modifiable project structure essential for low-level bytecode manipulation. This utility enables analysts to inspect and alter application logic at the assembly level before repackaging, functioning as the critical bridge between decompiled sources and rebuilt installable packages via `decode.ps1` and `rebuild-sign-install.ps1`. ### Apksigner and Zipalign for Package Integrity After modification, **apksigner** and **zipalign** ensure the rebuilt APK meets Android installation requirements. **Apksigner** cryptographically re-signs the package with debug keystores, while **zipalign** optimizes the ZIP data alignment for runtime memory efficiency. These tools execute sequentially within the `skills/apk-reverse/scripts/rebuild-sign-install.ps1` automation pipeline to produce valid installable artifacts. ## Dynamic Analysis and Runtime Instrumentation ### Frida for Method Hooking **Frida** enables dynamic instrumentation by hooking native and Java methods during application execution, with **Python** commonly used to author the hook scripts themselves. The `skills/apk-reverse/scripts/frida-run.ps1` script automates Frida server deployment, process enumeration via **frida-ps**, and the injection of custom scripts into target packages identified by their application ID. ### ADB for Device Communication The **Android Debug Bridge (ADB)** provides the underlying transport layer for file transfer, log capture, and package installation across the entire toolchain. This utility connects the host analysis environment to physical devices or emulators, facilitating the push-pull operations required by both static extraction workflows and dynamic instrumentation sessions orchestrated through the PowerShell wrappers. ## Tool Integration and Discovery Architecture The reverse-skill framework centralizes executable location and validation through `skills/scripts/lib/ToolDiscovery.ps1`, which maps each utility to the **apk-reverse** skill as defined in lines 57-30 of the discovery script. This centralized mapping allows the routing matrix ([`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), line 22) and master skill index ([`skills/INDEX.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/INDEX.md), line 11) to correctly dispatch APK analysis requests to the appropriate automation scripts defined in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md). ## Practical Workflow Implementation The following PowerShell commands demonstrate the integrated **APK reverse engineering** workflow as implemented in the repository scripts: ```powershell # Decode APK into Java sources and Smali resources pwsh -File "\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" ``` ```powershell # List connected Android devices for Frida targeting pwsh -File "\apk-reverse\scripts\frida-run.ps1" -ListDevices ``` ```powershell # Spawn application with Frida hooks attached via USB pwsh -File "\apk-reverse\scripts\frida-run.ps1" ` -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js" ``` ```powershell # Rebuild modified project, sign, zipalign, and install to device pwsh -File "\apk-reverse\scripts\rebuild-sign-install.ps1" ` -ProjectDir "C:\work\apktool_out" -Install -DeviceSerial "127.0.0.1:7555" ``` These commands illustrate the automated pipeline that transitions from static decompilation through dynamic instrumentation to final package deployment. ## Summary - **JADX** provides Java source decompilation from Dalvik bytecode as the primary static analysis tool within `decode.ps1`. - **Apktool** extracts and repackages Smali code and resources, enabling modification workflows at the assembly level. - **Frida**, **frida-ps**, and **Python** scripting deliver dynamic runtime instrumentation for method hooking and process enumeration. - **ADB** facilitates device communication, file transfer, and log capture across the analysis pipeline. - **Apksigner** and **zipalign** ensure cryptographically valid and optimally aligned package rebuilding in `rebuild-sign-install.ps1`. - **ToolDiscovery.ps1** (lines 57-30) centralizes tool mapping, while [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) (line 22) and [`INDEX.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/INDEX.md) (line 11) integrate the skill into the broader framework. ## Frequently Asked Questions ### What is the primary decompiler used for APK reverse engineering in reverse-skill? **JADX** serves as the primary decompiler, converting `classes.dex` files into readable Java source code through the `decode.ps1` automation script. This tool handles the initial static analysis phase before any dynamic instrumentation or modification occurs. ### How does the framework automate dynamic APK analysis? The repository utilizes **Frida** for runtime instrumentation, orchestrated via `frida-run.ps1` to hook methods and inject **Python**-based scripts. This integrates with **ADB** for device communication and **frida-ps** for process enumeration, creating a cohesive dynamic analysis pipeline. ### Which scripts handle APK rebuilding and installation after modification? The `rebuild-sign-install.ps1` script automates the entire repackaging workflow, invoking **apktool** for rebuilding, **apksigner** for debug signing, **zipalign** for optimization, and **ADB** for device installation. This ensures modified applications can be rapidly redeployed for testing. ### Is JEB Pro required to use the APK reverse engineering features? No, **JEB Pro** is listed as an optional commercial tool for advanced decompilation scenarios, but the core **APK reverse engineering** workflow functions entirely with open-source alternatives like **jadx** and **apktool**. The skill definition in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) supports both configurations without mandatory licensing requirements.