Primary Tools for APK Reverse Engineering in reverse-skill: A Complete Toolchain Guide

The reverse-skill repository orchestrates a comprehensive APK reverse engineering toolchain comprising jadx, apktool, frida, adb, apksigner, and zipalign, automated via PowerShell scripts to enable the complete decode-modify-rebuild-sign-install lifecycle.

The zhaoxuya520/reverse-skill project structures Android security analysis through dedicated skill definitions, with APK reverse engineering capabilities centralized in the skills/apk-reverse/ directory. This framework consolidates industry-standard utilities—mapped through skills/scripts/lib/ToolDiscovery.ps1—into reproducible pipelines defined in skills/apk-reverse/SKILL.md.

Static Analysis and Decompilation Tools

JADX for Java Source Recovery

JADX serves as the primary decompiler within the framework, translating Dalvik bytecode (classes.dex) into readable Java and Kotlin source code. The skills/apk-reverse/scripts/decode.ps1 wrapper invokes this tool during the initial static analysis phase, extracting high-level source representations necessary for understanding application logic without execution.

Optional Commercial Analysis with JEB Pro

For scenarios requiring advanced decompilation capabilities, the toolchain optionally supports JEB Pro, a licensed Android and ARM decompiler used for cross-validation of complex obfuscation schemes. While not required for basic operation, this tool provides enhanced disassembly accuracy when available, complementing the open-source analysis workflow.

Resource Extraction and Repackaging Utilities

Apktool for Smali Disassembly

Apktool handles the extraction of application resources, XML manifests, and Smali assembly code, creating a modifiable project structure essential for low-level bytecode manipulation. This utility enables analysts to inspect and alter application logic at the assembly level before repackaging, functioning as the critical bridge between decompiled sources and rebuilt installable packages via decode.ps1 and rebuild-sign-install.ps1.

Apksigner and Zipalign for Package Integrity

After modification, apksigner and zipalign ensure the rebuilt APK meets Android installation requirements. Apksigner cryptographically re-signs the package with debug keystores, while zipalign optimizes the ZIP data alignment for runtime memory efficiency. These tools execute sequentially within the skills/apk-reverse/scripts/rebuild-sign-install.ps1 automation pipeline to produce valid installable artifacts.

Dynamic Analysis and Runtime Instrumentation

Frida for Method Hooking

Frida enables dynamic instrumentation by hooking native and Java methods during application execution, with Python commonly used to author the hook scripts themselves. The skills/apk-reverse/scripts/frida-run.ps1 script automates Frida server deployment, process enumeration via frida-ps, and the injection of custom scripts into target packages identified by their application ID.

ADB for Device Communication

The Android Debug Bridge (ADB) provides the underlying transport layer for file transfer, log capture, and package installation across the entire toolchain. This utility connects the host analysis environment to physical devices or emulators, facilitating the push-pull operations required by both static extraction workflows and dynamic instrumentation sessions orchestrated through the PowerShell wrappers.

Tool Integration and Discovery Architecture

The reverse-skill framework centralizes executable location and validation through skills/scripts/lib/ToolDiscovery.ps1, which maps each utility to the apk-reverse skill as defined in lines 57-30 of the discovery script. This centralized mapping allows the routing matrix (skills/routing.md, line 22) and master skill index (skills/INDEX.md, line 11) to correctly dispatch APK analysis requests to the appropriate automation scripts defined in skills/apk-reverse/SKILL.md.

Practical Workflow Implementation

The following PowerShell commands demonstrate the integrated APK reverse engineering workflow as implemented in the repository scripts:

# Decode APK into Java sources and Smali resources

pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk"

# List connected Android devices for Frida targeting

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices

# Spawn application with Frida hooks attached via USB

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" `
    -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"

# Rebuild modified project, sign, zipalign, and install to device

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" `
    -ProjectDir "C:\work\apktool_out" -Install -DeviceSerial "127.0.0.1:7555"

These commands illustrate the automated pipeline that transitions from static decompilation through dynamic instrumentation to final package deployment.

Summary

• JADX provides Java source decompilation from Dalvik bytecode as the primary static analysis tool within decode.ps1.
• Apktool extracts and repackages Smali code and resources, enabling modification workflows at the assembly level.
• Frida, frida-ps, and Python scripting deliver dynamic runtime instrumentation for method hooking and process enumeration.
• ADB facilitates device communication, file transfer, and log capture across the analysis pipeline.
• Apksigner and zipalign ensure cryptographically valid and optimally aligned package rebuilding in rebuild-sign-install.ps1.
• ToolDiscovery.ps1 (lines 57-30) centralizes tool mapping, while routing.md (line 22) and INDEX.md (line 11) integrate the skill into the broader framework.

Frequently Asked Questions

What is the primary decompiler used for APK reverse engineering in reverse-skill?

JADX serves as the primary decompiler, converting classes.dex files into readable Java source code through the decode.ps1 automation script. This tool handles the initial static analysis phase before any dynamic instrumentation or modification occurs.

How does the framework automate dynamic APK analysis?

The repository utilizes Frida for runtime instrumentation, orchestrated via frida-run.ps1 to hook methods and inject Python-based scripts. This integrates with ADB for device communication and frida-ps for process enumeration, creating a cohesive dynamic analysis pipeline.

Which scripts handle APK rebuilding and installation after modification?

The rebuild-sign-install.ps1 script automates the entire repackaging workflow, invoking apktool for rebuilding, apksigner for debug signing, zipalign for optimization, and ADB for device installation. This ensures modified applications can be rapidly redeployed for testing.

Is JEB Pro required to use the APK reverse engineering features?

No, JEB Pro is listed as an optional commercial tool for advanced decompilation scenarios, but the core APK reverse engineering workflow functions entirely with open-source alternatives like jadx and apktool. The skill definition in SKILL.md supports both configurations without mandatory licensing requirements.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}