Documented Path for APK Reverse Engineering in Reverse-Skill: CLI Workflow and Automation Scripts

The documented path for APK reverse engineering in reverse-skill is located at skills/apk-reverse/SKILL.md, which defines a complete CLI-based workflow using jadx, apktool, and Frida alongside PowerShell automation scripts for decompilation, modification, and dynamic analysis.

The zhaoxuya520/reverse-skill repository provides a structured approach to Android APK analysis through its skill-based documentation system. The documented path for APK reverse engineering serves as the authoritative reference for security researchers and developers performing static and dynamic analysis on Android applications.

Core Documentation at skills/apk-reverse/SKILL.md

The primary specification resides in skills/apk-reverse/SKILL.md within the repository root. This markdown file establishes the complete job specification, including required tooling, directory structures, and execution workflows for Java decompilation, smali editing, APK rebuilding, and dynamic instrumentation.

According to the source code, the skill definition requires four core components working in concert: decompilation tools for static analysis, disassembly utilities for bytecode manipulation, signing frameworks for repackaging, and dynamic instrumentation engines for runtime inspection.

Required Tools and Environment Setup

Before executing the documented workflow, the following tools must be available in your system PATH:

• jadx: For Java source code decompilation from DEX bytecode
• apktool: For APK disassembly, resource extraction, and smali bytecode access
• Frida: For dynamic instrumentation and runtime method hooking
• Android SDK build tools: Specifically zipalign and apksigner for APK optimization and signing
• PowerShell: For executing the automation scripts on Windows environments

Step-by-Step APK Reverse Engineering Workflow

The SKILL.md documentation prescribes a four-phase methodology for comprehensive APK analysis.

Decompiling Java Source with jadx

Static analysis begins with extracting readable Java source code from the APK's DEX files. The documented command uses jadx to produce a structured output directory:

jadx -d jadx_out myapp.apk

This generates human-readable Java source files in the jadx_out directory, enabling analysis of application logic, API endpoints, and hardcoded secrets without manual bytecode interpretation.

Unpacking APK Resources with apktool

For applications requiring modification, apktool disassembles the APK into smali bytecode and extracted resources. The documented path specifies:

apktool d myapp.apk -o apktool_out

The apktool_out directory contains the AndroidManifest.xml, resource files, and smali directories necessary for bytecode-level patching and injection.

Rebuilding and Signing Modified APKs

After modifying smali code or resources, the APK must be rebuilt, aligned, signed, and optionally installed to a device. The repository provides skills/apk-reverse/scripts/rebuild-sign-install.ps1 to automate this pipeline:

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" `
    -ProjectDir "apktool_out" -Install -DeviceSerial "127.0.0.1:7555"

This script sequentially executes apktool b for rebuilding, zipalign for optimization, apksigner for v1/v2 signing, and adb install for deployment when the -Install flag is specified.

Dynamic Analysis with Frida Hooks

For runtime behavior inspection, the documented path integrates Frida for method interception and variable manipulation. The skills/apk-reverse/scripts/frida-run.ps1 wrapper handles device connection, process spawning, and script injection:

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" `
    -Usb -Spawn -Package com.example.app -ScriptPath "hook.js"

The -Usb flag targets USB-connected devices, while -Spawn ensures the script attaches during application initialization for complete lifecycle coverage.

Automation Scripts in the Reverse-Skill Repository

The skills/apk-reverse/scripts/ directory contains four specialized PowerShell modules that encapsulate complex multi-tool operations:

decode.ps1: Runs jadx and apktool in sequence, generating both Java sources and smali disassembly while producing execution summaries for documentation purposes.

frida-run.ps1: Wraps Frida CLI interactions, managing device selection, process attachment, and script loading with proper error handling for USB and remote connections.

rebuild-sign-install.ps1: Implements the complete modification-to-deployment pipeline, handling keystore generation, APK alignment optimization, and automated device installation.

manifest-summary.ps1: Parses AndroidManifest.xml extracted by apktool to extract package identifiers, permission declarations, and component definitions:

pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" `
    -ManifestPath "apktool_out\AndroidManifest.xml"

Summary

• The documented path for APK reverse engineering in reverse-skill is defined in skills/apk-reverse/SKILL.md, which serves as the canonical reference for the workflow.
• The methodology combines jadx for static decompilation, apktool for bytecode-level modification, and Frida for dynamic runtime analysis.
• Four PowerShell automation scripts in skills/apk-reverse/scripts/ streamline complex operations: decode.ps1, frida-run.ps1, rebuild-sign-install.ps1, and manifest-summary.ps1.
• The workflow supports complete APK lifecycle analysis from initial decompilation through modified repackaging and installation.

Frequently Asked Questions

Where is the main documentation for APK reverse engineering located in the reverse-skill repository?

The primary documentation resides at skills/apk-reverse/SKILL.md in the repository root. This file contains the complete CLI specification, required dependencies, and step-by-step workflows for analyzing Android APKs using jadx, apktool, and Frida.

What tools are required to execute the APK reverse engineering workflow documented in reverse-skill?

The documented path requires jadx for Java decompilation, apktool for APK disassembly and rebuilding, Frida for dynamic instrumentation, and Android SDK build tools including zipalign and apksigner for APK signing. PowerShell is required to run the provided automation scripts.

How does the reverse-skill repository automate the APK rebuilding and installation process?

The skills/apk-reverse/scripts/rebuild-sign-install.ps1 script automates the entire post-modification pipeline. It executes apktool to rebuild the APK, zipalign for 4-byte alignment optimization, apksigner for cryptographic signing, and optionally adb install for device deployment using the -Install parameter.

Can the reverse-skill APK workflow extract manifest information without full decompilation?

Yes. The skills/apk-reverse/scripts/manifest-summary.ps1 script specifically parses the AndroidManifest.xml file extracted by apktool to report package names, declared permissions, and application components without requiring Java decompilation or source analysis.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}