# APK Reverse Engineering Workflow with reverse-skill: A 6-Stage Guide

> Master APK reverse engineering with our 6-stage workflow guide using reverse-skill. Orchestrate jadx, apktool, Frida, and adb for efficient Android analysis. Learn the process now.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-06

---

**The reverse-skill repository provides a command-line driven, six-stage workflow for analyzing Android APKs that orchestrates jadx, apktool, Frida, and adb through reusable PowerShell scripts.**

The APK reverse engineering workflow with reverse-skill automates the complex process of decompiling, analyzing, and modifying Android applications. Located in the `zhaoxuya520/reverse-skill` repository, this skill combines industry-standard tools into a reproducible pipeline defined in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md). The workflow enforces strict guardrails to ensure static analysis precedes dynamic modifications, making it ideal for security researchers and reverse engineers.

## The Six Stages of APK Reverse Engineering

The workflow defined in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md) breaks down APK analysis into six logical stages, each targeting specific layers of the Android application stack.

### 1. Triage and Initial Discovery

The workflow begins with **triage** to quickly discover the APK's structure, including packages, manifest entries, and native libraries. The **[`scripts/decode.ps1`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/decode.ps1)** script orchestrates both **jadx** and **apktool** simultaneously, producing a summary of Java files, smali directories, and any `.so` files present in the `lib/` directory.

### 2. Java Logic Observation

Once decompiled, analysts examine high-level business logic in the **jadx** output directory (typically `jadx_out`). This stage focuses on identifying entry-point classes such as `MainActivity` and `Application`, along with security-relevant code handling login, encryption, root detection, and certificate pinning.

### 3. Smali and Resource Review

When Java source is obfuscated or when patches are required, the workflow shifts to **apktool** output (typically `apktool_out`). Analysts inspect **smali** bytecode, [`AndroidManifest.xml`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AndroidManifest.xml), and resource files like [`strings.xml`](https://github.com/zhaoxuya520/reverse-skill/blob/main/strings.xml). Common modifications include fixing `android:exported` attributes, removing debug flags, or bypassing root and certificate checks at the bytecode level.

### 4. Rebuild, Sign, and Install

After modifications, the **[`scripts/rebuild-sign-install.ps1`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/rebuild-sign-install.ps1)** automates repackaging. The script executes `apktool b` to rebuild the APK, runs **zipalign** for optimization, signs the package with a generated keystore using **apksigner**, and optionally pushes to a device via **adb install**.

### 5. Dynamic Hooking with Frida

When static analysis is insufficient, the **[`scripts/frida-run.ps1`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/frida-run.ps1)** script provides runtime instrumentation. It lists Frida-compatible devices and processes, then spawns or attaches to the target application to inject user-supplied JavaScript hooks. Typical use cases include bypassing SSL pinning, root detection, or authentication checks at runtime.

### 6. Native Library Analysis

If the APK contains critical `.so` binaries in `lib/`, the workflow detects these native libraries and redirects analysis to dedicated binary reverse-engineering skills such as **radare2** or **ida-reverse**. This branch handles scenarios where core logic resides in native code rather than Java or smali.

## Automating the Workflow with PowerShell Scripts

The reverse-skill repository encapsulates all six stages into reusable PowerShell scripts. Users supply only the APK path and optional flags, eliminating manual command-line orchestration. The **[[`references/apk-security-checklist.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/apk-security-checklist.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/apk-security-checklist.md)** provides an OWASP MASTG-based checklist for security-focused analysis, while **[[`references/frida-bypass-kit.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/frida-bypass-kit.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/frida-bypass-kit.md)** contains ready-made Frida scripts for common bypass scenarios.

To decode an APK using both jadx and apktool:

```powershell
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\Downloads\myapp.apk" -Clean

```

To extract package information and permissions from the manifest:

```powershell
pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "apktool_out\AndroidManifest.xml"

```

To rebuild, sign, and install a modified APK:

```powershell
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" `
    -ProjectDir "apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

```

For dynamic analysis, first enumerate devices and processes:

```powershell
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses

```

Then spawn the target app with a custom hook:

```powershell
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" `
    -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\ssl-bypass.js"

```

## Security Guardrails and Best Practices

The [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file includes a **"禁止事项"** (prohibited actions) section that enforces critical guardrails. These rules ensure analysts complete static analysis before attempting dynamic hooking, preventing premature modifications that could corrupt the APK or trigger security mechanisms. The workflow mandates that users verify smali patches in `apktool_out` before invoking the rebuild scripts, maintaining an auditable and reversible analysis process.

## Summary

- The **APK reverse engineering workflow with reverse-skill** provides a six-stage pipeline from initial triage to native binary analysis.
- **[`decode.ps1`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/decode.ps1)** combines jadx and apktool for comprehensive decompilation.
- **[`rebuild-sign-install.ps1`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/rebuild-sign-install.ps1)** handles the complete repackaging chain: build, align, sign, and install.
- **[`frida-run.ps1`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/frida-run.ps1)** unifies device management, process enumeration, and hook injection.
- The workflow automatically detects native `.so` libraries and redirects to specialized binary analysis tools.
- Built-in guardrails enforce methodological rigor, requiring static analysis completion before dynamic instrumentation.

## Frequently Asked Questions

### What tools does the reverse-skill workflow integrate for APK analysis?

The workflow orchestrates **jadx** for Java decompilation, **apktool** for smali disassembly and resource extraction, **Frida** for dynamic instrumentation, and **adb** for device communication. It also interfaces with **apksigner**, **zipalign**, and optionally **radare2** or IDA Pro for native library analysis.

### How does the workflow handle heavily obfuscated APKs?

When Java source is obfuscated or unavailable, the workflow redirects analysts to the **smali and resource review** stage using `apktool_out` contents. Analysts can patch smali bytecode directly to modify application behavior, then use **[`rebuild-sign-install.ps1`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/rebuild-sign-install.ps1)** to repackage and test changes.

### Can I modify an APK and reinstall it without manual command-line steps?

Yes. The **[`scripts/rebuild-sign-install.ps1`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/rebuild-sign-install.ps1)** script automates the entire modification pipeline. After editing smali or resources in the `apktool_out` directory, running this script with the `-Install` flag executes `apktool b`, signs the APK with a generated keystore, aligns it, and pushes to the connected device via adb.

### What is the purpose of the guardrails mentioned in SKILL.md?

The guardrails (documented in the **"禁止事项"** section of **[[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md)**) prevent common workflow errors such as attempting dynamic hooking before completing static analysis or modifying APKs without verifying changes. These rules ensure a methodical approach that preserves evidence and prevents accidental corruption of the target application.