APK Reverse Engineering Workflow with reverse-skill: A 6-Stage Guide

The reverse-skill repository provides a command-line driven, six-stage workflow for analyzing Android APKs that orchestrates jadx, apktool, Frida, and adb through reusable PowerShell scripts.

The APK reverse engineering workflow with reverse-skill automates the complex process of decompiling, analyzing, and modifying Android applications. Located in the zhaoxuya520/reverse-skill repository, this skill combines industry-standard tools into a reproducible pipeline defined in skills/apk-reverse/SKILL.md. The workflow enforces strict guardrails to ensure static analysis precedes dynamic modifications, making it ideal for security researchers and reverse engineers.

The Six Stages of APK Reverse Engineering

The workflow defined in skills/apk-reverse/SKILL.md breaks down APK analysis into six logical stages, each targeting specific layers of the Android application stack.

1. Triage and Initial Discovery

The workflow begins with triage to quickly discover the APK's structure, including packages, manifest entries, and native libraries. The scripts/decode.ps1 script orchestrates both jadx and apktool simultaneously, producing a summary of Java files, smali directories, and any .so files present in the lib/ directory.

2. Java Logic Observation

Once decompiled, analysts examine high-level business logic in the jadx output directory (typically jadx_out). This stage focuses on identifying entry-point classes such as MainActivity and Application, along with security-relevant code handling login, encryption, root detection, and certificate pinning.

3. Smali and Resource Review

When Java source is obfuscated or when patches are required, the workflow shifts to apktool output (typically apktool_out). Analysts inspect smali bytecode, AndroidManifest.xml, and resource files like strings.xml. Common modifications include fixing android:exported attributes, removing debug flags, or bypassing root and certificate checks at the bytecode level.

4. Rebuild, Sign, and Install

After modifications, the scripts/rebuild-sign-install.ps1 automates repackaging. The script executes apktool b to rebuild the APK, runs zipalign for optimization, signs the package with a generated keystore using apksigner, and optionally pushes to a device via adb install.

5. Dynamic Hooking with Frida

When static analysis is insufficient, the scripts/frida-run.ps1 script provides runtime instrumentation. It lists Frida-compatible devices and processes, then spawns or attaches to the target application to inject user-supplied JavaScript hooks. Typical use cases include bypassing SSL pinning, root detection, or authentication checks at runtime.

6. Native Library Analysis

If the APK contains critical .so binaries in lib/, the workflow detects these native libraries and redirects analysis to dedicated binary reverse-engineering skills such as radare2 or ida-reverse. This branch handles scenarios where core logic resides in native code rather than Java or smali.

Automating the Workflow with PowerShell Scripts

The reverse-skill repository encapsulates all six stages into reusable PowerShell scripts. Users supply only the APK path and optional flags, eliminating manual command-line orchestration. The [references/apk-security-checklist.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/apk-security-checklist.md) provides an OWASP MASTG-based checklist for security-focused analysis, while [references/frida-bypass-kit.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/frida-bypass-kit.md) contains ready-made Frida scripts for common bypass scenarios.

To decode an APK using both jadx and apktool:

pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\Downloads\myapp.apk" -Clean

To extract package information and permissions from the manifest:

pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "apktool_out\AndroidManifest.xml"

To rebuild, sign, and install a modified APK:

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" `
    -ProjectDir "apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

For dynamic analysis, first enumerate devices and processes:

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses

Then spawn the target app with a custom hook:

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" `
    -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\ssl-bypass.js"

Security Guardrails and Best Practices

The SKILL.md file includes a "禁止事项" (prohibited actions) section that enforces critical guardrails. These rules ensure analysts complete static analysis before attempting dynamic hooking, preventing premature modifications that could corrupt the APK or trigger security mechanisms. The workflow mandates that users verify smali patches in apktool_out before invoking the rebuild scripts, maintaining an auditable and reversible analysis process.

Summary

• The APK reverse engineering workflow with reverse-skill provides a six-stage pipeline from initial triage to native binary analysis.
• decode.ps1 combines jadx and apktool for comprehensive decompilation.
• rebuild-sign-install.ps1 handles the complete repackaging chain: build, align, sign, and install.
• frida-run.ps1 unifies device management, process enumeration, and hook injection.
• The workflow automatically detects native .so libraries and redirects to specialized binary analysis tools.
• Built-in guardrails enforce methodological rigor, requiring static analysis completion before dynamic instrumentation.

Frequently Asked Questions

What tools does the reverse-skill workflow integrate for APK analysis?

The workflow orchestrates jadx for Java decompilation, apktool for smali disassembly and resource extraction, Frida for dynamic instrumentation, and adb for device communication. It also interfaces with apksigner, zipalign, and optionally radare2 or IDA Pro for native library analysis.

How does the workflow handle heavily obfuscated APKs?

When Java source is obfuscated or unavailable, the workflow redirects analysts to the smali and resource review stage using apktool_out contents. Analysts can patch smali bytecode directly to modify application behavior, then use rebuild-sign-install.ps1 to repackage and test changes.

Can I modify an APK and reinstall it without manual command-line steps?

Yes. The scripts/rebuild-sign-install.ps1 script automates the entire modification pipeline. After editing smali or resources in the apktool_out directory, running this script with the -Install flag executes apktool b, signs the APK with a generated keystore, aligns it, and pushes to the connected device via adb.

What is the purpose of the guardrails mentioned in SKILL.md?

The guardrails (documented in the "禁止事项" section of [SKILL.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md)) prevent common workflow errors such as attempting dynamic hooking before completing static analysis or modifying APKs without verifying changes. These rules ensure a methodical approach that preserves evidence and prevents accidental corruption of the target application.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}