# APK Decode, Rebuild, Sign, and Install Scripts in the reverse-skill Repository > Explore the reverse-skill repository's scripts for efficient APK decode, rebuild, sign, and install. Streamline your Android reverse engineering workflow with these automation tools. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: how-to-guide - Published: 2026-08-08 --- **The reverse-skill repository provides two Bash automation scripts—[`decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/decode.sh) and [`rebuild-sign-install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/rebuild-sign-install.sh)—that streamline the complete Android APK reverse-engineering workflow from decompilation to device installation.** The `zhaoxuya520/reverse-skill` project offers a self-contained toolkit for Android security researchers who need to decode, modify, and redeploy APK files. These scripts orchestrate industry-standard tools like **jadx**, **apktool**, and **apksigner** while automatically handling dependency installation through an integrated bootstrap mechanism. ## Overview of the APK Reverse Engineering Pipeline The repository implements a three-stage workflow designed for iterative APK modification. First, [`decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/decode.sh) extracts both high-level Java sources and low-level resources from a target APK. After manual modification of the extracted Smali code or resources, [`rebuild-sign-install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/rebuild-sign-install.sh) handles the reconstruction, cryptographic signing, and device deployment. Both scripts located in `skills/apk-reverse/scripts/` share a common `KALI_BOOTSTRAP` mechanism that invokes [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) to auto-install missing dependencies including **zipalign**, **keytool**, and **adb**. ## decode.sh: Decompiling APKs with JADX and Apktool The [`decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/decode.sh) script performs parallel decompilation to give developers both readable Java sources and editable binary resources. ### Core Functionality Located at [`skills/apk-reverse/scripts/decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/decode.sh), this utility executes two distinct extraction operations. It runs **jadx** to decompile Dalvik bytecode into human-readable Java files, while simultaneously invoking **apktool** to unpack binary XML manifests, assets, native libraries, and Smali assembly code. This dual-output approach allows researchers to analyze application logic in Java while maintaining the ability to patch low-level resources. ### Command-Line Options The script accepts a positional `APK_PATH` argument followed by optional flags: - `--name ` – Specifies a custom task name for output directories - `--out ` – Defines the parent directory for decoded outputs (defaults to current working directory) - `--skip-jadx` – Bypasses Java decompilation if only resources are needed - `--skip-apktool` – Bypasses resource extraction if only Java sources are needed - `--clean` – Removes existing output directories before decoding ### Usage Example ```bash bash skills/apk-reverse/scripts/decode.sh target.apk \ --name malware_analysis \ --out /tmp/workdir \ --clean ``` This command creates `/tmp/workdir/malware_analysis/jadx/` containing Java sources and `/tmp/workdir/malware_analysis/apktool/` containing resources and Smali files. ## rebuild-sign-install.sh: Automating APK Reconstruction The [`rebuild-sign-install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/rebuild-sign-install.sh) script handles the complete repackaging pipeline from modified resources to installed application. ### Build and Alignment Process Located at [`skills/apk-reverse/scripts/rebuild-sign-install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/scripts/rebuild-sign-install.sh), the script first invokes **apktool** to reconstruct the modified project directory into an unsigned APK archive. It then executes **zipalign** with 4-byte alignment optimization to ensure efficient memory mapping on Android devices, a requirement for modern APK distribution. ### Signing Mechanism The script cryptographically signs the aligned APK using **apksigner** with a configurable keystore. If no keystore is specified via `--keystore`, the script automatically generates or utilizes the Android debug keystore located at `~/.android/debug.keystore`. This fallback mechanism ensures the pipeline works immediately without manual certificate generation. ### Installation via ADB When the `--install` flag is present, the script verifies connected devices via **adb** and pushes the signed APK to the specified target. The `--reinstall` flag adds the `-r` parameter to preserve existing application data during updates, while `--device ` targets specific hardware when multiple devices are connected. ### Command-Line Interface Key parameters include: - `PROJECT_DIR` (positional) – Path to the apktool output directory containing modified resources - `--out ` – Destination directory for the final APK - `--name ` – Base filename for the output package - `--keystore ` – Path to custom signing keystore - `--install` – Triggers ADB installation after signing - `--device ` – Specifies target device serial number - `--clean` – Removes intermediate build artifacts ### Usage Example ```bash bash skills/apk-reverse/scripts/rebuild-sign-install.sh \ /tmp/workdir/malware_analysis/apktool \ --out /tmp/output \ --name patched_app \ --install \ --device 0123ABCD ``` This rebuilds the modified resources, signs the package with the default debug key, and installs it on the device with serial `0123ABCD`. ## Tool Bootstrap and Dependency Management Both scripts implement defensive dependency checking through the `KALI_BOOTSTRAP` environment variable. When enabled, the scripts source [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) to automatically install missing binaries including **jadx**, **apktool**, **zipalign**, **apksigner**, **keytool**, and **adb**. This ensures the pipeline functions on fresh Kali Linux installations without manual tool configuration. ## Summary - **[`decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/decode.sh)** extracts APK contents using parallel **jadx** (Java) and **apktool** (resources) operations, supporting selective decoding via `--skip` flags. - **[`rebuild-sign-install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/rebuild-sign-install.sh)** automates the complete build chain: **apktool** reconstruction, **zipalign** optimization, **apksigner** cryptographic signing, and optional **adb** deployment. - Both scripts reside in `skills/apk-reverse/scripts/` and leverage [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) for automatic dependency resolution. - The signing process defaults to Android debug keystores but supports custom certificates via the `--keystore` parameter. - Device-specific installation is supported through `--device ` flags when multiple Android devices are connected. ## Frequently Asked Questions ### What tools do these scripts depend on? The scripts require **jadx** and **apktool** for decompilation, **zipalign** and **apksigner** for packaging, and **adb** for device communication. According to the source code in [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh), these dependencies are automatically installed when the `KALI_BOOTSTRAP` mechanism is activated. ### Can I skip the installation step when rebuilding? Yes. The `--install` flag in [`rebuild-sign-install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/rebuild-sign-install.sh) is optional. Omitting this flag generates the signed APK in the output directory without attempting ADB deployment, allowing for manual distribution or separate testing workflows. ### How does the script handle missing debug keystores? If no keystore is specified via `--keystore`, the script automatically utilizes or creates the standard Android debug keystore at `~/.android/debug.keystore`. This ensures first-time users can sign APKs immediately without manually generating cryptographic certificates. ### Is it possible to decode only with apktool and skip JADX? Yes. The [`decode.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/decode.sh) script accepts the `--skip-jadx` flag, which bypasses Java decompilation and extracts only resources, Smali code, and binary assets via apktool. This accelerates the workflow when source code analysis is unnecessary.