APK Decode, Rebuild, Sign, and Install Scripts in the reverse-skill Repository

The reverse-skill repository provides two Bash automation scripts—decode.sh and rebuild-sign-install.sh—that streamline the complete Android APK reverse-engineering workflow from decompilation to device installation.

The zhaoxuya520/reverse-skill project offers a self-contained toolkit for Android security researchers who need to decode, modify, and redeploy APK files. These scripts orchestrate industry-standard tools like jadx, apktool, and apksigner while automatically handling dependency installation through an integrated bootstrap mechanism.

Overview of the APK Reverse Engineering Pipeline

The repository implements a three-stage workflow designed for iterative APK modification. First, decode.sh extracts both high-level Java sources and low-level resources from a target APK. After manual modification of the extracted Smali code or resources, rebuild-sign-install.sh handles the reconstruction, cryptographic signing, and device deployment. Both scripts located in skills/apk-reverse/scripts/ share a common KALI_BOOTSTRAP mechanism that invokes kali/scripts/bootstrap-reverse.sh to auto-install missing dependencies including zipalign, keytool, and adb.

decode.sh: Decompiling APKs with JADX and Apktool

The decode.sh script performs parallel decompilation to give developers both readable Java sources and editable binary resources.

Core Functionality

Located at skills/apk-reverse/scripts/decode.sh, this utility executes two distinct extraction operations. It runs jadx to decompile Dalvik bytecode into human-readable Java files, while simultaneously invoking apktool to unpack binary XML manifests, assets, native libraries, and Smali assembly code. This dual-output approach allows researchers to analyze application logic in Java while maintaining the ability to patch low-level resources.

Command-Line Options

The script accepts a positional APK_PATH argument followed by optional flags:

• --name <task> – Specifies a custom task name for output directories
• --out <dir> – Defines the parent directory for decoded outputs (defaults to current working directory)
• --skip-jadx – Bypasses Java decompilation if only resources are needed
• --skip-apktool – Bypasses resource extraction if only Java sources are needed
• --clean – Removes existing output directories before decoding

Usage Example

bash skills/apk-reverse/scripts/decode.sh target.apk \
    --name malware_analysis \
    --out /tmp/workdir \
    --clean

This command creates /tmp/workdir/malware_analysis/jadx/ containing Java sources and /tmp/workdir/malware_analysis/apktool/ containing resources and Smali files.

rebuild-sign-install.sh: Automating APK Reconstruction

The rebuild-sign-install.sh script handles the complete repackaging pipeline from modified resources to installed application.

Build and Alignment Process

Located at skills/apk-reverse/scripts/rebuild-sign-install.sh, the script first invokes apktool to reconstruct the modified project directory into an unsigned APK archive. It then executes zipalign with 4-byte alignment optimization to ensure efficient memory mapping on Android devices, a requirement for modern APK distribution.

Signing Mechanism

The script cryptographically signs the aligned APK using apksigner with a configurable keystore. If no keystore is specified via --keystore, the script automatically generates or utilizes the Android debug keystore located at ~/.android/debug.keystore. This fallback mechanism ensures the pipeline works immediately without manual certificate generation.

Installation via ADB

When the --install flag is present, the script verifies connected devices via adb and pushes the signed APK to the specified target. The --reinstall flag adds the -r parameter to preserve existing application data during updates, while --device <serial> targets specific hardware when multiple devices are connected.

Command-Line Interface

Key parameters include:

• PROJECT_DIR (positional) – Path to the apktool output directory containing modified resources
• --out <dir> – Destination directory for the final APK
• --name <base> – Base filename for the output package
• --keystore <path> – Path to custom signing keystore
• --install – Triggers ADB installation after signing
• --device <serial> – Specifies target device serial number
• --clean – Removes intermediate build artifacts

Usage Example

bash skills/apk-reverse/scripts/rebuild-sign-install.sh \
    /tmp/workdir/malware_analysis/apktool \
    --out /tmp/output \
    --name patched_app \
    --install \
    --device 0123ABCD

This rebuilds the modified resources, signs the package with the default debug key, and installs it on the device with serial 0123ABCD.

Tool Bootstrap and Dependency Management

Both scripts implement defensive dependency checking through the KALI_BOOTSTRAP environment variable. When enabled, the scripts source kali/scripts/bootstrap-reverse.sh to automatically install missing binaries including jadx, apktool, zipalign, apksigner, keytool, and adb. This ensures the pipeline functions on fresh Kali Linux installations without manual tool configuration.

Summary

• decode.sh extracts APK contents using parallel jadx (Java) and apktool (resources) operations, supporting selective decoding via --skip flags.
• rebuild-sign-install.sh automates the complete build chain: apktool reconstruction, zipalign optimization, apksigner cryptographic signing, and optional adb deployment.
• Both scripts reside in skills/apk-reverse/scripts/ and leverage kali/scripts/bootstrap-reverse.sh for automatic dependency resolution.
• The signing process defaults to Android debug keystores but supports custom certificates via the --keystore parameter.
• Device-specific installation is supported through --device <serial> flags when multiple Android devices are connected.

Frequently Asked Questions

What tools do these scripts depend on?

The scripts require jadx and apktool for decompilation, zipalign and apksigner for packaging, and adb for device communication. According to the source code in kali/scripts/bootstrap-reverse.sh, these dependencies are automatically installed when the KALI_BOOTSTRAP mechanism is activated.

Can I skip the installation step when rebuilding?

Yes. The --install flag in rebuild-sign-install.sh is optional. Omitting this flag generates the signed APK in the output directory without attempting ADB deployment, allowing for manual distribution or separate testing workflows.

How does the script handle missing debug keystores?

If no keystore is specified via --keystore, the script automatically utilizes or creates the standard Android debug keystore at ~/.android/debug.keystore. This ensures first-time users can sign APKs immediately without manually generating cryptographic certificates.

Is it possible to decode only with apktool and skip JADX?

Yes. The decode.sh script accepts the --skip-jadx flag, which bypasses Java decompilation and extracts only resources, Smali code, and binary assets via apktool. This accelerates the workflow when source code analysis is unnecessary.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}