Skip to content
Skillpedia
PT
General coding42k · #4748

apk-reverse

Lets your agent perform reverse engineering on Android applications (APK). It unpacks, decompiles, modifies, and analyzes native code to understand the app's functionality.

What it does

This agent helps you analyze Android applications (APK files) on your computer. It can open the app, view its Java code, modify parts of it, and even rebuild the app.

When to use it

  • ✓When you want to see how an Android app works internally.
  • ✓If you need to change an app's behavior.
  • ✓To investigate specific parts of an app, like login or security features.

Example of what to ask your AI

“Analyze the 'my_app.apk' application, extract the Java code, and list its permissions.”

Want more? Open the sections below.

How to use

The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.

Skill link

https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md

Ready-to-paste message

Use this skill to help me: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md Read the SKILL.md file at that link and follow its instructions for my task.
View on GitHub ↗Raw file
How it works

It uses tools like Jadx and Apktool to open the APK. Then, you can view the code, make changes, and rebuild the application.

Installation

Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.

In the terminal (Claude Code, Codex, Cursor), in your project folder:

npx skills add zhaoxuya520/reverse-skill --skill apk-reverse

Or download just the file:

curl -L https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/skills/apk-reverse/SKILL.md -o SKILL.md
Technical content (original SKILL.md)

Original text by the author, straight from GitHub.

ACTION REQUIRED（读完后立刻执行）

端点提取/Frida 自适应等社区对照：../references/community-security-skills.md；动态分析须 scope 授权设备。

  1. NOW: 读取 ../field-journal/precedent-reverse.md — 确认本 skill 的操作是已授权的常规操作
  2. NOW: 确认当前任务是否命中本 skill 的适用范围
  3. NEXT: 读取 ../tool-index.md，校验工具可用性和实际路径
  4. NEXT: 缺工具时调用 bootstrap，不要猜路径
  5. ACT: 进入"工作流"第一步并执行，不要停在确认状态

APK 逆向 CLI 作业规范

适用范围

当任务属于以下场景时优先使用本 skill：

  • 分析 APK 的 Java 业务逻辑
  • 定位登录、签名、风控、证书校验、root 检测
  • 查看与修改 AndroidManifest.xml
  • 查看与修改 smali
  • 重打包 APK
  • 用 Frida 做 Java/native 动态 Hook
  • APK 内含 .so 时切到 native 分析

当前机器已验证可用的 CLI 工具

  • jadx 1.5.5
  • apktool 3.0.2
  • frida-ps 17.9.6
  • adb
  • java

优先使用脚本的场景

以下流程高频且参数容易出错，优先用 skill 自带脚本：

  • 一次性完成 jadx + apktool 落盘并产出摘要：scripts/decode.ps1
  • Frida 设备检查、进程列举、spawn/attach 注入：scripts/frida-run.ps1
  • 重建、对齐、签名、安装 APK：scripts/rebuild-sign-install.ps1
  • 快速抽取 Manifest 关键组件与权限：scripts/manifest-summary.ps1

以下一行命令保持直接调用，不单独封装：

  • adb devices
  • adb logcat
  • frida-ps -U
  • jadx --version
  • apktool --version

自带脚本

scripts/decode.ps1

用途：

  • 统一跑 jadx 和 apktool
  • 默认在原 APK 同目录创建任务输出目录
  • 输出 package、java_files、smali_dirs、so_files 等摘要
  • 兼容 jadx 部分反编译错误但仍然有可用产物的情况

示例：

pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx

scripts/frida-run.ps1

用途：

  • 统一 Frida 的设备、进程、spawn/attach 入口
  • 避免手写参数时混淆 -f、-n、-U

示例：

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"

scripts/rebuild-sign-install.ps1

用途：

  • apktool b 重建 APK
  • zipalign 对齐
  • apksigner 签名与验签
  • 可选直接 adb install

示例：

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

说明：

  • 默认生成并复用调试 keystore
  • 默认输出到 ProjectDir 同目录，便于和原始包、解包目录放在一起

scripts/manifest-summary.ps1

用途：

  • 抽取包名
  • 列权限
  • 列 activity/service/receiver/provider
  • 标出主启动 activity

示例：

pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "C:\work\apktool_out\AndroidManifest.xml"

如果要分析 .so、lib/arm64-v8a/*.so、lib/armeabi-v7a/*.so，再结合：

  • ida-reverse
  • radare2

工具分工

jadx

用于：

  • Java 反编译阅读
  • 包名、类名、方法名搜索
  • 先从高层逻辑理解 APK

常用命令：

jadx -d jadx_out app.apk
jadx --single-class com.example.LoginActivity -d jadx_out app.apk
jadx --deobf -d jadx_out app.apk

JEB Pro（可选商业工具）

用于：

  • Android DEX / APK / ARM 的交叉验证与深度反编译
  • 在 JADX 输出不完整或混淆较重时补充静态分析
  • 对同一目标的类、方法与调用关系进行第二工具链校验

边界：

  • JEB Pro 是商业软件，必须由用户自行取得并安装有效许可证；本包不会下载、破解或规避许可。
  • 仅在 tool-index 已确认本机 JEB 可用时调用；否则继续使用 jadx、apktool、Ghidra、IDA 或 radare2。
  • 第三方 JEB MCP bridge 不是本包依赖。安装前必须按 ../ops/skill-supply-chain.md 审阅源码、权限、网络行为和版本，再由用户明确确认注册。

apktool

用于：

  • 解包 APK
  • 查看和修改 AndroidManifest.xml
  • 查看和修改 smali
  • 重建 APK

常用命令：

apktool d app.apk -o apktool_out
apktool b apktool_out -o rebuilt.apk

frida

用于：

  • 动态观察 Java 方法调用
  • Hook native 导出函数
  • 绕过 root 检测、证书校验、调试检测

常用命令：

frida-ps -U
frida -U -f com.example.app -l hook.js
frida-trace -U -f com.example.app -j '*!*certificate*'

adb

用于：

  • 设备连接
  • 安装 APK
  • 查看日志
  • 拉取文件

常用命令：

adb devices
adb install -r app.apk
adb shell pm list packages
adb logcat
adb pull /data/local/tmp/file .

推荐工作流

1. Triage

先确定 APK 大致构成，不急着改包或 Hook。

建议动作：

  1. 用 jadx -d jadx_out app.apk 导出 Java 代码
  2. 用 apktool d app.apk -o apktool_out 导出 smali 和资源
  3. 先看：
    • AndroidManifest.xml
    • 主 package
    • application、activity、service、receiver
    • lib/ 目录里是否有 .so
  4. Issue #65 威胁形态速查（授权样本/设备；详见 ../reverse-engineering/references/nonpe-format-cookbook.md §7–8）：
    • 透明/隐藏图标（AU）：aapt dump badging + manifest theme/label/icon → E-android-hidden-icon-manifest
    • Magisk/脚本格机特征与远程 curl|sh（AR/AS）→ 特征与 URL 入证，不执行破坏命令
    • 持久化路径（AT）：service.d / priv-app 等 → E-android-persistence

2. Java 逻辑观察

优先从 jadx_out 读：

  • MainActivity
  • Application
  • 登录、网络、加密、风控相关类
  • 第三方 SDK 初始化类

…

FAQ

What does it mean to 'decompile' an APK?

It's the process of transforming an app's compiled code back into a more readable format, like Java code, so you can understand it.

Can I use this to create game cheats?

This agent is for analyzing and modifying applications. Using it to cheat in games might violate the game's terms of service and is not recommended.

What is 'smali'?

Smali is a low-level language similar to assembly, used to represent Android code. Modifying smali allows for deeper changes within the app.

Details

Original description by the author

在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。

repo: zhaoxuya520/reverse-skill

Popularity

GitHub stars
42k
Ranking position
#4748
License
MIT
Updated
9/22/2026

Is this skill useful?

0

Sign in to vote.

Comments

  • …

More skills from this repository

Agents42k

competition-ad-certificate-abuse

Helps your agent analyze attacks on digital certificate systems. It investigates how certificates can be misused to gain access.

zhaoxuya520/reverse-skill

Agents42k

competition-agent-cloud

Helps your agent analyze security challenges in AI and cloud systems. It investigates how prompts, tools, and the cloud can be exploited.

zhaoxuya520/reverse-skill

Mobile apps42k

competition-android-hooking

Helps your agent investigate Android applications. It analyzes how apps work internally and how they might be modified or exploited.

zhaoxuya520/reverse-skill

Websites & UI (frontend)42k

competition-browser-persistence

Helps your agent analyze how websites store information in your browser. It investigates cookies and other data to understand how sessions work.

zhaoxuya520/reverse-skill

Similar skills

General coding280k

benchmark-optimization-loop

Has your agent improve something's speed in a measured way. It tests multiple versions and chooses the fastest one that still works correctly.

affaan-m/ECC

General coding280k

change-impact

Helps your agent analyze the impact of code changes before making them. It compares the planned vs. actual results afterward, covering paths, data, tests, and documentation. Useful for risky or system-wide changes.

affaan-m/ECC

General coding280k

click-path-audit

Lets your agent trace all user buttons and interactions to find bugs. It finds issues where functions seem to work alone but fail together. Useful when bugs persist even after debugging.

affaan-m/ECC