ACTION REQUIRED (Execute immediately after reading)

Endpoint extraction/Frida adaptation and other community references: ../references/community-security-skills.md; Dynamic analysis requires scope-authorized devices.

```
NOW
```
: Read
```
../field-journal/precedent-reverse.md
```
— Confirm that the operations of this skill are authorized routine operations
```
NOW
```
: Confirm whether the current task falls within the applicable scope of this skill
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing, do not guess paths
```
ACT
```
: Proceed to and execute the first step of the "Workflow", do not stay in the confirmation status

APK Reverse Engineering CLI Operation Specification

Applicable Scope

Prioritize using this skill when the task belongs to the following scenarios:

Analyze Java business logic of APK
Locate login, signature, risk control, certificate verification, root detection
View and modify
```
AndroidManifest.xml
```
View and modify smali
Repackage APK
Perform Java/native dynamic Hook with Frida
Switch to native analysis when APK contains
```
.so
```
files

CLI Tools Verified Available on Current Machine

```
jadx
```
```
1.5.5
```
```
apktool
```
```
3.0.2
```
```
frida-ps
```
```
17.9.6
```
```
adb
```
```
java
```

Scenarios for Prioritizing Script Usage

The following processes are high-frequency and prone to parameter errors, so prioritize using the scripts built into this skill:

Complete
```
jadx + apktool
```
disk output and generate summary in one go:
```
scripts/decode.ps1
```
Frida device check, process listing, spawn/attach injection:
```
scripts/frida-run.ps1
```
Rebuild, align, sign, and install APK:
```
scripts/rebuild-sign-install.ps1
```
Quickly extract key components and permissions from Manifest:
```
scripts/manifest-summary.ps1
```

Use the following one-line commands directly without separate encapsulation:

```
adb devices
```
```
adb logcat
```
```
frida-ps -U
```
```
jadx --version
```
```
apktool --version
```

Built-in Scripts

scripts/decode.ps1

Purpose:

Run
```
jadx
```
and
```
apktool
```
in a unified manner
Create a task output directory in the same directory as the original APK by default
Output summaries such as
```
package
```
,
```
java_files
```
,
```
smali_dirs
```
,
```
so_files
```
Compatible with situations where
```
jadx
```
has partial decompilation errors but still produces usable results

Example:

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx

scripts/frida-run.ps1

Purpose:

Unified entry for Frida's device, process, spawn/attach operations
Avoid confusion between
```
-f
```
,
```
-n
```
,
```
-U
```
when writing parameters manually

Example:

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"

scripts/rebuild-sign-install.ps1

Purpose:

Rebuild APK with
```
apktool b
```
Align with
```
zipalign
```
Sign and verify signature with
```
apksigner
```
Optional direct
```
adb install
```

Example:

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Description:

Generate and reuse debug keystore by default
Output to the same directory as
```
ProjectDir
```
by default, making it easy to place with the original package and unpacked directory

scripts/manifest-summary.ps1

Purpose:

Extract package name
List permissions
List activity/service/receiver/provider
Mark the main launch activity

Example:

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "C:\work\apktool_out\AndroidManifest.xml"

If analyzing

.so

lib/arm64-v8a/*.so

lib/armeabi-v7a/*.so

, combine with:

```
ida-reverse
```
```
radare2
```

Tool Division

jadx

Used for:

Java decompilation and reading
Package name, class name, method name search
Understand APK from high-level logic first

Common commands:

bash

jadx -d jadx_out app.apk
jadx --single-class com.example.LoginActivity -d jadx_out app.apk
jadx --deobf -d jadx_out app.apk

JEB Pro

(Optional Commercial Tool)

Used for:

Cross-validation and deep decompilation of Android DEX / APK / ARM
Supplement static analysis when JADX output is incomplete or heavily obfuscated
Perform second toolchain verification on classes, methods and call relationships of the same target

Boundaries:

JEB Pro is commercial software, users must obtain and install a valid license on their own; this package will not download, crack or bypass licenses.
Only call when the local JEB is confirmed available in
```
tool-index
```
; otherwise, continue using
```
jadx
```
,
```
apktool
```
, Ghidra, IDA or radare2.
Third-party JEB MCP bridge is not a dependency of this package. Before installation, review the source code, permissions, network behavior and version according to
```
../ops/skill-supply-chain.md
```
, then obtain explicit confirmation from the user for registration.

apktool

Used for:

Unpack APK
View and modify
```
AndroidManifest.xml
```
View and modify smali
Rebuild APK

Common commands:

bash

apktool d app.apk -o apktool_out
apktool b apktool_out -o rebuilt.apk

frida

Used for:

Dynamically observe Java method calls
Hook native exported functions
Bypass root detection, certificate verification, debugging detection

Common commands:

bash

frida-ps -U
frida -U -f com.example.app -l hook.js
frida-trace -U -f com.example.app -j '*!*certificate*'

adb

Used for:

Device connection
APK installation
View logs
Pull files

Common commands:

bash

adb devices
adb install -r app.apk
adb shell pm list packages
adb logcat
adb pull /data/local/tmp/file .

Recommended Workflow

1. Triage

First determine the general structure of the APK, do not rush to modify the package or Hook.

Recommended actions:

Export Java code with
```
jadx -d jadx_out app.apk
```
Export smali and resources with
```
apktool d app.apk -o apktool_out
```

Check first:

```
AndroidManifest.xml
```
Main
```
package
```
```
application
```
,
```
activity
```
,
```
service
```
,
```
receiver
```
Whether there are
```
.so
```
files in the
```
lib/
```
directory

2. Java Logic Observation

Prioritize reading from

jadx_out

```
MainActivity
```
```
Application
```
Classes related to login, network, encryption, risk control
Third-party SDK initialization classes

Common keywords:

```
login
```
```
sign
```
```
encrypt
```
```
cipher
```
```
token
```
```
root
```
```
certificate
```
```
trust
```
```
okhttp
```
```
retrofit
```
```
webview
```

If Java code is readable, locate business logic here first.

3. Smali and Resource Layer Confirmation

Switch to

apktool_out

when

jadx

results are incomplete, heavily obfuscated, or actual patching is needed:

Check
```
smali*/
```
Check
```
res/values/strings.xml
```
Check
```
AndroidManifest.xml
```

Prioritize patching:

```
android:exported
```
Debug flags
Root detection return values
Login verification logic
Certificate verification branches

4. Rebuild and Installation

After modification:

bash

apktool b apktool_out -o rebuilt.apk

Or use the script for closed-loop operation directly:

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Description:

This skill only guarantees the
```
apktool
```
rebuild link
If formal installation on the device is required later, a signing process is usually needed
If the task enters signing/alignment, supplement with
```
apksigner
```
/
```
zipalign
```

5. Dynamic Hook

Use Frida when static analysis is insufficient:

Hook login functions
Hook key points of
```
OkHttp
```
/
```
Retrofit
```
/
```
WebView
```
Hook
```
javax.crypto
```
,
```
MessageDigest
```
Hook root detection functions
Hook SSL pinning logic

Principles:

Hook Java layer first, then decide if native Hook is needed
Print parameters and return values first, then decide whether to actively modify return values

Recommendations:

Use
```
frida-*
```
directly for simple one-time commands
Prioritize using
```
scripts/frida-run.ps1
```
for stable reusable injection processes

6. Native

.so

Diversion

If the APK contains key

.so

files:

Locate
```
lib/**/*.so
```
with
```
apktool
```
or
```
jadx
```
Use
```
radare2
```
if only exporting symbols, strings, or quick triage is needed
Use
```
ida-reverse
```
for long-term in-depth analysis, decompilation, renaming, type recovery

Switch to native analysis as soon as encountering these signals:

Java layer is only JNI wrapper
Core signature logic is not in Java
Key logic disappears after
```
System.loadLibrary()
```
Certificate verification/risk control is in
```
.so
```

Output Requirements

At least explain the following in the final output:

Entry components and key classes
Whether key logic is in Java, smali or
```
.so
```
Confirmed sensitive points: login, signature, root, SSL, WebView, JNI
If patching is done, explain what was modified
If Hook is done, explain which class/method/exported function was hooked

Prohibited Items

Do not blindly modify smali at the beginning
Do not write Hook before checking manifest and main entry
Do not directly equate incomplete Java decompilation with "unanalyzable logic"
Do not continue to focus on Java layer when
```
.so
```
obviously carries core logic

Quick Command Cheat Sheet

bash

# Decompile Java
jadx -d jadx_out app.apk

# Unpack APK
apktool d app.apk -o apktool_out

# Rebuild APK
apktool b apktool_out -o rebuilt.apk

# Devices and processes
adb devices
frida-ps -U

# Launch and inject
frida -U -f com.example.app -l hook.js

Routing Context

Upstream Entries:

skills/SKILL.md

(Master Control),

routing.md

Downstream Exports:

Core logic in
```
.so
```
→
```
ida-reverse/
```
or
```
radare2/
```
Need dynamic Hook/verification →
```
reverse-engineering/tools-dynamic.md
```
(Frida Section)
General reverse engineering methodology →
```
reverse-engineering/SKILL.md
```

Peer Related Modules:

reverse-engineering/

(.so analysis and advanced Frida usage)

On-Demand Bootstrap

The entry script of this skill has been integrated into the unified bootstrap system. When tools are missing, it will not report errors directly, but automatically attempt to install them.

Automation Capability Boundaries

Tool	Auto-installable	Installation Method	Description
jadx	✓	GitHub Release ZIP	Automatically download and extract to `%USERPROFILE%\Tools\jadx\`
apktool	✓	GitHub Release JAR + wrapper	Automatically download jar and generate bat to `%USERPROFILE%\Tools\apktool\`
JEB Pro	✗	User manually installs and provides valid license	Optional Android / ARM cross-validation tool; third-party MCP bridge requires separate audit
frida / frida-ps	✓	pip install frida-tools	Requires Python to be installed
adb	✓	winget / fallback path	Automatically install Android Platform-Tools
zipalign	✗	Need to manually install Android Build-Tools	`sdkmanager "build-tools;35.0.0"`
apksigner	✗	Need to manually install Android Build-Tools	Same as above

Bootstrap Trigger Points

```
scripts/decode.ps1
```
: Automatically call
```
bootstrap-reverse.ps1
```
when jadx or apktool is missing
```
scripts/rebuild-sign-install.ps1
```
: Automatically call bootstrap when adb or apktool is missing
```
scripts/frida-run.ps1
```
: Currently manual check (frida is usually installed via pip)

When Bootstrap Fails

If automatic installation fails, the script will throw a clear error with a manual installation link. Common reasons:

Network issues (GitHub API / PyPI unreachable)
winget unavailable (Windows version too low)
Java not installed (apktool depends on JDK)

Task Completion Self-Check (MUST pass before claiming completion)

Have I executed every step in the workflow (instead of just reading)?
Have I used real tool paths based on
```
tool-index
```
?
Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
Have I completed and written back the Checklist items required by RULES?

apk-reverse

NPX Install

Tags

SKILL.md Content (Chinese)

ACTION REQUIRED (Execute immediately after reading)

APK Reverse Engineering CLI Operation Specification

Applicable Scope

CLI Tools Verified Available on Current Machine

Scenarios for Prioritizing Script Usage

Built-in Scripts

`scripts/decode.ps1`

`scripts/frida-run.ps1`

`scripts/rebuild-sign-install.ps1`

`scripts/manifest-summary.ps1`

Tool Division

`jadx`

`JEB Pro`
(Optional Commercial Tool)

`apktool`

`frida`

`adb`

Recommended Workflow

1. Triage

2. Java Logic Observation

3. Smali and Resource Layer Confirmation

4. Rebuild and Installation

5. Dynamic Hook

6. Native
`.so`
Diversion

Output Requirements

Prohibited Items

Quick Command Cheat Sheet

Routing Context

On-Demand Bootstrap

Automation Capability Boundaries

Bootstrap Trigger Points

When Bootstrap Fails

Task Completion Self-Check (MUST pass before claiming completion)