apk-reverse · 手机版逆向skill

Android APK Reverse Engineering Skill

Unpack it, understand it, patch it, prove it works.

About · Capabilities · Quick start · Usage · Layout · Docs · Verify · Contributing · License

🌐 English · 中文

About

If you are an AI agent, open SKILL.md and follow its routing, consent and patch rules before touching any target.

A practical Android APK reverse-engineering skill for phone-based work. It turns “I have an APK” into a repeatable loop instead of guessed commands:

APK
  → toolcheck / install_tools        (is the toolchain ready?)
  → decode + manifest_summary        (unpack, decompile, map components)
  → scan_premium / find_api_calls    (find the logic and the ads)
  → patch smali / manifest / .so     (make the smallest change)
  → build_sign                       (repack, align, sign)
  → device verify                    (install, launch, check behaviour)
  → field-journal                    (write down cause → fix)

Why this exists

• APK tasks need a different playbook from generic coding tasks
• jadx / apktool / Frida / IDA are easy to install but easy to misuse
• Phone-only workflows (proot Ubuntu on ARM64) have their own pitfalls
• The same “why did it crash after repacking?” problems get solved twice

At a glance

Version	Scripts	Reference docs	CI	License
v0.5.13	32 + 12 Frida	24	GitHub Actions	MIT

⭐ Star this repo · 🍴 Fork · 🐛 Report an issue

(back to top)

Capabilities

Area	What it does
Decompilation	jadx sources, apktool resources/smali, smali3, CFR
Components & ads	SDK signatures, manifest / layout / resource inspection
Logic analysis	paid & entitlement checks, numeric logic, storage (SharedPreferences / SQLite)
Patching	smali patches, static fields, native .so instruction patches
Protection	packers, signature checks, integrity checks
Dynamic & network	Frida, objection, mitmproxy, certificate-pinning adaptation
Delivery	repack, align, sign, install and verify on device

(back to top)

Quick start

SK=/path/to/apk-reverse

bash $SK/scripts/toolcheck.sh                 # tool check
bash $SK/scripts/install_tools.sh             # install missing tools

bash $SK/scripts/decode.sh app.apk --out ./work   # decode
python3 $SK/scripts/manifest_summary.py ./work    # manifest summary
python3 $SK/scripts/scan_premium.py ./work        # paid/entitlement candidates
python3 $SK/scripts/find_api_calls.py ./work      # API and credential hints
bash $SK/scripts/build_sign.sh ./work out.apk     # repack + sign

Tool downloads are verified against scripts/download-sha256.txt (SHA256); a mismatch aborts the install, and an unpinned version prints its hash with a warning.

(back to top)

Usage

• The workflow rules and patch patterns live in SKILL.md; reference docs under references/ explain each step in depth.
• Everything runs in proot Ubuntu on ARM64; a regular Linux machine works too.
• Build a release: bash scripts/make_release.sh --name apk-reverse --public → zip（+ 本地 .sha256，发布附件只传 SHA256SUMS）, then the extracted copy is re-checked.
• Verify a release: bash scripts/verify_release.sh <zip> (reads .sha256 or SHA256SUMS).
• Publish to GitHub: bash scripts/publish_github.sh --tag v<version> --release; the token comes from $GITHUB_TOKEN or ~/.config/dsh-go/github-token and never enters the repo.

(back to top)

Repository layout

apk-reverse/
├── SKILL.md          # routing / workflow / patch patterns / rules
├── references/       # topic docs
├── scripts/          # executable tools
├── field-journal/    # reusable problem → cause → fix notes
├── assets/           # banner, icon and social preview images
├── AGENTS.md         # agent activation and consent boundaries
├── SECURITY.md       # trust model and reporting
├── CONTRIBUTING.md
├── CHANGELOG.md
├── VERSION
└── LICENSE           # MIT

(back to top)

Documentation

• references/identity-check.md — local identity card, no online lookups
• references/mobile-toolchain.md — toolchain and installation
• references/patch-patterns.md — smali / manifest / layout patching
• references/protection-map.md — packers, integrity checks, traffic capture
• references/device-verify.md, references/device-control.md — on-device verification
• references/security-audit.md — exported components, WebView, secrets
• docs/STAGES.md — six-stage workflow: entry, artifacts, gate for each stage
• docs/REPORT-TEMPLATE.md — analysis report template (conclusion first, evidence chain)
• docs/MCP-INTEGRATION.md — JADX / Ghidra / IDA / Burp MCP integration notes
• scripts/frida/README.md — Frida script library (SSL unpinning, anti-debug, exit blocker, root bypass, Frida hider, return-value patcher)
• tests/routing_cases.json — routing regression cases (CI checks with scripts/check_routing.py)
• docs/ENVIRONMENTS.md — phone proot vs Termux vs desktop agent, and where this skill fits
• references/kotlin-r8-recovery.md — R8/ProGuard obfuscation and Kotlin name recovery
• references/api-extraction.md — API / auth headers / third-party host extraction
• references/on-device-tooling.md — on-device GUI toolchain: MT Manager / NP Manager / LSPosed / Termux vs scripts
• references/lsposed-modules.md — LSPosed module fallback when repacking is refused
• references/decompilers.md — decompiler choice: jadx / Fernflower / ddc (with on-phone install)
• references/triage-playbook.md — 15-minute triage checklist
• docs/EVIDENCE.md — evidence levels and ledger discipline (scripts/ledger.py)
• docs/APP-INTEGRATION.md — using this skill inside the phone app
• references/native-fuzzing.md — native fuzzing (AFL++/ASan) feasibility
• See the index at the end of SKILL.md

(back to top)

Release integrity

Every release ships a SHA256SUMS file; recipients verify with:

sha256sum -c SHA256SUMS
# or
bash scripts/verify_release.sh apk-reverse.zip SHA256SUMS

(back to top)

Contact

• Email: xiaotianya14@gmail.com
• QQ Group: 258605008
• Feedback: GitHub Issues

Contributing

Contributions are welcome — issues, better patch patterns, new reference docs, field-journal notes.

1. Fork the repository
2. git checkout -b feature/your-idea
3. Commit your change (git commit -m 'Add your idea')
4. git push origin feature/your-idea
5. Open a pull request

Please keep changes inside the consent and authorization boundaries described in AGENTS.md and SECURITY.md.

Contributors

Contributors — PRs welcome.

(back to top)

Built with

jadx · apktool · Frida · IDA Pro · Ghidra

Acknowledgments

Thanks to the open-source tool authors behind jadx, apktool, Frida, radare2, Ghidra and every tool this skill relies on. This project is a workflow layer on top of their work.

License

MIT — see LICENSE. Read the disclaimer below before use.

Disclaimer: this project is for learning/research on applications you own or are authorized to test. You are responsible for data loss, device damage and legal risk. Do not use it against other people's devices, unauthorized apps, or in violation of platform terms. No warranty; the authors accept no liability.

(back to top)

License & assets

• Code & docs: MIT (see LICENSE).
• Visual assets are NOT MIT-licensed: avatars, banners, icon, social image and badge styles in assets/ remain © xiaotianya14, all rights reserved — no commercial use, no redistribution, no relicensing.
• Private packages (game-mod material, working notes) are not published and not licensed.
• Third-party tools, SDKs and trademarks remain under their own terms. See NOTICE for details.