/android-reverse-engineering

name: android-reverse-engineering
description: Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints, trace call flows from UI to network layer, and analyze runtime behavior with Frida, network capture, JNI/SO inspection, and signature generation. Use when the user wants to decompile, analyze, hook, inspect network traffic, bypass SSL pinning for analysis, locate crypto or signing logic, or follow call flows in Android packages.
trigger: decompile APK|decompile XAPK|reverse engineer Android|extract API|analyze Android|jadx|fernflower|vineflower|follow call flow|decompile JAR|decompile AAR|Android reverse engineering|find API endpoints|frida|hook android|ssl pinning|network capture|android packet capture|jni|so analysis|sign analysis|signature generation|unidbg|反编译APK|安卓逆向|提取API|分析安卓应用|反编译安卓|逆向工程|追踪调用链|提取接口

Android Reverse Engineering

Decompile Android APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower, trace call flows through application code and libraries, produce structured documentation of extracted APIs, and escalate to runtime analysis only after static triage shows that it is needed. Two decompiler engines are supported: jadx for broad Android coverage and Fernflower/Vineflower for higher-quality output on complex Java code.

Core Principle

Do not jump straight into Frida, packet capture, or SO analysis. Start with JADX and identify:

• The network stack in use
• The request builder or interceptor chain
• Where signing or encryption appears to happen
• Whether the logic is visible in Java or delegated to native code

Use dynamic analysis only to confirm or bridge gaps that static analysis cannot resolve.

When to Suggest IDA MCP

IDA MCP provides static binary analysis (disassembly, decompilation, cross-references) for `.so` files. Do NOT suggest it blindly — check these conditions first:

**Suggest IDA MCP when the user asks to:**

• Find function offsets or exports in a specific SO
• Decompile a known native function to C pseudocode
• Trace cross-references to a string, symbol, or address
• Check whether a SO imports crypto/network libraries
• Analyze a SO that is NOT obfuscated (standard compiler, recognizable function boundaries)

**Do NOT suggest IDA MCP when:**

• The SO uses control-flow flattening or similary heavy obfuscation — pseudocode will be unreadable. Use Frida scripts instead.
• All strings in the SO are encrypted — static search finds nothing. Use `jni_method_trace.js` to capture runtime decryption.
• The user needs runtime values (keys, tokens, parameters, decrypted data) — IDA can only show static code.
• The target SO has not yet been identified — suggest `jni_method_trace.js` first to find which SO handles the logic.
• The user needs to compute or generate a signature, ciphertext, or token — this requires runtime execution, not static analysis.

**Quick check before suggesting:** Use `survey_binary` on the SO. If the output shows only a handful of huge functions (> 10 KB each) instead of many small ones, the binary is obfuscated — skip IDA and suggest Frida.

Prerequisites

This skill requires **Java JDK 17+** and **jadx** to be installed. **Fernflower/Vineflower**, **dex2jar**, and **rizin** are optional but recommended for better decompilation quality and native `.so` analysis. Run the dependency checker to verify:

bash skills/android-reverse-engineering/scripts/check-deps.sh

On Windows (PowerShell):

& "skills/android-reverse-engineering/scripts/check-deps.ps1"

If anything is missing, follow the installation instructions in `skills/android-reverse-engineering/references/setup-guide.md`.

Workflow

Phase 1: Verify and Install Dependencies

Before decompiling, confirm that the required tools are available — and install any that are missing.

**Action**: Run the dependency check script.

bash skills/android-reverse-engineering/scripts/check-deps.sh

On Windows (PowerShell):

& "skills/android-reverse-engineering/scripts/check-deps.ps1"

The output contains machine-readable lines:

• `INSTALL_REQUIRED:<dep>` — must be installed before proceeding
• `INSTALL_OPTIONAL:<dep>` — recommended but not blocking

**If required dependencies are missing** (exit code 1), install them automatically:

bash skills/android-reverse-engineering/scripts/install-dep.sh <dep>

On Windows (PowerShell):

& "skills/android-reverse-engineering/scripts/install-dep.ps1" <dep>

The install script detects the OS and package manager, then:

• Installs without sudo when possible (downloads to `~/.local/share/`, symlinks in `~/.local/bin/`)
• Uses sudo and the system package manager when necessary (apt, dnf, pacman)
• If sudo is needed but unavailable or the user declines, it prints the exact manual command and exits with code 2 — show these instructions to the user

Windows notes:

• The PowerShell install script prefers `winget`, then `scoop`, then `choco`
• If no package manager is available, it falls back to downloading into `%USERPROFILE%\.local\share\`
• `check-deps.ps1` and `decompile.ps1` refresh PATH from the user environment, so newly installed tools can usually be found without restarting the terminal

**For optional dependencies**, ask the user if they want to install them. Vineflower and dex2jar are recommended for best results. Rizin is recommended when JNI or `.so` inspection is likely.

After installation, re-run `check-deps.sh` to confirm everything is in place. Do not proceed to Phase 2 until all required dependencies are OK.

Phase 2: Decompile

Use the decompile wrapper script to process the target file. The script supports three engines: `jadx`, `fernflower`, and `both`.

**Action**: Choose the engine and run the decompile script. The script handles APK, XAPK, JAR, and AAR files.

bash skills/android-reverse-engineering/scripts/decompile.sh