# Android Reverse Engineering

> Decompile Android APK/XAPK/JAR/AAR files and extract/document HTTP APIs (Retrofit/OkHttp/URLs) with a repeatable workflow.

- Skill: `gmh5225/android-reverse-engineering` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gmh5225/android-reverse-engineering`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gmh5225/android-reverse-engineering/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: gmh5225 (https://skillmd.com/u/gmh5225)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gmh5225/android-reverse-engineering

---


# Android Reverse Engineering & API Extraction

This skill provides a structured workflow to:
- decompile Android artifacts (APK/XAPK/JAR/AAR)
- trace call flows from entry points to network layers
- extract and document HTTP APIs (Retrofit endpoints, OkHttp calls, hardcoded URLs, auth patterns)

## Prerequisites

- Java JDK 17+
- `jadx` (CLI)
- Optional (recommended): Vineflower/Fernflower, dex2jar

## Workflow (high-level)

1. **Decompile**
   - Use `jadx` first for a broad pass (resources + sources)
   - Use Fernflower/Vineflower for better Java output on tricky code; compare when needed
2. **Analyze structure**
   - Identify launcher Activity, Application class, and DI setup
   - Map packages: `api`, `network`, `data`, `repository`, `service`, `retrofit`, `http`
3. **Trace call flows**
   - UI entry point → ViewModel/Presenter → Repository → API service → HTTP client call
4. **Extract APIs**
   - Retrofit: interface annotations (`@GET`, `@POST`, …)
   - OkHttp: `Request.Builder`, `HttpUrl`, interceptors
   - URLs: string literals (`http://`, `https://`) and base URL builders
5. **Document endpoints**

Use this template for each endpoint you discover:

```markdown
### `METHOD /path`

- **Source**: `com.example.api.ApiService` (ApiService.java:42)
- **Base URL**: `https://api.example.com/v1`
- **Path params**: `id` (String)
- **Query params**: `page` (int), `limit` (int)
- **Headers**: `Authorization: Bearer <token>`
- **Request body**: `{ "email": "string", "password": "string" }`
- **Response**: `ApiResponse<User>`
- **Called from**: `LoginActivity → LoginViewModel → UserRepository → ApiService`
```

## Notes

This repository also ships a **Claude Code plugin** implementation (scripts, references, and the `/decompile` slash command) under:

- `plugins/android-reverse-engineering/`