Android Reverse Skill

Android Reverse Skill

Use this skill primarily to extract network APIs from Android packages. Decompile first, then prioritize base URLs, endpoint declarations, request construction, auth headers, transport clients, resource-defined URLs, and the call chains that prove where each API is used. The bundled scripts live next to this file under scripts/; detailed techniques live under references/.

Operate only on apps, libraries, or malware samples the user is authorized to analyze. If the request appears to target unauthorized access, credential theft, or abuse, stop and keep the response to lawful analysis guidance.

Path Setup

Resolve all bundled resources relative to this SKILL.md directory. Do not rely on plugin-specific root environment variables.

For macOS/Linux examples, set:

SKILL_DIR="/absolute/path/to/android-reverse-skill"

For Windows PowerShell examples, set:

$SkillDir = "C:\absolute\path\to\android-reverse-skill"

If Codex has loaded this skill, use the path shown in the skills list or the current SKILL.md file path to derive SKILL_DIR.

Workflow

1. Check Dependencies

Run the dependency checker before decompiling:

bash "$SKILL_DIR/scripts/check-deps.sh"

On Windows:

& "$SkillDir\scripts\check-deps.ps1"

Required dependencies:

• Java JDK 17+
• jadx

Optional dependencies:

• Vineflower/Fernflower for higher-quality Java decompilation
• dex2jar for using Fernflower on APK/DEX inputs
• apktool for resource work
• adb for pulling packages from devices

If required dependencies are missing, install only after normal Codex approval rules are satisfied. The install scripts may download from the network, write to ~/.local, modify shell profiles, use Homebrew, or ask for sudo.

bash "$SKILL_DIR/scripts/install-dep.sh" jadx
bash "$SKILL_DIR/scripts/install-dep.sh" vineflower

On Windows:

& "$SkillDir\scripts\install-dep.ps1" jadx

Read references/setup-guide.md when installation fails or the user wants manual setup steps.

2. Decompile

Use the decompile wrapper for APK, XAPK, JAR, or AAR files:

bash "$SKILL_DIR/scripts/decompile.sh" [OPTIONS] <file>

On Windows:

& "$SkillDir\scripts\decompile.ps1" [OPTIONS] <file>

Common options:

• -o <dir>: choose output directory
• --deobf: enable deobfuscation
• --no-res: skip resources for faster code-only output
• --engine jadx|fernflower|both: choose decompiler engine

Engine selection:

• Start with jadx for APK/XAPK and first-pass analysis.
• Use fernflower for JAR/AAR or difficult Java constructs.
• Use both when jadx has warnings or the user wants comparison output.
• Add --deobf for obfuscated apps or when package/class names are mostly short identifiers.

The scripts handle XAPK extraction and split/bundled APK detection. When a thin wrapper APK contains base.apk, look for the main source under <output>/base/sources/.

Read references/jadx-usage.md or references/fernflower-usage.md when tuning decompiler options.

3. Run API-First Discovery

Run a broad network sweep against the full decompiled output root when possible, not only sources/, so XML resources and build-time config are included:

bash "$SKILL_DIR/scripts/find-api-calls.sh" <output>/

For real apps, first identify app-owned package prefixes from AndroidManifest.xml and top-level source packages, then use --focus to reduce third-party library noise:

bash "$SKILL_DIR/scripts/find-api-calls.sh" <output>/ --focus com.example.app --focus com.example.sdk

Use targeted passes to isolate noisy areas:

bash "$SKILL_DIR/scripts/find-api-calls.sh" <output>/ --retrofit
bash "$SKILL_DIR/scripts/find-api-calls.sh" <output>/ --okhttp
bash "$SKILL_DIR/scripts/find-api-calls.sh" <output>/ --auth
bash "$SKILL_DIR/scripts/find-api-calls.sh" <output>/ --graphql
bash "$SKILL_DIR/scripts/find-api-calls.sh" <output>/ --websocket
bash "$SKILL_DIR/scripts/find-api-calls.sh" <output>/ --grpc
bash "$SKILL_DIR/scripts/find-api-calls.sh" <output>/ --security
bash "$SKILL_DIR/scripts/find-api-calls.sh" <output>/ --resources

On Windows:

& "$SkillDir\scripts\find-api-calls.ps1" <output>\ -Auth
& "$SkillDir\scripts\find-api-calls.ps1" <output>\ -GraphQL
& "$SkillDir\scripts\find-api-calls.ps1" <output>\ -Security

Treat matches as leads, not final API documentation. For each lead, read surrounding source to confirm the actual method, base URL, dynamic path construction, auth behavior, and caller.

4. Analyze Network Structure

After decompilation, inspect:

• resources/AndroidManifest.xml for launcher Activity, Application class, components, and network permissions.
• App-owned package prefixes from manifest and source paths. Use these with --focus during API search.
• resources/res/values/strings.xml, resources/res/xml/network_security_config.xml, JSON/properties/assets, and Gradle generated constants for URLs and hosts.
• Top-level packages under sources/ to separate app code from libraries.
• Packages or classes named api, network, service, repository, data, retrofit, http, client, or interceptor.
• Client setup for Retrofit, OkHttp, Volley, Apollo/GraphQL, WebSocket/SSE, gRPC, Ktor, WebView, or HttpURLConnection.
• Auth and security setup: interceptors, Authorization, API keys, token refresh, certificate pinning, custom trust managers, and cleartext/network security config.
• Architecture signals such as Activity/Fragment, ViewModel, Repository, Presenter, Dagger/Hilt modules, or clean architecture layers.

For XAPK or bundled APKs, prioritize the base APK output.

5. Trace Call Flows

Start from user-visible or initialization entry points and follow calls toward network code:

• Application.onCreate() for dependency injection, base URLs, interceptors, and HTTP client setup.
• Main Activity or feature Activity for click listeners and UI events.
• ViewModel/Presenter methods to repositories/use cases.
• Repositories and service interfaces to Retrofit, OkHttp, Volley, WebView, or HttpURLConnection.
• DI modules for interface bindings and configured base URLs.

When code is obfuscated, anchor on string literals, Retrofit annotations, URL constants, HTTP method names, Request.Builder, interceptor setup, and auth header construction.

Read references/call-flow-analysis.md for deeper tracing patterns and commands.

6. Document APIs

For each confirmed endpoint or network channel, document:

• HTTP method and path
• Base URL
• Path/query parameters
• Headers and authentication
• Request body and response type
• Calling chain from UI/startup to network layer
• Source file and line number
• Confidence: confirmed, inferred, or unresolved dynamic construction

Use this concise format:

### METHOD /path

- Source: `package.ApiService` (`ApiService.java:42`)
- Base URL: `https://api.example.com/v1`
- Params: path/query/body fields
- Headers/Auth: authorization scheme or token source
- Response: response type/model
- Called from: `Activity -> ViewModel -> Repository -> ApiService`
- Confidence: confirmed

Read references/api-extraction-patterns.md for library-specific patterns and a fuller template.

Deliverables

When the workflow completes, return:

• Decompiled output location
• Network architecture summary
• API endpoint/channel documentation
• Auth, token, and header behavior
• Important call-flow map for key APIs
• Security findings relevant to network extraction, such as certificate pinning or cleartext config
• Dependency or decompiler warnings that affect confidence

Keep raw secrets, tokens, or private keys out of the final answer unless the user explicitly owns the app and asks for secret-handling guidance; prefer describing where they are loaded and how they are used.