DΛΣMӨП

// HackTricks · Mobile

APK decompilers

APK decompilers

The comparative decompilation guide in the references provides further details on the tools and their tradeoffs.[3]

JD-Gui[4]

As the pioneering GUI Java decompiler, JD-Gui allows you to investigate Java code within APK files. It’s straightforward to use; after obtaining the APK, simply open it with JD-Gui to inspect the code.

Jadx[5]

Jadx offers a user-friendly interface for decompiling Java code from Android applications. It’s recommended for its ease of use across different platforms.

  • To launch the GUI, navigate to the bin directory and execute: jadx-gui
  • For command-line usage, decompile an APK with: jadx app.apk
  • To specify an output directory or adjust decompilation options: jadx app.apk -d <path to output dir> --no-res --no-src --no-imports

AI-assisted static analysis with jadx-mcp

jadx-mcp is a jadx-gui plugin that exposes the analysis model of the currently loaded APK, DEX, or JAR as 27 schema-validated MCP tools over Streamable HTTP. Unlike copying decompiled text into an LLM, the client can request Java or Smali, methods and fields, decoded manifest components and resources, cross-references, and jadx rename operations as structured results.[14]

The plugin targets jadx-gui 1.5.6 and requires jadx to run on Java 17 or later. Install its fat JAR, open the target in jadx-gui, start the server from Plugins → jadx-mcp: Settings…, and register the default endpoint with an HTTP-capable MCP client:[14]

jadx plugins --install-jar jadx-mcp-0.1.0.jar
claude mcp add --transport http jadx-mcp http://localhost:8090/mcp

A compact Android review/deobfuscation loop is:[14]

  1. Call status, then inspect get_android_manifest, get_manifest_component, get_main_activity_class, get_strings, and selected resource files to map exported entry points, deep links, hardcoded endpoints, and security configuration.
  2. Use search_classes, search_method_by_name, or search_classes_by_keyword, then retrieve only the relevant class/method source or Smali. Supply a signature fragment to method tools when overloads are ambiguous.
  3. Follow xrefs_to_class, xrefs_to_method, and xrefs_to_field, retrieving method source at each hop to reconstruct call paths and field-access flows.
  4. Rename inferred symbols with rename_class, rename_method, rename_field, or rename_package, reload, and repeat. These aliases use jadx’s normal deobfuscation system; rename_variable is session-local and is not stored in saved .jadx metadata.

Paginated tools accept offset and limit (default 50, maximum 500). Prefer targeted queries over get_main_application_classes_code, whose full-source responses are token-heavy.[14]

[!WARNING] The server has no authentication. Its safe default is 127.0.0.1:8090; Origin/Host validation helps against browser and DNS-rebinding access but does not authenticate network clients. Never bind it to 0.0.0.0 or a LAN address, and do not port-forward the endpoint: connected clients can extract loaded code/resources and mutate project aliases.[14]

GDA Android Reversing Tool[6]

GDA, a Windows-only tool, offers extensive features for reverse engineering Android apps. Install and run GDA on your Windows system, then load the APK file for analysis.

Bytecode Viewer[7]

With Bytecode-Viewer, you can analyze APK files using multiple decompilers. After downloading, run Bytecode-Viewer, load your APK, and select the decompilers you wish to use for simultaneous analysis.

Enjarify[8]

Enjarify translates Dalvik bytecode to Java bytecode, enabling Java analysis tools to analyze Android applications more effectively.

  • To use Enjarify, run: enjarify app.apk This generates the Java bytecode equivalent of the provided APK.

CFR[9]

CFR is capable of decompiling modern Java features. Use it as follows:

  • For standard decompilation: java -jar ./cfr.jar "app.jar" --outputdir "output_directory"
  • For large JAR files, adjust the JVM memory allocation: java -Xmx4G -jar ./cfr.jar "app.jar" --outputdir "output_directory"

Fernflower[10]

Fernflower, an analytical decompiler, requires building from source. After building:

  • Decompile a JAR file: java -jar ./fernflower.jar "app.jar" "output_directory" Then, extract the .java files from the generated JAR using unzip.

Krakatau[11]

Krakatau offers detailed control over decompilation, especially for handling external libraries.

  • Use Krakatau by specifying the standard library path and the JAR file to decompile: ./Krakatau/decompile.py -out "output_directory" -skip -nauto -path "./jrt-extractor/rt.jar" "app.jar"

Procyon[12]

For straightforward decompilation with procyon:

  • Decompile a JAR file to a specified directory: procyon -jar "app.jar" -o "output_directory"

frida-DEXdump[13]

This tool can be used to dump the DEX of a running APK in memory. This helps to beat static obfuscation that is removed while the application is executed in memory.

androidReverse

androidReverse is an on-device Android reverse-engineering suite: useful when you need to triage an APK directly from a phone/tablet without ADB or a desktop workstation.[1][2]

Useful workflow:

  • Extract .apk, .xapk, and split .apks from installed apps or storage, then inspect Java/Kotlin, Smali, resources, and lib/*.so in the same session.
  • Compare the same class across multiple engines instead of trusting a single decompiler output. It includes Jadx, Jadx Fallback, Jadx IR, CFR, Procyon, JD-Core, Krakatau, and Vineflower. In practice, use Jadx/CFR/Procyon for readability and switch to Krakatau or Jadx IR when obfuscation, malformed bytecode, Kotlin artifacts, lambdas, or flattened control flow make the reconstructed Java suspicious.
  • Validate resources/manifests when normal viewers fail: the suite decodes binary AXML and parses ARSC tables, which is useful to recover permissions, exported components, intent filters, deep links, feature flags, URLs, and other strings hidden in resources.
  • Pivot into native code when the real logic lives in JNI: it embeds radare2 for pseudo-C, assembly, hex, CFGs, call graphs, and xrefs, which is handy to inspect JNI entry points, anti-analysis checks, crypto routines, and string decryption inside Android .so files.
  • For Flutter apps, prefer its Unflutter support; for Unity apps, inspect the recovered il2cpp metadata instead of relying only on Java decompilation.

This is especially practical for field triage, mobile malware static analysis, and quick review of customer-provided APKs when you only have an Android device available.

References