android-reverse-engineering-skill Documentation

Technical Documentation: SimoneAvogadro/android-reverse-engineering-skill

ℹ️ Provenance: Multi-Tier Ingestion · CodeWiki Reference

Overview (`README.md`) Copy Section

Android Reverse Engineering & API Extraction — Claude Code skill

A Claude Code skill that decompiles Android APK/XAPK/JAR/AAR files and extracts the HTTP APIs used by the app — Retrofit endpoints, OkHttp calls, hardcoded URLs, authentication patterns — so you can document and reproduce them without the original source code.

First-class Kotlin support: modern Android apps are Kotlin/KMP, heavily obfuscated with R8. This skill recovers the original Kotlin class names from metadata R8 cannot strip, and extracts APIs from Ktor, Apollo (GraphQL) and Koin — not just the classic Retrofit/OkHttp stack. See Kotlin name recovery below.

Windows / PowerShell support (experimental): The *.ps1 scripts alongside the bash ones are a recent community contribution, still being stabilised. For any issues please open an issue on this repository (not on the contributors' upstream forks): the PowerShell scripts are maintained here by @SimoneAvogadro.

Table of Contents Copy Chapter

• What it does
• Requirements
• Installation
• Usage
• Repository Structure
• References
• Acknowledgments
• Disclaimer
• License

What it does Copy Chapter

Requirements Copy Chapter

Required:

• Java JDK 17+
• jadx (CLI)

Optional (recommended):

• Vineflower or Fernflower — better output on complex Java code
• dex2jar — needed to use Fernflower on APK/DEX files

See plugins/android-reverse-engineering/skills/android-reverse-engineering/references/setup-guide.md for detailed installation instructions.

Installation Copy Chapter

From GitHub (recommended) Copy Section

Inside Claude Code, run:

/plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill
/plugin install android-reverse-engineering@android-reverse-engineering-skill

The skill will be permanently available in all future sessions.

From a local clone Copy Section

git clone https://github.com/SimoneAvogadro/android-reverse-engineering-skill.git

Then in Claude Code:

/plugin marketplace add /path/to/android-reverse-engineering-skill
/plugin install android-reverse-engineering@android-reverse-engineering-skill

Usage Copy Chapter

Slash command Copy Section

/decompile path/to/app.apk

This runs the full workflow: dependency check, decompilation, and initial structure analysis.

Natural language Copy Section

The skill activates on phrases like:

• "Decompile this APK"
• "Reverse engineer this Android app"
• "Extract API endpoints from this app"
• "Follow the call flow from LoginActivity"
• "Analyze this AAR library"

Manual scripts Copy Section

The scripts can also be used standalone:

/* Detailed source-code truncated for AI context efficiency. */

Kotlin name recovery (R8 deobfuscation) Copy Section

Most real-world Kotlin/KMP apps ship through R8, so the decompiled classes come
out as a.b.c. R8 renames the JVM symbols but cannot strip the Kotlin
metadata strings — the Kotlin runtime (reflection, coroutines) needs the
original fully-qualified names at runtime. This skill mines those
@DebugMetadata / @Metadata annotations to rebuild an obfuscated → real
class-name map. On a typical app it recovers ~100 % of the
*Repository / *ViewModel / *UseCase / *Impl classes you actually want to
read.

# 1. Build the mapping from the decompiled sources
bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/recover-kotlin-names.sh output/sources/ output/names/
#    → output/names/mapping.tsv, mapping.json, by_package/

# 2. Query it: resolve an obfuscated name, search by real name, or grep
#    the sources with each hit annotated with its recovered class name
bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/lookup-name.sh output/names/ LoginRepository
bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/lookup-name.sh output/names/ -o a.b.c
bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/lookup-name.sh output/names/ --grep 'login' output/sources/

Repository Structure Copy Chapter

/* Detailed source-code truncated for AI context efficiency. */

References Copy Chapter

• jadx — Dex to Java decompiler
• Fernflower — JetBrains analytical decompiler
• Vineflower — Fernflower community fork
• dex2jar — DEX to JAR converter
• apktool — Android resource decoder

Acknowledgments Copy Chapter

Thanks to the contributors who have shaped this skill:

• @tajchert — Phase 0 fingerprinting, R8-resistant Kotlin name recovery (recover-kotlin-names.sh, lookup-name.sh), and Ktor / Apollo / Koin / HMAC extraction patterns (#16)
• @philjn — Native Windows / PowerShell support (check-deps.ps1, install-dep.ps1, decompile.ps1, find-api-calls.ps1) and split/bundled APK detection in decompile.sh (#8)
• @txhno — Migration to the maintained ThexXTURBOXx/dex2jar fork (#12)
• @muqiao215 — Decompile partial-success handling, Fernflower timeout safeguard, intermediate-artifact directory (#10)
• @kevinaimonster — Chinese localization (SKILL.md discovery keywords) (#4)

Disclaimer Copy Chapter

This plugin is provided strictly for lawful purposes, including but not limited to:

• Security research and authorized penetration testing
• Interoperability analysis permitted under applicable law (e.g., EU Directive 2009/24/EC, US DMCA §1201(f))
• Malware analysis and incident response
• Educational use and CTF competitions

You are solely responsible for ensuring that your use of this tool complies with all applicable laws, regulations, and terms of service. Unauthorized reverse engineering of software you do not own or do not have permission to analyze may violate intellectual property laws and computer fraud statutes in your jurisdiction.

The authors disclaim any liability for misuse of this tool.

License Copy Chapter

Apache 2.0 — see LICENSE.

The decompilers and other tools this plugin drives (jadx, Vineflower/Fernflower, dex2jar, Apktool, adb, Java) are third-party software, not bundled with the plugin and distributed under their own licenses — see THIRD_PARTY_NOTICES.md. Privacy: PRIVACY.md.

--- METRICS ---

• Files Extracted: 1
• Estimated Token Budget: ~2056 tokens
• Canonical Reference: https://codewiki.google/github.com/SimoneAvogadro/android-reverse-engineering-skill