This project offers a comprehensive toolkit for Android reverse engineering, designed for security researchers and penetration testers. It automates static and dynamic analysis tasks, including decompilation, API extraction, call chain tracing, and dynamic instrumentation with Frida, providing a complete pipeline from APK analysis to native code investigation.

How It Works

The skill employs a dual-engine decompiler approach, leveraging both jadx and Fernflower/Vineflower to provide comparative analysis and more robust code output. It facilitates detailed call chain tracing from UI components down to network requests (Retrofit/OkHttp) and integrates a suite of practical Frida scripts for dynamic analysis, covering SSL pinning bypass, DEX/SO dumping, encryption hook, and root/Frida detection bypasses. The toolkit also includes capabilities for native JNI/SO analysis.

Quick Start & Requirements

• Installation: Clone the repository. The README details integration steps for AI platforms, but manual script execution is also supported.
• Primary Dependencies: Java JDK 17+, jadx command-line tool.
• Recommended Dependencies: Vineflower/Fernflower, dex2jar, Rizin, Frida, adb.
• Platform Support: macOS, Linux, Windows (via PowerShell scripts).
• Setup: Automated dependency checking and installation scripts (check-deps.sh, install-dep.sh) are provided.
• Links: Official quick-start and usage examples are detailed within the README.

Highlighted Details

• Dual decompiler engines (jadx, Fernflower/Vineflower) with automatic comparison.
• Comprehensive API extraction for Retrofit, OkHttp, URLs, auth headers, tokens, and signature logic.
• Nine practical Frida scripts for dynamic analysis (SSL logging, DEX/SO dumping, JNI tracing, encryption hooks, bypasses, keystore export).
• Full native layer analysis support, including JNI registration tracing and SO symbol analysis with Rizin.
• Automatic XAPK and nested APK unpacking.
• Cross-platform support via Bash and PowerShell scripts.

Maintenance & Community

No specific details on maintainers, community channels (Discord/Slack), or sponsorships are present in the provided text. The project is noted as a significant expansion upon the SimoneAvogadro/android-reverse-engineering-skill repository.

Licensing & Compatibility

• License: Apache 2.0.
• Compatibility: The permissive Apache 2.0 license allows for commercial use and integration with closed-source projects, subject to the license terms and the project's usage disclaimer.

Limitations & Caveats

The tool relies on external command-line utilities that may require manual installation or configuration. Users must ensure compliance with all applicable laws and software terms of service, as the project explicitly disclaims responsibility for any misuse.