Android APK Decompiler

A comprehensive guide to decompiling and analyzing Android APK files using industry-standard tools.

Quick Start

When you receive an APK file to analyze, follow this workflow:

1. Initial inspection: Use Jadx for quick, readable source code extraction
2. Deep analysis: Use multiple decompilers in parallel for complex cases
3. Obfuscated apps: Use frida-DEXdump to extract runtime DEX files
4. Modern Java features: Use CFR for better handling of recent Java syntax

Tool Selection Guide

For Quick Analysis (Recommended Default)

Jadx - Best all-around tool for most scenarios

• User-friendly GUI and CLI options
• Cross-platform support
• Good balance of speed and accuracy

# GUI mode
jadx-gui

# CLI mode - basic decompilation
jadx app.apk

# CLI mode - with options
jadx app.apk -d ./output --no-res --no-src --no-imports

For Complex/Obfuscated Apps

Bytecode-Viewer - Multiple decompilers in one interface

• Compare outputs from different decompilers simultaneously
• Best for apps with heavy obfuscation
• Download from releases page, run, load APK, select decompilers

GDA-android-reversing-Tool - Windows-only, feature-rich

• Extensive reverse engineering features
• Install on Windows, load APK for analysis

For Modern Java Features

CFR - Handles modern Java syntax well

# Standard decompilation
java -jar ./cfr.jar "app.jar" --outputdir "output_directory"

# For large JAR files (increase memory)
java -Xmx4G -jar ./cfr.jar "app.jar" --outputdir "output_directory"

For Runtime Analysis (Beating Obfuscation)

frida-DEXdump - Extract DEX from running app in memory

• Useful when static obfuscation is removed at runtime
• Dump the DEX of a running APK to analyze deobfuscated code

For Bytecode Translation

Enjarify - Convert Dalvik to Java bytecode

enjarify app.apk

• Enables Java analysis tools to work with Android apps
• Generates Java bytecode equivalent of the APK

For Detailed Control

Krakatau - Fine-grained decompilation control

./Krakatau/decompile.py -out "output_directory" -skip -nauto -path "./jrt-extractor/rt.jar" "app.jar"

• Specify standard library paths
• Handle external libraries effectively

For Simple JAR Decompilation

procyon - Straightforward decompilation

procyon -jar "app.jar" -o "output_directory"

Fernflower - JetBrains' analytical decompiler

# After building from source
java -jar ./fernflower.jar "app.jar" "output_directory"
# Then extract .java files from generated JAR
unzip output.jar

JD-Gui - Pioneering GUI decompiler

• Open APK directly in JD-Gui
• Simple, straightforward interface
• Good for quick inspection

Analysis Workflow

Step 1: Initial Reconnaissance

1. Run Jadx on the APK to get a quick overview
2. Look at the manifest file for permissions and components
3. Identify main entry points and suspicious activities

Step 2: Deep Dive

1. Use multiple decompilers if code is obfuscated
2. Compare outputs to find the most readable version
3. Focus on key areas: network calls, file operations, crypto functions

Step 3: Runtime Analysis (if needed)

1. If static analysis shows heavy obfuscation, use frida-DEXdump
2. Run the app and dump DEX from memory
3. Analyze the deobfuscated runtime code

Step 4: Documentation

1. Document findings: vulnerabilities, suspicious behavior, data flows
2. Note which decompiler produced the clearest results
3. Save relevant code snippets for reporting

Common Use Cases

Finding Hardcoded Secrets

• Search for API keys, passwords, tokens in decompiled source
• Look in strings.xml, constants, and initialization code
• Check for encryption keys and certificates

Analyzing Network Communication

• Find HTTP/HTTPS client implementations
• Identify endpoints and data being transmitted
• Check for SSL pinning and certificate validation

Understanding App Behavior

• Review manifest for permissions and components
• Trace main activity and service flows
• Identify third-party SDKs and libraries

Security Assessment

• Look for insecure data storage
• Check for proper input validation
• Identify potential attack vectors

Tips for Success

1. Start simple: Jadx works for 80% of cases
2. Use multiple tools: Different decompilers handle edge cases differently
3. Check the manifest first: It tells you what the app can do
4. Look for patterns: Obfuscated code often has telltale signs
5. Document everything: Keep track of which tool produced which output
6. Be patient: Complex apps may require multiple passes

When to Use Each Tool

Scenario	Recommended Tool
Quick inspection	Jadx
Obfuscated code	Bytecode-Viewer + multiple decompilers
Modern Java (records, var, etc.)	CFR
Runtime deobfuscation	frida-DEXdump
Windows environment	GDA
Dalvik to Java conversion	Enjarify
Fine-grained control	Krakatau
Simple JAR files	procyon or Fernflower

References

• Original decompilation guide: https://eiken.dev/blog/2021/02/how-to-break-your-jar-in-2021-decompilation-guide-for-jars-and-apks/
• Jadx: https://github.com/skylot/jadx
• CFR: https://github.com/leibnitz27/cfr
• Bytecode-Viewer: https://github.com/Konloch/bytecode-viewer/releases
• frida-DEXdump: https://github.com/hluwa/frida-dexdump