# Android Reverse Engineering

Decompiles APK and JAR files and extracts API endpoints and call flows.

- Repository: https://github.com/SimoneAvogadro/android-reverse-engineering-skill (8609 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-12
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add SimoneAvogadro/android-reverse-engineering-skill --skill android-reverse-engineering -g -a claude-code -y`
Codex: `npx skills add SimoneAvogadro/android-reverse-engineering-skill --skill android-reverse-engineering -g -a codex -y`
Cursor: `npx skills add SimoneAvogadro/android-reverse-engineering-skill --skill android-reverse-engineering -g -a cursor -y`
Gemini CLI: `npx skills add SimoneAvogadro/android-reverse-engineering-skill --skill android-reverse-engineering -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill`

## Description

Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints (Retrofit, OkHttp, Volley), and trace call flows from UI to network layer. Use when the user wants to decompile, analyze, or reverse engineer Android packages, find API endpoints, or follow call flows. 中文触发词：反编译APK、安卓逆向、提取API、分析安卓应用、反编译安卓、逆向工程、追踪调用链、提取接口

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Android Reverse Engineering

Decompile Android APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower, trace call flows through application code and libraries, and produce structured documentation of extracted APIs. Two decompiler engines are supported, jadx for broad Android coverage and Fernflower for higher-quality output on complex Java code, and can be used together for comparison.

## Prerequisites

This skill requires **Java JDK 17+** and **jadx** to be installed. **Fernflower/Vineflower** and **dex2jar** are optional but recommended for better decompilation quality. Run the dependency checker to verify:

```bash
bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.sh
```

On Windows (PowerShell):
```powershell
& "${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.ps1"
```

If anything is missing, follow the installation instructions in `${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/references/setup-guide.md`.

## Workflow

### Phase 0: Fingerprint the App (recommended before anything else)

Before installing tools or decompiling, run a fast triage to determine what
kind of app you are looking at. **Decompiling Java is mostly useless for
Flutter, React Native, Cordova/Capacitor, and Xamarin apps**, the real code
lives elsewhere. The fingerprint script tells you which.

```bash
bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/fingerprint.sh <file.apk|file.xapk>
```

It prints, in one screen:

The rest: https://github.com/SimoneAvogadro/android-reverse-engineering-skill/blob/HEAD/plugins/android-reverse-engineering/skills/android-reverse-engineering/SKILL.md