yv1ing/z3r0/apktool

apktool

Use apktool for authorized Android APK resource decoding and smali-level inspection when Java decompilation alone is insufficient.

Help first

Before constructing commands, run the installed help and use it as the source of truth:

apktool --help

Usage rules

• Work only on explicitly provided APKs or artifacts in scope.
• Prefer decoding into a task-scoped output directory.
• Preserve the original artifact; never modify it in place.
• Treat decoded resources, manifests, smali, certificates, and configuration values as static evidence, not proof of runtime exploitability.
• Save large decoded outputs and grep results to files rather than streaming them into the conversation.
• Do not rebuild, sign, patch, or modify an APK unless the user explicitly asks and the scope permits it.
• Use jadx when readable Java/Kotlin-like source is needed; use apktool when manifest, resources, smali, or packaging fidelity matters.

Common workflows

Decode an APK into a task directory:

apktool d app.apk -o app-apktool

Inspect manifest, resources, and smali after decoding:

sed -n '1,200p' app-apktool/AndroidManifest.xml
find app-apktool/res -maxdepth 3 -type f | sort
find app-apktool/smali -type f -name '*.smali' | head

Search decoded output for common static-analysis leads:

rg -n 'https?://|api.?key|secret|token|password|WebView|addJavascriptInterface' app-apktool

Use jadx alongside apktool when readable Java/Kotlin-like control flow is needed.

Output

Report the APK path, command used, output directory, relevant manifest/resource/smali paths, and any findings or blockers that affect analysis.