SimoneAvogadro / android-reverse-engineering-skill

2026-02-02 · Source: Github Trending: All languages · Field: Technology & Digital — Software Development & Engineering, Cybersecurity & Data Privacy, Artificial Intelligence & Machine Learning · Depth: Intermediate, quick

Summary

A new Claude Code skill enables the decompilation of Android APK, XAPK, JAR, and AAR files to extract and document HTTP APIs without requiring the original source code. This tool utilizes `jadx` and optionally `Fernflower` or `Vineflower` for decompilation, supporting single-engine or side-by-side comparisons. It identifies Retrofit endpoints, OkHttp calls, hardcoded URLs, and authentication patterns, while also tracing call flows from UI components to HTTP requests. The skill analyzes app structure, including manifests and architecture, and incorporates strategies for navigating obfuscated code produced by ProGuard/R8. It requires Java JDK 17+ and `jadx`, with `Vineflower` or `Fernflower` and `dex2jar` recommended for enhanced functionality.

Key takeaway

For security researchers or malware analysts needing to understand Android application behavior without source code, this Claude Code skill streamlines the reverse engineering process. You can quickly extract critical API endpoints, authentication methods, and call flows, which is invaluable for vulnerability assessment, interoperability analysis, or incident response. Ensure your use complies with all applicable laws and terms of service.

Key insights

Decompile Android apps to extract HTTP API details and call flows, even from obfuscated code.

Principles

• Automate API extraction from compiled Android binaries.
• Support multiple decompilation engines for robustness.

Method

The skill decompiles Android binaries using `jadx` (and optionally `Fernflower`/`Vineflower`), then analyzes the resulting source to identify API calls, authentication patterns, and trace call flows from UI components.

In practice

• Use `/decompile path/to/app.apk` for full workflow.
• Specify `--engine fernflower` for alternative decompilation.
• Run `find-api-calls.sh` on decompiled sources.

Topics

• Android Reverse Engineering
• API Extraction
• Decompilation
• jadx
• Obfuscated Code Analysis

Code references

• skylot/jadx
• Vineflower/vineflower
• JetBrains/fernflower
• pxb1988/dex2jar
• SimoneAvogadro/android-reverse-engineering-skill

Best for: AI Security Engineer, Security Engineer, Research Scientist

Related on AIssential

• MASCOT-Android: A Curated Dataset and Automated Collection Pipeline for Android Malware Source Code Specimens — Repository READMEs provide a strong, automatable signal for identifying Android malware source code, enabling scalable dataset collection.
• Turbo Pascal 3.02A, deconstructed — AI models can effectively deconstruct and interpret legacy binary executables into human-readable code.
• Claude’s code: Anthropic leaks source code for AI software engineering tool — Human error led to a significant source code leak for Anthropic's Claude Code, raising security and competitive concerns.
• Reverse engineering Claude's CVE-2026-2796 exploit — Claude Opus 4.6 demonstrated autonomous browser exploit generation, signaling advancing LLM cyber capabilities.
• RevEng.AI raises $15M to secure AI-generated software — RevEng.AI's BinNet uses binary-level AI analysis to secure software supply chains against hidden threats in compiled, AI-generated, and third-party code.
• Autoresearch Claude Code Hacker - Can It Breach My Vibecoded Site? — An AI-driven red teaming framework can autonomously test web application security and iteratively refine attack strategies.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Github Trending: All languages.