skills.rest
SimoneAvogadro
SimoneAvogadroCOMMUNITY
Explore all skills by this author →
GitHub

android-reverse-engineering

Decompile Android APK, XAR JAR, and AAR files to extract HTTP API endpoints and trace call flows.

6.7k|738|Updated Feb 2, 2026
Search Tags:#android#reverse engineering#jadx#apk#decompilation#api extraction#fernflower
One-click install
npx skills add https://github.com/SimoneAvogadro/android-reverse-engineering-skill --skill android-reverse-engineering
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: android-reverse-engineering
Source: https://github.com/SimoneAvogadro/android-reverse-engineering-skill/tree/main/plugins/android-reverse-engineering/skills/android-reverse-engineering
Command: npx skills add https://github.com/SimoneAvogadro/android-reverse-engineering-skill --skill android-reverse-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill allows you to decompile Android application packages (APK, XAPK, JAR, AAR) and extract valuable information like API endpoints, call flows, and app structure, even without the original source code.

Core Features & Use Cases

  • Decompilation: Convert Android packages into readable Java source code using jadx and Fernflower/Vineflower.
  • API Extraction: Identify and document HTTP API endpoints (Retrofit, OkHttp, Volley), hardcoded URLs, and authentication patterns.
  • Call Flow Tracing: Analyze the application's architecture and trace execution paths from the UI down to network calls.
  • Use Case: You need to understand how a specific feature in an Android app works, or identify the APIs it communicates with, but you don't have the source code. This Skill provides the tools to reverse engineer the app and gather this information.

Quick Start

Decompile the provided Android application package 'app-release.apk'.

Frequently Asked Questions about android-reverse-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decompile an APK to extract HTTP API endpoints?▼

Decompiling an APK to extract HTTP API endpoints involves converting Android application packages into readable Java source code using jadx and Fernflower, then identifying Retrofit, OkHttp, and Volley network calls to document the APIs. This Skill automates that entire process.

Can I reverse engineer an Android app to trace call flows without source code?▼

Yes, you can reverse engineer an Android app without source code by decompiling the APK structure and tracing execution paths from the UI down to network calls. This Skill analyzes app architecture and maps call flows automatically.

Does jadx work with XAPK, JAR, and AAR file formats?▼

Yes, jadx works with XAPK, JAR, and AAR file formats. This Skill supports decompiling all these Android application package types, converting them into readable Java source code for analysis, and extracting hardcoded URLs and authentication patterns.

What is the best way to analyze obfuscated code in an Android APK?▼

Analyzing obfuscated code in an Android APK requires decompiling the package with jadx and Fernflower/Vineflower. This Skill handles obfuscated code during decompilation, allowing you to understand app structure and extract API endpoints despite code obfuscation.

How do I extract Retrofit and OkHttp API endpoints from an Android app?▼

Extracting Retrofit and OkHttp API endpoints requires decompiling the APK to Java source code and scanning for network call patterns. This Skill identifies and documents HTTP API endpoints, hardcoded URLs, and authentication patterns automatically.

Related Skills

Explore More Software Engineering Skills→
BrownFineSecurityBrownFineSecurity
811

jadx

Decompile Android APK DEX bytecode into readable Java source code.

Official
Advanced
AcczdyAcczdy
2

testing-api-security-with-owasp-top-10

Assess REST and GraphQL API endpoints for OWASP API Security Top 10 vulnerabilities.

Community
Intermediate
ElbertePlinioElbertePlinio

http-toolkit-intercept

Capture HTTP traffic via HTTP Toolkit and correlate it with session logs.

Community
Advanced
aivos-xieaivos-xie
1

ai-reverse-engineering

Automate binary code decompilation and analysis with IDA Pro and Ghidra.

Community
Advanced