skills.rest
vichhka-git
vichhka-gitCOMMUNITY
Explore all skills by this author →
GitHub

Android Reverse Engineering Workflow

Decompile Android APK, XAPK, JAR, and AAR files and extract API call information.

7|2|Updated Feb 5, 2026
Search Tags:#android#reverse engineering#mobile security#jadx#decompilation#api extraction#fernflower
One-click install
npx skills add https://github.com/vichhka-git/android-reverse-engineering-mcp-server --skill android-reverse-engineering-workflow
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Android Reverse Engineering Workflow
Source: https://github.com/vichhka-git/android-reverse-engineering-mcp-server/tree/main/docs
Command: npx skills add https://github.com/vichhka-git/android-reverse-engineering-mcp-server --skill android-reverse-engineering-workflow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the complex and time-consuming process of reverse engineering Android applications, enabling you to understand their internal workings and extract valuable API information without access to the original source code.

Core Features & Use Cases

  • Decompilation: Converts APK, XAPK, JAR, and AAR files into readable Java source code using multiple decompiler engines (jadx, Fernflower/Vineflower).
  • API Extraction: Identifies and documents Retrofit endpoints, OkHttp calls, hardcoded URLs, and authentication patterns.
  • Call Flow Tracing: Maps execution paths from UI elements to network calls, aiding in understanding app logic and security.
  • Use Case: A security researcher needs to understand how a mobile banking app handles sensitive data transmission. This Skill can decompile the app, identify all API endpoints used for transactions, and trace the flow of authentication tokens.

Quick Start

Use the Android Reverse Engineering Workflow skill to decompile the provided APK file and extract its API calls.

Frequently Asked Questions about Android Reverse Engineering Workflow

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract API endpoints from an APK file without source code?▼

To extract API endpoints from an APK file without source code, this workflow decompiles the application using jadx or Fernflower and analyzes the code structure to document Retrofit and OkHttp network calls.

What is the best way to decompile an Android app and trace its network calls?▼

The best way to decompile an Android app and trace network calls is to use an automated workflow that converts APK files into readable Java source code and maps execution paths from UI elements to network transmissions.

Does the Android reverse engineering workflow support XAPK and AAR file formats?▼

Yes, the Android reverse engineering workflow supports XAPK and AAR file formats, automatically decompiling them into readable Java source code alongside standard APK and JAR files.

Can I use jadx or Fernflower to analyze obfuscated code in mobile applications?▼

You can use jadx or Fernflower to analyze obfuscated code in mobile applications, as this workflow supports multiple decompiler engines and handles obfuscated code to facilitate reverse engineering.

How do I map the call flow from UI elements to authentication APIs in an Android app?▼

To map the call flow from UI elements to authentication APIs in an Android app, this workflow traces execution paths within the decompiled source code to identify authentication patterns and document network endpoints.

Related Skills

Explore More Software Engineering Skills→
BrownFineSecurityBrownFineSecurity
811

jadx

Decompile Android APK DEX bytecode into readable Java source code.

Official
Advanced
xtonextone
3

android-api-client

Build Android API clients with Retrofit, OkHttp, and Kotlinx Serialization.

Official
Advanced
SimoneAvogadroSimoneAvogadro
6.7k

android-reverse-engineering

Decompile Android APK, XAR JAR, and AAR files to extract HTTP API endpoints and trace call flows.

Community
Advanced
SuperlendSuperlend

firebase-apk-scanner

Detect Firebase security misconfigurations in Android APKs.

Official
Advanced