Analysis of the internal structure of mobile applications often becomes a necessity for developers, cybersecurity specialists and advanced enthusiasts. The desire to understand exactly how Instagram or Telegramworks, what permissions they request at the system level and how their logic is organized is quite natural in the world of open source software. However, the operating system Android by default hides executable files from the average user by packaging them in special containers.
The process of reviewing code is not a trivial “press one button” task, since modern applications go through the stage of obfuscation - obfuscation of code to protect against theft of intellectual property. However, there are a number of professional tools and techniques that allow you to decompile an application and restore its structure to a readable form. In this article, we will examine in detail legal ways to gain access to the internals of apps.
It is worth noting right away that to work you will need a computer with an installed set of development utilities, since powerful analyzers rarely work directly on the smartphone itself due to resource limitations and access rights. We will consider both automated solutions for beginners and manual methods for in-depth analysis of bytecode.
Preparing the environment and obtaining an APK file
The first and mandatory stage of any analysis is obtaining the application installation package in the format .apk. You cannot analyze a app that is simply installed on the system without first extracting its binary file. There are several ways to do this, ranging from using third-party file managers to the command line.
The easiest method for the average user is to use specialized extractor applications available in Google Play. Utilities such as APK Extractor or Send Anywhereallow you to create a copy of the installed application and save it to the internal memory of the device. After this, the file must be transferred to the computer for further work with desktop software.
For a more professional approach, it is recommended to use the toolkit ADB (Android Debug Bridge). This method requires you to enable USB debugging mode in the developer menu on your smartphone. By connecting the device to the PC, you can run a command to find the path to the desired application and copy it.
adb shell pm path com.example.app
adb pull /path/to/base.apk
The resulting file base.apk is the basis for all subsequent manipulations. It is important to understand that modern applications often use resource sharing (Split APKs), when the main code and resources for different screens or languages are separated into different files. In such cases, standard extractors may not cope, and you will need to use a utility adb install-multiple or specialized scripts to combine packages.
☑️ Preparing for analysis
Using online decompilers and lightweight utilities
If your goal is to quickly look at the structure of an application without installing cumbersome software, you can use online services. These tools allow you to load an APK file into your browser and gain access to decompiled Java code or application resources within minutes.
One of the most popular solutions is the service javadecompilers.com. It supports many formats and decompilation engines, including CFR, FernFlower and Procyon. The user simply drags the file into the browser window, selects the desired engine and downloads the archive with the results. This is ideal for an initial assessment of the security of an application or checking for the presence of malicious libraries.
However, online methods have significant limitations. Firstly, there are restrictions on the size of the uploaded file, usually not exceeding 50-100 MB. Secondly, uploading proprietary software to someone else’s server may violate the terms of use of the service or privacy policy if the application contains sensitive data.
⚠️ Attention: Never upload APK files of banking applications, crypto wallets or corporate software containing personal access keys or authorization tokens to online decompilers.
For local use on Windows, there are portable versions of analyzers, such as Luyten or Bytecode Viewer. They are a graphical shell over various decompilers and allow you to open files directly from your hard drive. This approach ensures greater speed and complete data confidentiality, since the entire process occurs exclusively on your device.
Use online decompilers only for open-source applications or your own projects. To analyze someone else's commercial software, always use local tools on an isolated machine.
Professional analysis through JADX and GDA
When you need a deep analysis of the application logic, searching for vulnerabilities or studying encryption algorithms, you need to turn to the heavy arsenal of reverse engineers. The leader in this area is the utility JADX, which is a Dex decompiler in Java with a graphical interface. It is capable of converting Dalvik bytecode back into readable Java source code.
The process of working with JADX-GUI is intuitive: after launching the app, you open the APK file, and the utility automatically analyzes the structure, displaying a tree of packages, classes and methods. You can search the text, view dependencies between classes and export the project to a format Gradle for further work in an IDE like Android Studio.
Another powerful tool that is gaining popularity is GDA (GDA Android Reversing Tool). Unlike JADX, which focuses on Java code, GDA provides a more detailed look at file structure, including analysis of native libraries (.so files) and work with function call graphs. This is an indispensable tool for those who study protecting applications from hacking.
| Tool | Interface type | Main function | Complexity |
|---|---|---|---|
| JADX | Graphical (GUI) | Decompilation in Java | Low |
| APKTool | Command line | Resource decompilation | Medium |
| GDA | Graphical (GUI) | Native code analysis | High |
| Bytecode Viewer | Graphical (GUI) | Multi-decompiler | Medium |
When using these tools, it is important to consider that the result decompilation will not always be a perfect copy of the original source code. The compiler optimizes the code by removing comments and changing variable names, so the reconstructed text may look a little confusing, but the logic of the app will remain unchanged.
Working with resources and manifest via APKTool
Often, not only the app code is of interest, but also application resources: images, interface layouts, string constants and configuration files. To work with this data, the industry standard utility is APKTool. It allows you to unpack the APK file into a folder with source resources in the format .xml i .smali.
Unlike JADX, which tries to recover Java code, APKTool works at the bytecode level Smali. Smali is an assembly-like representation of Dalvik code. Working with it requires certain knowledge of the architecture of the Android virtual machine, but it makes it possible not only to read, but also to modify the behavior of the application, and then assemble it back.
To get started, you need to download the JAR file of the utility and run the decompilation command in the terminal. The result will be the creation of a directory containing all the project resources. Particular attention should be paid to the file AndroidManifest.xmlwhich, when decompiled, becomes readable and shows all requested permissions, entry points and application components.
java -jar apktool.jar d application.apk -o output_folderAfter making changes to the resources or Smali code, the project can be put back together and signed with a new digital signature. However, installing a modified application on a device will require uninstalling the original version or having root access, since the signatures will not match.
What is Smali and why do you need it?
Smali is a human-readable representation of the Dalvik bytecode used in Android. Unlike Java, where code is compiled into bytecode, Smali allows you to work with this bytecode directly. This is critical for modifying applications, since Java decompilers cannot always correctly restore complex logic, and Smali editing guarantees the accuracy of the changes.
Network traffic analysis and dynamic debugging
Static code analysis shows what the app should does, but does not always reflect what it does in reality. Dynamic analysis, often involving interception of network traffic, is used to understand the application's interaction with the server. This allows you to see actual requests, API responses, and transferred data.
The most common tool for these purposes is Charles Proxy or Mitmproxy. The principle of operation is to configure the smartphone to use the computer as a proxy server. All HTTPS app traffic goes through your PC, where it can be decrypted if you install a special security certificate on the device.
The process of setting up a certificate can be non-trivial, especially on versions of Android 7.0 and above, where the system by default does not trust user certificates for system applications. In such cases, you need to have Root access and move the certificate to the system's trusted authority store.
⚠️ Attention: Intercepting traffic from encrypted connections without the knowledge of the server owner may violate data protection laws and the terms of use of the service. Use these methods only for analyzing your own applications or for educational purposes.
In addition to network analysis, advanced professionals use debuggers such as Frida. This tool allows you to inject your own Python or JavaScript scripts into the running application process. With Frida, you can change variable values, bypass license or logging checks on the fly without stopping the app.
Frequent problems and limitations in reverse engineering
Beginner researchers often encounter a situation where the decompiled code looks like a set of meaningless symbols or methods with names like a(), b(), c(). This is the result of the work of an obfuscator ProGuard or R8, which specifically rename classes and methods to complicate the analysis.
It is almost impossible to restore the original variable names in this case without access to the mapping file (mapping.txt), which only the developer. However, the logic of transitions between methods and the structure of calls are preserved, which allows you to understand the algorithm of work even without knowing the exact names of the functions.
Another problem is the use of native code (library .so), written in C or C++. Such parts of the application are not decompiled into Java and require the use of machine code-level disassemblers, such as IDA Pro or Ghidra. Analysis of assembly code requires significantly higher qualifications and understanding of the architecture of ARM processors.
It is also worth considering that some applications use anti-debugging techniques. They can detect that Frida is running, have root access, or are running in an emulator, and in response to this, block their work or provide false data. Bypassing such protections requires constant updating of knowledge and tools.
Code obfuscation is a standard security practice, and not a symptom of a virus. It makes it difficult to read the code, but does not make analysis impossible for an experienced specialist.
Is it possible to view the application code directly on your phone without a computer?
Technically, this is possible using decompiler applications available in stores, but their functionality is extremely limited. They can only show the basic structure or manifest. For a full analysis, especially of large APK files, the power of a mobile processor and the amount of RAM are not enough, so the use of a PC is mandatory.
Is it legal to decompile other people's applications?
Legislation in this area varies from country to country. In general, decompilation for purposes of compatibility, training, or security research is often allowed (fair use), but distributing decompiled code or using it to create clones of applications is a violation of copyright.
Why doesn't code after decompilation compile back into Android Studio?
Decompilers restore the logic, but lose some of the metadata needed for assemblies. Additionally, there may be library version conflicts or missing resources. Getting a working project usually requires manual modification of the Gradle configuration files and correction of syntax errors encountered during conversion.
Which code format will I see: Java or Kotlin?
Most decompilers, including JADX, produce the result as Java code. Even if the application was written in Kotlin, the decompiler will convert the bytecode into Java syntax. You can read it without problems, since the syntaxes are very similar, but specific Kotlin constructs may look less elegant.