Reverse engineering of mobile applications is a complex but extremely useful skill for developers, security specialists and analysts. Often there is a need to understand how someone else's application works, find vulnerabilities, or simply study the implementation of interesting functionality. Android Studiobeing the main development environment for the platform, it provides powerful tools that can be adapted for decompilation tasks.
The process of turning a compiled binary file .apk back into readable source code is not a trivial task. The compiler optimizes the code, removes unnecessary symbols and converts the logic into bytecode, which is executed by the virtual machine Dalvik or ART. However, modern tools make it possible to reconstruct the project structure with high accuracy. In this article, we will look at how to set up the environment and what plugins to use to work effectively.
It is important to understand that decompiling other people's applications may violate license agreements and copyright laws. Use the acquired knowledge exclusively for educational purposes, for auditing the security of your own products or analyzing malware in an isolated environment. Decompilation does not restore the source code one to one: comments, variable names and file structure are often lost forever.
Preparing a working environment and installing plugins
Before you begin the analysis, you need to make sure that your development environment is ready to work with binary files. The standard installation Android Studio does not always include all the necessary components for convenient viewing of decompiled code out of the box, although the basic functionality is present. For professional analysis, you will need to install specialized plugins that greatly simplify code navigation.
The most popular and reliable solution is the integration of a decompiler JADX. This tool allows you to view code directly from APK files, supporting search across the entire project and navigation between classes. Installation is done through the built-in plugin manager: go to the menu File → Settings → Plugins (or Android Studio → Preferences on macOS) and enter "JADX" in the search.
After finding the plugin, click the button Install and restart the development environment. Without this step, you will be limited to only a basic view of the bytecode, which is extremely inconvenient for deep analysis of the application logic. Also make sure you have the latest version Android SDK Build-Toolsas some command line utilities depend on specific versions of the build tools.
If the JADX plugin does not appear in the search, check whether the version of your Android Studio is compatible with the version of the plugin. Sometimes you need to manually install the plugin archive via the "Install Plugin from Disk" button.
In addition to JADX, it is worth paying attention to plugins for syntax highlighting and resource analysis. Some extensions allow you to visualize method call graphs, which is critical when studying confusing code. Having the right set of tools reduces the time to prepare for analysis from hours to several minutes.
Methods for importing an APK file into a project
There are several ways to load the target file into the development environment. The method you choose depends on your goals: do you just need to quickly look at the code, or do you plan to modify the application and build it again. The easiest way is to use the "Profile or Debug APK" function, which is built into the file menu.
To do this, select in the top menu File → Profile or Debug APK and specify the path to your file .apk. Android Studio will automatically unpack the archive, parse the manifest and open a window with the project structure. In the left panel you will see sections Manifest, Java, Resources and others. This is an ideal option for a quick audit without creating a full-fledged project.
- 📂 The direct opening method allows you to instantly see the structure without setting up Gradle.
- 🔍 The built-in resource viewer displays XML layouts and strings in a readable form.
- ⚡ Debugging is possible immediately if the mode is enabled on the device developer.
The second method involves creating a new project and manually adding the APK as a dependency module or source code. This approach is more labor intensive, but gives complete control over the assembly process. You can change the configuration build.gradle, add your libraries and try to compile a modified version of the application.
When importing, you should consider the file size. Heavy games or applications with a large number of native libraries can take a long time to be indexed. During the indexing process, the development environment analyzes all classes and resources, creating a database for quick searching. Interrupting this process may result in incorrect code navigation.
Analysis of project structure and resources
After successfully downloading the file, the project tree will open in front of you. The main attention should be paid to the file AndroidManifest.xml. This is where all application components are described: activities, services, BroadcastReceiver and content providers. Analyzing the manifest allows you to understand the application architecture and entry points.
Pay attention to permissions (uses-permission) that the application requests. An excessive list of permissions often indicates suspicious activity or poor code optimization. The manifest also specifies the minimum and target versions of the SDK, which is important for understanding compatibility and the APIs used.
| Component | Description | Where to look |
|---|---|---|
| Activity | Application interface screens | Manifest / Java code |
| Service | Background processes without an interface | Manifest / Java code |
| Receiver | Reaction to system events | Manifest (intent-filter) |
| Provider | Access to data for other applications | Manifest / ContentProvider |
Application resources are stored in folder res. Here you can find interface layouts (layout), string constants (values/strings.xml), images and styles. Decompiled layouts may differ from the original XML files as the compiler aapt optimizes them for quick reading by the system. However, the structure (View Hierarchy) is usually preserved well enough to understand the logic of the interface.
You can use the built-in viewer of Android Studio to analyze graphics and other binary resources. Double clicking on an image file will open its preview. If resources are encrypted or packaged in non-standard formats (for example, inside a folder assets), you will need third-party scripts to extract and decrypt them.
⚠️ Warning: Some applications use resource obfuscation techniques by changing their names to meaningless character sets (for example,a.b.cinsteadlogin_screen). This significantly complicates the analysis of the interface.
Working with decompiled code and navigation
The heart of any analysis is the study of Java or Kotlin code. Android Studio will display the decompiled code of the classes in the editor window. The quality of reconstruction depends on the level of obfuscation. If the developer used ProGuard or R8 Without saving mapping files, the names of classes and methods will be replaced with unreadable sequences.
Navigation through the code is carried out using standard IDE tools. Use the keyboard shortcut Ctrl+B (or Cmd+B on Mac) to jump to the declaration of a method or class. The function Find Usages (Alt+F7) will show all the places where the selected element is used. This is an indispensable tool for tracking the flow of data within an application.
Text search (Ctrl+Shift+F) allows you to find specific strings, URLs, encryption keys or error logs throughout the project. When searching, keep in mind that strings can be encrypted or assembled dynamically from parts, which makes them difficult to detect with a simple text search.
☑️ Code analysis checklist
Reading decompiled code requires experience. Loops for can be converted into constructs while, and anonymous classes into separate files with strange names. The logic of working with asynchronous tasks (for example, RxJava or Coroutines) after compilation often turns into complex state machines that are difficult to read without understanding the principles of the compiler.
Obfuscation problems and methods for circumventing them
Obfuscation is the main enemy of the reverse engineer. Tools like ProGuard i R8 not only rename elements, but also remove unused code, inline methods, and change the control flow structure. As a result, the decompiled code may look like a bunch of disjointed instructions.
To combat this, there are deobfuscation tools. For example, some online services and local utilities attempt to recover original class names based on heuristic analysis or leaked name databases. However, there is no guaranteed way to completely restore the source code without a file. mapping.txt does not exist.
Sometimes analyzing lines of code helps. Even if method names are hidden, string literals (text inside quotes) often remain readable. From them you can understand the purpose of the method. For example, a method a.bthat contains a string "SELECT * FROM users"is most likely working with the database.
⚠️ Warning: Using automatic deobfuscators can lead to errors in the code. Always double-check the logic manually, especially in critical areas responsible for security or payments.
In complex cases, dynamic analysis is used. By running the application in the debugger, you can see the real values of the variables and the call stack at the time of execution. This allows you to understand the logic of the work, even if static code analysis is difficult due to strong protection.
Code export and further processing
After analysis, there is often a need to save the results. Android Studio allows you to export decompiled code to a Gradle project format. This can be done through the menu File → Export → Export to Gradle Project (availability depends on the plugin version and import type).
The exported project can be opened in a separate window, modified and attempted to be assembled. However, successful build is a rare case for third-party applications. You will have to fix dependencies, sign the application with your key, and resolve library version conflicts.
To save reports on vulnerabilities or interesting code fragments, it is better to use snippets or export to PDF/HTML directly from the IDE interface. The code formatting will remain the same, which is convenient for demonstrating to colleagues or documenting findings.
Is it possible to build the modified application?
Theoretically yes, but in practice you will encounter signature verification. System applications or applications protected by the Integrity API (SafetyNet/Play Integrity) will not launch with a changed signature. For testing purposes, you can disable checks, but for production this is almost impossible without access to the developer's original key.
Do not forget about the cleanliness of the workspace. Decompiled projects take up a lot of disk space. After completing your research, delete temporary files and indexes so as not to slow down Android Studio in the future.
Frequently asked questions (FAQ)
Is it possible to decompile an application protected by native code (C/C++)?
Android Studio only shows the Java/Kotlin part. To analyze native libraries (.so files), you will need to use disassemblers like IDA Pro or Ghidra. In Android Studio, you will only see method calls through JNI.
Why does the code look different from original Java?
The compiler converts the code into bytecode, and the decompiler tries to reconstruct it back. This process is not ideal: syntactic sugar (for example, lambda expressions) is expanded into anonymous classes, and loops can change the structure.
Is it legal to decompile applications from Google Play?
In most cases, this violates the terms of use of the service and the application's license agreement. Exceptions include cases of malware analysis, security research, or training under your country's copyright laws.
How to open a .dex file directly?
The files .dex are located inside an APK. It is better to open the APK itself via File → Profile or Debug APK. If you only need to work with dex, use the JADX plugin or convert dex to jar using the utility d2j-dex2jar.
What should you do if Android Studio crashes when opening a large APK?
Increase the amount of RAM allocated to the IDE. Edit the file studio.vmoptions and change the parameter -Xmx (for example, to -Xmx4096m). Also disable unnecessary plugins.