Analysis of the structure of mobile apps is becoming an increasingly important task for developers, cybersecurity specialists and curious enthusiasts. The desire to look “under the hood” is often dictated by the need to understand the logic of the software, find vulnerabilities, or simply learn from someone else’s programming experience. However, the operating system by its nature hides the source code from the eyes of the average user, distributing apps in the form of compiled packages. Android by its nature, hides the source code from the eyes of the average user by distributing apps in the form of compiled packages.
The decompilation process allows you to turn obscure machine code back into a readable format close to the language Java or Kotlin. This opens access to the resources, manifest, and operating logic of the components. It is important to immediately understand the difference between viewing finished bytecode and accessing the original sources, which developers usually keep secret. We will look at the legal and technical aspects of how you can study the internal structure of installed software.
There are several ways to implement this task, ranging from using specialized software on a computer to mobile utilities directly on the device. The choice of a specific method depends on your goals: do you need a deep analysis of the logic or is it enough to just look at the list of permissions and components. In any case, you will need certain technical knowledge and a set of tools.
Preparing the environment and obtaining the APK file
The first step towards analysis is to obtain the installation file itself. Standard application stores, such as Google Play, do not provide direct access to downloading installation packages in open form. You will need to extract .apk the file from the system or download it from third-party verified repositories. To extract already installed apps, you can use file managers with a backup function.
If an application is already installed on your device, its installation package is usually stored in the system partition /data/app/. Access to this directory without superuser rights (root) is closed to regular applications. Therefore, the simplest solution would be to use extractor utilities that copy the installed package to a folder accessible to the user, for example, to Download.
⚠️ Attention: Download APK files only from trusted sources. Modified packages may contain malicious code that will compromise the security of your device and personal data.
After receiving the file, make sure that it is not damaged and matches the version of the app you want to investigate. Sometimes developers use technology App Bundlethat divides the application into several parts (base module, screen configurations, language packs). In this case, you will need a special tool to combine these parts into a single installation file before starting the analysis.
To work with the extracted files on your computer, create a separate folder with a clear name. This will help avoid confusion, especially if you plan to analyze several different apps at the same time. The project structure will contain many generated files, so the order in the working directory is critical.
Using decompilers on a personal computer
The most powerful and functional analysis method is the use of professional software on a PC. The leader in this area is the utility JADX, which allows you to view code in a convenient graphical interface. It automatically decompiles bytecode Dalvik to readable Java code, preserving the structure of packages and classes. This is the best choice for those who want to understand the logic of the application.
The process of working with JADX-GUI is extremely simple: just drag the APK file into the app window. In a few seconds you will have access to all classes, methods and string resources. You can search for specific keywords, track function calls and export the project to Gradle format for further study in the environment Android Studio.
An alternative option is to use online services that perform decompilation on their servers. This is convenient if you do not have the opportunity to install the software on your computer, but it is less secure, since you are uploading someone else’s (or your private) code to a third-party resource. Local processing on your computer ensures data privacy.
Use JADX's Search String feature to quickly find specific error messages, server URLs, or API keys hidden in the code.
In addition to viewing the code, decompilers allow you to analyze the file AndroidManifest.xml. This document contains important information about permissions, entry points, registered services, and broadcast recipients. Understanding the manifest gives you an idea of what system components the application uses and how it interacts with the environment.
Mobile tools for analysis directly on your smartphone
It is not always possible to use a computer. Fortunately, the ecosystem Android allows you to perform basic code analysis directly on your mobile device. For this, there are special decompiler applications, such as JADX (mobile version) or MT Manager. These tools work slower than their desktop counterparts due to hardware limitations, but are quite capable of viewing the structure.
Applications like MT Manager provide advanced functionality, including the ability to edit resources and even modify code (with subsequent re-signing). This is a powerful reverse engineering machine that requires a certain level of training. The interface may seem complicated to a beginner, but it opens up access to deep customization of application parameters.
- 📱 JADX Mobile - a simple code viewer with convenient search and navigation through classes.
- 🛠️ MT Manager - a combine for managing APKs, editing XML and working with DEX files.
- 🔍 ApkTool M - a tool for disassembling and assembling applications with support plugins.
When working on a smartphone, it is important to consider the amount of RAM. Decompiling heavy applications with many libraries may cause the device to freeze or force the tool to close. It is recommended to close background processes before starting the analysis to free up system resources for calculations.
☑️ Check before starting the decompiler
Analysis using Android Studio and debugging
For professional developers, the environment Android Studio is the main tool. It allows you not only to statically study the code, but also to conduct dynamic analysis. By connecting the device via USB and enabling debugging, you can attach to a running process, view the call stack in real time and analyze variables.
Tool Profiler as part of the studio makes it possible to monitor the use of the processor, memory and network. This helps identify unobvious performance issues or suspicious activity, such as hidden data being sent to the server. Dynamic analysis is often more effective than static analysis because it allows you to see code that is loaded or generated only at runtime.
Using a debugger requires USB debugging rights. In the developer menu, you need to activate the item USB Debugging. When connected to a computer, a request to confirm the RSA key will appear on the smartphone screen, which must be accepted. Without this step, the development environment will not be able to establish a connection with the device.
⚠️ Warning: Never enable USB debugging on unfamiliar computers or public charging stations. This can give attackers complete control over your device.
The IDE allows you to set breakpoints in decompiled code. When the app execution reaches this line, the process will pause, and you will be able to examine in detail the state of the system at that particular moment. This is an indispensable method for understanding encryption algorithms or checking licenses.
Working with the command line and ADB
The utility Android Debug Bridge (ADB)is often used to automate processes and script data processing. This is a console tool that allows you to control the device from your computer. With its help, you can extract files, install packages, get system logs and execute shell commands directly on the device.
One of the useful commands is to get the path to an installed application by its package name. This allows you to quickly find the location of the APK file on the system without using third-party file managers. The command returns the full path, which can then be used to copy the file to your computer.
adb shell pm path com.example.appAlso through ADB, you can take screenshots (screenshots) of a running application or record video from the screen, which is useful for documenting bugs or analyzing the visual part of the interface. System logs received via logcat, often contain valuable information about errors and internal processes that are not visible in the user interface.
Secret command to get all installed packages
The 'adb shell pm list packages' command will display a complete list of all installed applications on the device, including system ones. Add the '-3' flag to see only custom applications.
Advanced users can use ADB to install modified versions of applications, replacing the original files. However, this requires disabling signature verification or using special patches, which goes beyond basic configuration and falls into the realm of modding.
Legal Considerations and Ethics of Reverse Engineering
Most commercial application license agreements (EULA) expressly prohibit decompiling, disassembling, and reverse engineering of software. Violation of these terms may result in legal liability.
Legal exceptions exist, for example to ensure software compatibility or conduct security research. In some jurisdictions, copyright laws allow reverse engineering for educational purposes or to fix critical vulnerabilities as long as it does not interfere with the normal use of the product.
| Type of Analysis | Purpose | Risks | Legality |
|---|---|---|---|
| Educational | Studying code patterns | Low | Conditionally allowed |
| Security | Searching for viruses and vulnerabilities | Medium | Allowed (White Hat) |
| Commercial | Copying functionality | High | Prohibited |
| Modding | Changing the behavior of the game/application | High (ban) | Violation of EULA |
If you plan to publish the results of your analysis, be careful about disclosing sensitive information. Publishing private keys, API tokens, or server addresses can harm developers and users. Always follow the principles of Responsible Disclosure.
Reverse engineering is legal only as part of security research or training. Copying code to create clones of applications is a violation of copyright.
Frequent questions and problems during analysis
Why does the code look confusing and contain strange names?
Developers use obfuscation (for example, ProGuard or R8) to protect their code. This process replaces meaningful class and method names with meaningless sets of characters (a, b, c) to make parsing difficult. It is impossible to completely restore the original names without an obfuscation map.
Is it possible to get the original code in Java or Kotlin?
No, you get decompiled code, which is a reconstruction. It may contain errors, unnecessary constructs, or differ from the source text written by the programmer. The operating logic is preserved, but the syntax may not be ideal.
Is it safe to run the analyzed application?
If you have modified the application (changed the code or signatures), it may not be safe to launch it. The modified application will not pass integrity checks in some services (for example, banking) and may be blocked. Always test such versions on a standalone device or emulator.
Why do you need the AndroidManifest.xml file?
This is the application passport. It describes all the permissions that the app requests, interface components, services and entry points. Analyzing the manifest often provides more information about the application's capabilities than looking at the code itself.
What to do if the decompiler gives an error when opening an APK?
The file may be damaged, encrypted, or use non-standard packaging. Try using a different version of the decompiler or running the file through a alignment utility (zipalign) first. Sometimes renaming the file extension helps.