> ## Content Index
> Fetch the complete content index at: https://www.fieldnotes.wtf/llms.txt
> Use this file to discover other available public pages before exploring further.

# Reverse Engineering Android APKs
- URL: https://www.fieldnotes.wtf/reverse-engineering-android-apks/
- Published: 2023-01-24T12:00:00.000Z
- Updated: 2026-07-01T20:58:48.000Z
- Author: Zach Rogers
- Tags: notes

This is a quick reference for how I usually approach reverse engineering Android apps for the purposes of research, pentesting, bug bounty, etc. I plan to write a more in-depth guide at some point in the future.

# Installing Tools

```
sudo pacman -S android-tools jdk-openjdk jre-openjdk
paru -S android-apktool-git apk-editor-studio-bin jadx-gui-desktop burpsuite frida-tools frida python-frida-tools

```

# Configuration & Optimization

```
# Android VM optimization
sudo modprobe -r kvm_intel
sudo modprobe kvm_intel nested=1

# Confirm above optimization
grep -E --color=auto 'vmx|svm' /proc/cpuinfo

# Java VM optimization
sudo archlinux-java set java-18-openjdk
export _JAVA_OPTIONS=-Xmx6G
export _JAVA_OPTIONS=-Xmx12G

```

# Pull APK file via ADB

```
# Find APK on device (or Android VM)
adb shell pm list packages | grep <APP_NAME>

# What is the path of the APK?
adb shell pm path <APP>

# Pull a copy locally
adb pull <PATH> .

```

# Decompile APK, Java Classes

```
apktool d <APP>,apk -o out/
jadx -d out classes.dex

```

# Recompile & Zip Align APK

```
apktool b out/ --use-aapt2 -o APP_patched.apk
zipalign -p -b 4 APP_patched.apk

```

# APK Signing

```
keytool -genkey -v -keystore release.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
apksigner sign --ks release.keystore APP_patched.apk

```

# APK Install

```
adb install APP_patched.apk

```

# Make Android System Writable

```
# Emulator must have the following flag
emulator -writable-system -avd <AVD_NAME>
adb shell mount -o rw,remount,rw /system

```

# Generate & Push Android System Root Cert

```
# Generate Cert
openssl req -x509 -days 730 -nodes -newkey rsa:2048 -outform der -keyout server.key -out ca.der -extensions v3_ca -config openssl.cnf
openssl rsa -in server.key -inform pem -out server.key.der -outform der
openssl pkcs8 -topk8 -in server.key.der -inform der -out server.key.pkcs8.der -outform der -nocrypt

# Get <CERT_IDENTIFIER>
openssl x509 -inform PEM -subject_hash_old -in ca.cer | head -1

# Push cert to Android system
adb push ca.cer /system/etc/security/cacerts/<CERT_IDENTIFIER>.0

```

# Frida SSL Unpinning

```
adb push frida-server-15.1.27-android-x86 /data/local/tmp/frida-server
adb shell "chmod 755 /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server &"
wget https://raw.githubusercontent.com/httptoolkit/frida-android-unpinning/main/frida-script.js
frida --no-pause -U -l ./frida-script.js -f com.APP_NAME com.android.chrome

```

# APK Logs

```
adb logcat -c

```

`<3 Zach`