android-reverse-engineering

1# Android Reverse Engineering
2 
3Decompile Android APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower, trace call flows through application code and libraries, and produce structured documentation of extracted APIs. Two decompiler engines are supported — jadx for broad Android coverage and Fernflower for higher-quality output on complex Java code — and can be used together for comparison.
4 
5## Prerequisites
6 
7This skill requires **Java JDK 17+** and **jadx** to be installed. **Fernflower/Vineflower** and **dex2jar** are optional but recommended for better decompilation quality. Run the dependency checker to verify:
8 
9```bash
10bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.sh
11```
12 
13On Windows (PowerShell):
14```powershell
15& "${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.ps1"
16```
17 
18If anything is missing, follow the installation instructions in `${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/references/setup-guide.md`.
19 
20## Workflow
21 
22### Phase 0: Fingerprint the App (recommended before anything else)
23 
24Before installing tools or decompiling, run a fast triage to determine what
25kind of app you are looking at. **Decompiling Java is mostly useless for
26Flutter, React Native, Cordova/Capacitor, and Xamarin apps** — the real code
27lives elsewhere. The fingerprint script tells you which.
28 
29```bash
30bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/fingerprint.sh <file.apk|file.xapk>
31```
32…