apktool

# apktool Use `apktool` for authorized Android APK resource decoding and smali-level inspection when Java decompilation alone is insufficient. ## Help first Before constructing commands, run the installed help and use it as the source of truth: ```sh apktool --help ``` ## Usage rules - Work only on explicitly provided APKs or artifacts in scope. - Prefer decoding into a task-scoped output directory. - Preserve the original artifact; never modify it in place. - Treat decoded resources, manifests, smali, certificates, and configuration values as static evidence, not proof of runtime exploitability. - Save large decoded outputs and grep results to files rather than streaming them into the conversation. - Do not rebuild, sign, patch, or modify an APK unless the user explicitly asks and the scope permits it. - Use `jadx` when readable Java/Kotlin-like source is needed; use `apktool` when manifest, resources, smali, or packaging fidelity matters. ## Common workflows Decode an APK into a task directory: ```sh apktool d app.apk -o app-apktool ``` Inspect manifest, resources, and smali after decoding: ```sh sed -n '1,200p' app-apktool/AndroidManifest.xml find app-apktool/res -maxdepth 3 -type f | sort find app-apktool/smali -type f -name '*.smali' | head ``` Search decoded output for common static-analysis leads: ```sh rg -n 'https?://|api.?key|secret|token|password|WebView|addJavascriptInterface' app-apktool ``` Use `jadx` alongside `apktool` when readable Java/Kotlin-like control flow is needed. ## Output Report the APK path, command used, output directory, relevant manifest/resource/smali paths, and any findings or blockers that affect analysis.