crypto-recon-apk

name	crypto-recon-apk
description	Master orchestrator for Android APK reverse engineering. Fully autonomous — decompiles APK, spawns 11 parallel specialists, collects findings, writes report, reconstructs Python code. No intermediate stops. Accepts .apk/.apkm/.xapk + optional HAR.

Crypto Recon — APK Autonomous Orchestrator

Core Principle

Fully autonomous. Infer the user's goal from their initial message. Run all phases without interruption. Stop only when the goal artifact exists (Python code, report, etc).

One-time decompile: If output/[name]/java/ already has Java files, SKIP jadx/apktool — go straight to Phase 3 (parallel analysis). Decompile results are permanent.

Goal Inference (read once, never ask again)

User says	Goal	Pipeline endpoint
"cari signing" / "gimana sign"	Python signing function	reconstruct → stop
"cari crypto / encryption"	Map all crypto	report → reconstruct best
"bikin script" / "flow lengkap"	Working Python flow	reconstruct → building → stop
just provides APK	Full analysis	report → offer options

Phase 1 — Normalize Input

.apkm / .xapk bundle → extract base.apk

import zipfile, json, os
os.makedirs("output/[name]_extracted", exist_ok=True)
with zipfile.ZipFile("[file]", "r") as z:
    # Read metadata
    try:
        info = json.loads(z.read("info.json"))
        # print: app_name, pname, release_version
    except: pass
    z.extract("base.apk", "output/[name]_extracted/")
apk_path = "output/[name]_extracted/base.apk"

Print brief: Extracted: [app_name] v[version] (package: [pname])

Phase 2 — Decompile (skip if output/[name]/java/ already populated)

java_count = len(list(Path("output/[name]/java/").rglob("*.java"))) if Path("output/[name]/java/").exists() else 0
if java_count > 0:
    print(f"Cached: {java_count} Java files in output/[name]/java/ — skipping decompile")
else:
    # run decompile

jadx CLI — MUST use -cp, never -jar (jar Main-Class is GUI)

java -cp tools/bin/jadx-*.jar jadx.cli.JadxCLI \
  -d output/[name]/java \
  --no-res --show-bad-code \
  --threads-count 8 \
  output/[apk_path]

apktool — Smali + resources

java -jar tools/bin/apktool.jar d output/[apk_path] \
  -o output/[name]/smali_raw -f --no-src

Or use the Python wrapper (Windows-safe):

python tools/apk_decompile.py output/[apk_path] --name [name]

Print when done: Decompile: [N] Java files, [M] Smali files → output/[name]/

Phase 3 — PARALLEL ANALYSIS (spawn all simultaneously, no waiting)

Immediately after decompile (or cache check), spawn ALL agents in ONE parallel batch:

Agents to spawn (all at once, same message):

Agent 1 — crypto-recon-apk-java Prompt: "Scan APK Java source at output/[name]/java/ and smali at output/[name]/smali/ for all cryptographic operations. Focus on OkHttp interceptors, Retrofit, signing flows, HMAC, AES, RSA, hardcoded keys. App package: [package]. Goal: [user goal]. Return findings in structured format."

Agent 2 — crypto-recon-signing Prompt: "You are scanning decompiled Android Java source (not JS, but same string patterns apply). Scan output/[name]/java/ for ALL API request signing patterns: OkHttp interceptors, header injection, HMAC+timestamp+nonce flows, sort-params patterns, BuildConfig secrets. App: [name]. Return every signing flow found."

Agent 3 — crypto-recon-hash Prompt: "Scan output/[name]/java/ for ALL hash/digest operations. Look for MessageDigest.getInstance('MD5'/'SHA-256'/'SHA-1'), DigestUtils, custom hex functions. This is decompiled Android Java source. Return every hash operation found."

Agent 4 — crypto-recon-symmetric Prompt: "Scan output/[name]/java/ for ALL symmetric encryption. Look for Cipher.getInstance('AES/CBC/...'), SecretKeySpec, IvParameterSpec. This is decompiled Android Java source. Return every AES/DES/ChaCha operation."

Agent 5 — crypto-recon-asymmetric Prompt: "Scan output/[name]/java/ for ALL asymmetric crypto. Look for KeyFactory.getInstance('RSA'), hardcoded PUBLIC_KEY strings (BEGIN PUBLIC KEY / PKCS#8), Cipher RSA/ECB. This is decompiled Android Java source. Extract full key values."

Agent 6 — crypto-recon-mac Prompt: "Scan output/[name]/java/ for ALL MAC operations. Look for Mac.getInstance('HmacSHA256'/'HmacSHA1'/'HmacMD5'), SecretKeySpec for HMAC, doFinal(). This is decompiled Android Java source."

Agent 7 — crypto-recon-encoding Prompt: "Scan output/[name]/java/ for ALL encoding. Look for Base64.encodeToString/encode/decode (Android and java.util.Base64), bytesToHex, Integer.toHexString, hex patterns. This is decompiled Android Java source."

Agent 8 — crypto-recon-jwt-oauth Prompt: "Scan output/[name]/java/ for ALL token-based auth patterns. Look for Bearer tokens, JWT parsing/decoding, OAuth2 flows, session tokens, access/refresh token storage and refresh logic. Also look for any proprietary auth SDK (any package with 'auth', 'ciam', 'sso', 'login' in the name). This is decompiled Android Java source. Return every auth flow found."

Agent 9 — crypto-recon-libraries Prompt: "Scan output/[name]/java/ for ALL crypto and security libraries. Common ones to find: okhttp3, retrofit2, javax.crypto, com.google.crypto.tink, org.bouncycastle, at.favre.lib, com.scottyab, com.google.android.gms.safetynet. Also discover any vendor-specific security SDK (packages with 'security', 'guard', 'protect', 'vault', 'safe' in the name). List every import/dependency found with its purpose."

Agent 10 — crypto-recon-custom Prompt: "Scan output/[name]/java/ for hardcoded secrets, custom crypto, and obfuscated signing. Look for: (1) BuildConfig.java — read every field, extract KEY/SECRET/TOKEN/SALT values; (2) static final String constants with secret-like names; (3) hardcoded hex strings >16 chars in constants; (4) XOR loops doing byte manipulation; (5) any JSON/properties files in assets/ folder — read them all for embedded keys. App: [name]."

Agent 11 — crypto-recon-kdf Prompt: "Scan output/[name]/java/ for key derivation. Look for SecretKeyFactory.getInstance('PBKDF2WithHmacSHA1'), bcrypt, scrypt, Argon2, HKDF. Also check if AES keys are derived from passwords or device IDs."

Agent 12 — API Flow Mapper (always run — fastest path to "full build flow") Prompt: "You are mapping the complete API flow of an Android app to reconstruct it in Python. Scan output/[name]/java/ for: (1) ALL Retrofit service interfaces — find every @GET/@POST/@PUT/@DELETE annotated method, extract endpoint URLs, @Header/@Query/@Body/@Field parameters; (2) ALL OkHttpClient.Builder configurations — find base URLs, interceptors added, timeouts; (3) The login/auth flow — find login() / authenticate() / getToken() methods and trace the full sequence from credentials to stored token; (4) ALL API endpoint strings — grep for '/api/' paths. Return: base URL, all endpoints with HTTP method + params, auth flow sequence in order."

Agent 13 — Retrofit/API Endpoint Extractor (for building complete flow script fast) Prompt: "Scan output/[name]/java/ for ALL Retrofit API service interfaces. Find interfaces annotated with Retrofit annotations (@GET, @POST, @PUT, @DELETE, @PATCH, @HTTP). For each interface: extract the interface name, every method name, HTTP method, URL path, all parameter annotations (@Header, @Query, @Field, @Body, @Path, @QueryMap, @FieldMap). Also find the Retrofit.Builder() calls to get the baseUrl. Return a complete API catalog."

Agent 14 — Auth Chain Tracer (login → token → signed request chain) Prompt: "Trace the complete authentication chain in output/[name]/java/. Find: (1) The login entry point — what method/class handles login? What credentials go in? (2) Token storage — where is the access token stored after login? (SharedPreferences? In-memory? Encrypted?); (3) Token injection — where is the token added to requests? (OkHttp interceptor? Retrofit header?); (4) Token refresh — is there a refresh flow? What triggers it?; (5) Logout — what gets cleared? Map the full chain: login(user,pass) → [intermediate steps] → token stored → token used in header. Return the complete sequence."

Agent 15 (if HAR provided) — crypto-recon-har Prompt: "Analyze HAR file at [har_path]. Extract all API endpoints, request headers (especially signing/auth headers), request/response bodies. Find what headers the live app actually sends. Cross-reference with APK name [name]."

Phase 4 — Collect & Merge Findings

Wait for ALL agents to complete (they run in parallel, so total time = slowest agent, not sum).

Merge all findings. Deduplicate. Rank by priority:

1. SIGNING flows (highest — these are the target)
2. HMAC / MAC
3. Symmetric encryption (AES)
4. Asymmetric (RSA) / hardcoded keys
5. JWT / token flows
6. Everything else

Phase 5 — Write Report

Invoke crypto-recon-report with all merged findings.

Output: output/[name]/final/[name].md

Phase 6 — Auto-Reconstruct (no asking)

Immediately after report — DO NOT ask user which finding to reconstruct.

Select automatically:

• If SIGNING finding exists (HIGH confidence) → reconstruct it
• Else if HMAC finding exists → reconstruct it
• Else if SYMMETRIC exists → reconstruct it
• Else → reconstruct the highest-confidence finding

Invoke crypto-recon-reconstruct with the selected finding.

Output: output/[name]/final/reconstruct_[algo].py

Phase 7 — Auto-Build Flow Script (if goal requires it)

If user's goal was "bikin script" / "flow lengkap" / "complete flow": → immediately invoke crypto-recon-building with:

• All output/[name]/final/reconstruct_*.py files
• Agent 12 output: API Flow Map (base URL + login flow + endpoint catalog)
• Agent 13 output: Retrofit endpoint catalog (all HTTP methods + parameters)
• Agent 14 output: Auth chain sequence (login → token → header injection)
• Agent 15 output: HAR catalog if available

crypto-recon-building uses all four sources together to assemble the complete flow — no guessing needed.

If user's goal was just "cari signing" / "analisis": → skip building, go to Phase 8

Output: output/[name]/final/flow_[name].py

Phase 8 — Final Summary (stop here)

=== APK ANALYSIS COMPLETE ===
App:     [app_name] v[version]
Package: [package]

Java files analyzed: [N] (jadx)
Smali files:        [M] (apktool)

Top findings:
  [SIGNING HIGH]   [actual finding from analysis]
  [MAC HIGH]       [actual finding from analysis]
  [SYMMETRIC MED]  [actual finding from analysis]
  [LIBRARY]        [actual SDKs found in this APK]

Artifacts:
  Report:    output/[name]/final/[name].md
  Signing:   output/[name]/final/reconstruct_[algo].py
  Flow:      output/[name]/final/flow_[name].py  (if produced)

Next:
  "debug" → verify against live API (crypto-recon-apk-debug)
  "flow lengkap" → build complete register/login/bet flow
  "lihat [ClassName]" → read specific decompiled Java class

Error Handling

Situation	Action
jadx launches GUI	Use java -cp jadx*.jar jadx.cli.JadxCLI — NEVER java -jar
java/ already exists with files	Skip decompile, go directly to Phase 3
Agent returns no findings	Note in report as "clean", continue — don't stop pipeline
ProGuard heavy obfuscation	apk-java uses Smali as primary, web specialists still grep strings
Runtime protection SDK detected	Flag: some signing may be in native .so — note in report
Proprietary auth SDK found	Trace getAccessToken() or similar → used as Bearer/session token
Native .so found	Note in report: Ghidra/IDA needed for .so analysis
Decompile OOM	Reduce jadx threads: --threads-count 2