SimoneAvogadro/android-reverse-engineering-skill: Claude Code skill to support Android app's reverse engineering
github.com | tool | #open-source | #claude-code | #security-tool | #android | #reverse-engineering | #mobile-security | #api-extraction | #tooling | #api-discovery
Summary
A Claude Code skill for Android reverse engineering: decompiles APK/XAPK/JAR/AAR files and extracts HTTP APIs—Retrofit, OkHttp, Ktor, Apollo—recovering Kotlin class names from R8-obfuscated builds.
- Collected
📦 Full-Text Content Snapshot
R2 Archive · Full Article Preserved
Source: github.com/SimoneAvogadro/android-reverse-engineering-skill
A Claude Code skill that decompiles Android APK/XAPK/JAR/AAR files and extracts the HTTP APIs used by the app — Retrofit endpoints, OkHttp calls, hardcoded URLs, authentication patterns — so you can document and reproduce them without the original source code.
First-class Kotlin support: modern Android apps are Kotlin/KMP, heavily obfuscated with R8. This skill recovers the original Kotlin class names from metadata R8 cannot strip, and extracts APIs from Ktor, Apollo (GraphQL) and Koin — not just the classic Retrofit/OkHttp stack. See Kotlin name recovery below.
Windows / PowerShell support (experimental): The
*.ps1scripts alongside the bash ones are a recent community contribution, still being stabilised. For any issues please open an issue on this repository (not on the contributors' upstream forks): the PowerShell scripts are maintained here by @SimoneAvogadro.
Table of Contents
- What it does
- Requirements
- Installation
- Usage
- Repository Structure
- References
- Acknowledgments
- Disclaimer
- License
What it does
| Capability | Description |
|---|---|
| Fingerprint first (Phase 0) | Triage an APK/XAPK in seconds — detect the framework (Flutter / React Native / Cordova / Xamarin / native-Kotlin), HTTP stack, obfuscation level and native libs before spending time on a full decompile |
| Decompile | APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower (single engine or side-by-side comparison) |
| Recover Kotlin names | Rebuild original *Repository / *ViewModel / *UseCase class names from R8-obfuscated binaries using Kotlin metadata that R8 cannot strip |
| Extract APIs | Retrofit, OkHttp, Volley and modern Kotlin/KMP stacks: Ktor, Apollo (GraphQL), Koin DI — endpoints, hardcoded URLs, auth headers, tokens and HMAC request-signing schemes |
| Trace call flows | From Activities/Fragments through ViewModels and repositories down to HTTP calls |
| Analyze structure | Manifest, packages, architecture patterns |
| Handle obfuscation | R8-resistant path/URL extraction plus strategies for navigating ProGuard/R8 output |
Requirements
Required:
- Java JDK 17+
- jadx (CLI)
Optional (recommended):
- Vineflower or Fernflower — better output on complex Java code
- dex2jar — needed to use Fernflower on APK/DEX files
See plugins/android-reverse-engineering/skills/android-reverse-engineering/references/setup-guide.md for detailed installation instructions.
Installation
From GitHub (recommended)
Inside Claude Code, run:
/plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill
/plugin install android-reverse-engineering@android-reverse-engineering-skillThe skill will be permanently available in all future sessions.
From a local clone
git clone https://github.com/SimoneAvogadro/android-reverse-engineering-skill.gitThen in Claude Code:
/plugin marketplace add /path/to/android-reverse-engineering-skill
/plugin install android-reverse-engineering@android-reverse-engineering-skillUsage
Ask Claude to analyze an Android binary or decompile output. The skill triggers automatically on prompts like:
- "Decompile this APK and show me all the API endpoints it calls"
- "Triage this APK first — tell me what framework it uses and if it has native libs"
- "The code is obfuscated with R8 — recover the Kotlin class names so I can understand the architecture"
- "Find the authentication flow and any API keys in this app"
- "Extract the GraphQL queries and Apollo operations from this APK"
- "Trace how user login works in this app from the UI to the network request"
Claude will follow a 6-phase workflow:
- Phase 0 — Fingerprint: Inspects the zip structure before decompilation. Detects the framework, HTTP clients, native libraries (
.so), obfuscation state, and flags anti-reversing tricks. - Phase 1 — Decompile: Decompiles the target using jadx, Fernflower, or both. Handles DEX split archives, resource extraction, and multi-dex layouts.
- Phase 2 — API Extraction: Scans decompiled sources for HTTP endpoints, base URLs, auth headers, query parameters, and API keys across Retrofit, OkHttp, Ktor, and Apollo GraphQL.
- Phase 3 — Call Flow Analysis: Traces execution paths from entrypoints (Activities, BroadcastReceivers, Services) down to network calls.
- Phase 4 — Architectural Analysis: Maps component interactions, dependency injection trees (Dagger, Hilt, Koin), and data flow.
- Phase 5 — Deobfuscation Support: Recovers obfuscated symbols, maps synthetic lambda names, and tracks renamed methods across interfaces.
Slash Commands
The plugin provides a dedicated /decompile slash command:
/decompile app.apk
/decompile app.apk --engine fernflower
/decompile app.apk --output /path/to/outputKotlin Name Recovery (R8 Deobfuscation)
R8 renames classes to short names (a.b.c), but Kotlin metadata encoded in @kotlin.Metadata retains original class signatures unless explicitly stripped:
# Recover names from decompiled output
bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/recover-kotlin-names.sh output/sources/ output/names/
# Query the recovered name map
bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/lookup-name.sh output/names/ -o a.b.c
bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/lookup-name.sh output/names/ --grep 'login' output/sources/Repository Structure
android-reverse-engineering-skill/
├── .claude-plugin/
│ └── marketplace.json # Marketplace catalog
├── plugins/
│ └── android-reverse-engineering/
│ ├── .claude-plugin/
│ │ └── plugin.json # Plugin manifest
│ ├── skills/
│ │ └── android-reverse-engineering/
│ │ ├── SKILL.md # Core workflow (Phase 0–5)
│ │ ├── references/
│ │ │ ├── setup-guide.md
│ │ │ ├── jadx-usage.md
│ │ │ ├── fernflower-usage.md
│ │ │ ├── api-extraction-patterns.md
│ │ │ ├── kotlin-name-recovery.md
│ │ │ ├── third_party_hosts.txt # denylist for first/third-party bucketing
│ │ │ └── call-flow-analysis.md
│ │ └── scripts/
│ │ ├── check-deps.sh # Bash
│ │ ├── check-deps.ps1 # PowerShell
│ │ ├── install-dep.sh
│ │ ├── install-dep.ps1
│ │ ├── decompile.sh
│ │ ├── decompile.ps1
│ │ ├── fingerprint.sh # Phase 0 — pre-decompile triage
│ │ ├── recover-kotlin-names.sh # R8 → real Kotlin class names
│ │ ├── lookup-name.sh # query the recovered name map
│ │ ├── find-api-calls.sh
│ │ └── find-api-calls.ps1
│ └── commands/
│ └── decompile.md # /decompile slash command
├── LICENSE
└── README.mdReferences
- jadx — Dex to Java decompiler
- Fernflower — JetBrains analytical decompiler
- Vineflower — Fernflower community fork
- dex2jar — DEX to JAR converter
- apktool — Android resource decoder
Acknowledgments
Thanks to the contributors who have shaped this skill:
- @tajchert — Phase 0 fingerprinting, R8-resistant Kotlin name recovery (
recover-kotlin-names.sh,lookup-name.sh), and Ktor / Apollo / Koin / HMAC extraction patterns (#16) - @philjn — Native Windows / PowerShell support (
check-deps.ps1,install-dep.ps1,decompile.ps1,find-api-calls.ps1) and split/bundled APK detection indecompile.sh(#8) - @txhno — Migration to the maintained
ThexXTURBOXx/dex2jarfork (#12) - @muqiao215 — Decompile partial-success handling, Fernflower timeout safeguard, intermediate-artifact directory (#10)
- @kevinaimonster — Chinese localization (
SKILL.mddiscovery keywords) (#4)
Disclaimer
This plugin is provided strictly for lawful purposes, including but not limited to:
- Security research and authorized penetration testing
- Interoperability analysis permitted under applicable law (e.g., EU Directive 2009/24/EC, US DMCA §1201(f))
- Malware analysis and incident response
- Educational use and CTF competitions
You are solely responsible for ensuring that your use of this tool complies with all applicable laws, regulations, and terms of service. Unauthorized reverse engineering of software you do not own or do not have permission to analyze may violate intellectual property laws and computer fraud statutes in your jurisdiction.
License
Apache 2.0 — see LICENSE.
The decompilers and other tools this plugin drives (jadx, Vineflower/Fernflower, dex2jar, Apktool, adb, Java) are third-party software, not bundled with the plugin and distributed under their own licenses.
📦 Full-Text Markdown Snapshot archived by Phying News · Original source: github.com/SimoneAvogadro/android-reverse-engineering-skill
--- id: 7269 canonical_url: "https://phying.com/item/7269" title: "SimoneAvogadro/android-reverse-engineering-skill: Claude Code skill to support Android app's reverse engineering" type: "tool" cve: null cvss: null severity: "unknown" vendor: null product: "android-reverse-engineering-skill" affected_versions: null source_domain: "github.com" source_url: "https://github.com/SimoneAvogadro/android-reverse-engineering-skill" published_at: null snapshot_at: "2026-10-26T06:01:00Z" archived_by: "Phying News (https://phying.com/item/7269)" lang: "en" --- # Android Reverse Engineering & API Extraction — Claude Code skill [](https://opensource.org/licenses/Apache-2.0) [](https://github.com/SimoneAvogadro/android-reverse-engineering-skill/stargazers) [](https://github.com/SimoneAvogadro/android-reverse-engineering-skill/commits/master) *Source: [github.com/SimoneAvogadro/android-reverse-engineering-skill](https://github.com/SimoneAvogadro/android-reverse-engineering-skill)* A Claude Code skill that decompiles Android APK/XAPK/JAR/AAR files and **extracts the HTTP APIs** used by the app — Retrofit endpoints, OkHttp calls, hardcoded URLs, authentication patterns — so you can document and reproduce them without the original source code. > **First-class Kotlin support**: modern Android apps are Kotlin/KMP, heavily obfuscated with R8. This skill recovers the **original Kotlin class names** from metadata R8 cannot strip, and extracts APIs from **Ktor**, **Apollo (GraphQL)** and **Koin** — not just the classic Retrofit/OkHttp stack. See [Kotlin name recovery](#kotlin-name-recovery-r8-deobfuscation) below. > **Windows / PowerShell support (experimental)**: The `*.ps1` scripts alongside the bash ones are a recent community contribution, still being stabilised. For any issues please open an issue on **this** repository (not on the contributors' upstream forks): the PowerShell scripts are maintained here by [@SimoneAvogadro](https://github.com/SimoneAvogadro). ## Table of Contents - [What it does](#what-it-does) - [Requirements](#requirements) - [Installation](#installation) - [Usage](#usage) - [Repository Structure](#repository-structure) - [References](#references) - [Acknowledgments](#acknowledgments) - [Disclaimer](#disclaimer) - [License](#license) ## What it does | Capability | Description | | --- | --- | | **Fingerprint first (Phase 0)** | Triage an APK/XAPK in seconds — detect the framework (Flutter / React Native / Cordova / Xamarin / native-Kotlin), HTTP stack, obfuscation level and native libs *before* spending time on a full decompile | | **Decompile** | APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower (single engine or side-by-side comparison) | | **Recover Kotlin names** | Rebuild original `*Repository` / `*ViewModel` / `*UseCase` class names from R8-obfuscated binaries using Kotlin metadata that R8 cannot strip | | **Extract APIs** | Retrofit, OkHttp, Volley **and modern Kotlin/KMP stacks: Ktor, Apollo (GraphQL), Koin DI** — endpoints, hardcoded URLs, auth headers, tokens and HMAC request-signing schemes | | **Trace call flows** | From Activities/Fragments through ViewModels and repositories down to HTTP calls | | **Analyze structure** | Manifest, packages, architecture patterns | | **Handle obfuscation** | R8-resistant path/URL extraction plus strategies for navigating ProGuard/R8 output | ## Requirements **Required:** - Java JDK 17+ - [jadx](https://github.com/skylot/jadx) (CLI) **Optional (recommended):** - [Vineflower](https://github.com/Vineflower/vineflower) or [Fernflower](https://github.com/JetBrains/fernflower) — better output on complex Java code - [dex2jar](https://github.com/ThexXTURBOXx/dex2jar) — needed to use Fernflower on APK/DEX files See `plugins/android-reverse-engineering/skills/android-reverse-engineering/references/setup-guide.md` for detailed installation instructions. ## Installation ### From GitHub (recommended) Inside Claude Code, run: ```bash /plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill /plugin install android-reverse-engineering@android-reverse-engineering-skill ``` The skill will be permanently available in all future sessions. ### From a local clone ```bash git clone https://github.com/SimoneAvogadro/android-reverse-engineering-skill.git ``` Then in Claude Code: ```bash /plugin marketplace add /path/to/android-reverse-engineering-skill /plugin install android-reverse-engineering@android-reverse-engineering-skill ``` ## Usage Ask Claude to analyze an Android binary or decompile output. The skill triggers automatically on prompts like: - *"Decompile this APK and show me all the API endpoints it calls"* - *"Triage this APK first — tell me what framework it uses and if it has native libs"* - *"The code is obfuscated with R8 — recover the Kotlin class names so I can understand the architecture"* - *"Find the authentication flow and any API keys in this app"* - *"Extract the GraphQL queries and Apollo operations from this APK"* - *"Trace how user login works in this app from the UI to the network request"* Claude will follow a 6-phase workflow: - **Phase 0 — Fingerprint**: Inspects the zip structure before decompilation. Detects the framework, HTTP clients, native libraries (`.so`), obfuscation state, and flags anti-reversing tricks. - **Phase 1 — Decompile**: Decompiles the target using jadx, Fernflower, or both. Handles DEX split archives, resource extraction, and multi-dex layouts. - **Phase 2 — API Extraction**: Scans decompiled sources for HTTP endpoints, base URLs, auth headers, query parameters, and API keys across Retrofit, OkHttp, Ktor, and Apollo GraphQL. - **Phase 3 — Call Flow Analysis**: Traces execution paths from entrypoints (Activities, BroadcastReceivers, Services) down to network calls. - **Phase 4 — Architectural Analysis**: Maps component interactions, dependency injection trees (Dagger, Hilt, Koin), and data flow. - **Phase 5 — Deobfuscation Support**: Recovers obfuscated symbols, maps synthetic lambda names, and tracks renamed methods across interfaces. ### Slash Commands The plugin provides a dedicated `/decompile` slash command: ```bash /decompile app.apk /decompile app.apk --engine fernflower /decompile app.apk --output /path/to/output ``` ### Kotlin Name Recovery (R8 Deobfuscation) R8 renames classes to short names (`a.b.c`), but Kotlin metadata encoded in `@kotlin.Metadata` retains original class signatures unless explicitly stripped: ```bash # Recover names from decompiled output bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/recover-kotlin-names.sh output/sources/ output/names/ # Query the recovered name map bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/lookup-name.sh output/names/ -o a.b.c bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/lookup-name.sh output/names/ --grep 'login' output/sources/ ``` ## Repository Structure ``` android-reverse-engineering-skill/ ├── .claude-plugin/ │ └── marketplace.json # Marketplace catalog ├── plugins/ │ └── android-reverse-engineering/ │ ├── .claude-plugin/ │ │ └── plugin.json # Plugin manifest │ ├── skills/ │ │ └── android-reverse-engineering/ │ │ ├── SKILL.md # Core workflow (Phase 0–5) │ │ ├── references/ │ │ │ ├── setup-guide.md │ │ │ ├── jadx-usage.md │ │ │ ├── fernflower-usage.md │ │ │ ├── api-extraction-patterns.md │ │ │ ├── kotlin-name-recovery.md │ │ │ ├── third_party_hosts.txt # denylist for first/third-party bucketing │ │ │ └── call-flow-analysis.md │ │ └── scripts/ │ │ ├── check-deps.sh # Bash │ │ ├── check-deps.ps1 # PowerShell │ │ ├── install-dep.sh │ │ ├── install-dep.ps1 │ │ ├── decompile.sh │ │ ├── decompile.ps1 │ │ ├── fingerprint.sh # Phase 0 — pre-decompile triage │ │ ├── recover-kotlin-names.sh # R8 → real Kotlin class names │ │ ├── lookup-name.sh # query the recovered name map │ │ ├── find-api-calls.sh │ │ └── find-api-calls.ps1 │ └── commands/ │ └── decompile.md # /decompile slash command ├── LICENSE └── README.md ``` ## References - [jadx — Dex to Java decompiler](https://github.com/skylot/jadx) - [Fernflower — JetBrains analytical decompiler](https://github.com/JetBrains/fernflower) - [Vineflower — Fernflower community fork](https://github.com/Vineflower/vineflower) - [dex2jar — DEX to JAR converter](https://github.com/ThexXTURBOXx/dex2jar) - [apktool — Android resource decoder](https://apktool.org/) ## Acknowledgments Thanks to the contributors who have shaped this skill: - [@tajchert](https://github.com/tajchert) — Phase 0 fingerprinting, R8-resistant Kotlin name recovery (`recover-kotlin-names.sh`, `lookup-name.sh`), and Ktor / Apollo / Koin / HMAC extraction patterns (#16) - [@philjn](https://github.com/philjn) — Native Windows / PowerShell support (`check-deps.ps1`, `install-dep.ps1`, `decompile.ps1`, `find-api-calls.ps1`) and split/bundled APK detection in `decompile.sh` (#8) - [@txhno](https://github.com/txhno) — Migration to the maintained [`ThexXTURBOXx/dex2jar`](https://github.com/ThexXTURBOXx/dex2jar) fork (#12) - [@muqiao215](https://github.com/muqiao215) — Decompile partial-success handling, Fernflower timeout safeguard, intermediate-artifact directory (#10) - [@kevinaimonster](https://github.com/kevinaimonster) — Chinese localization (`SKILL.md` discovery keywords) (#4) ## Disclaimer This plugin is provided strictly for **lawful purposes**, including but not limited to: - Security research and authorized penetration testing - Interoperability analysis permitted under applicable law (e.g., EU Directive 2009/24/EC, US DMCA §1201(f)) - Malware analysis and incident response - Educational use and CTF competitions **You are solely responsible** for ensuring that your use of this tool complies with all applicable laws, regulations, and terms of service. Unauthorized reverse engineering of software you do not own or do not have permission to analyze may violate intellectual property laws and computer fraud statutes in your jurisdiction. ## License Apache 2.0 — see [LICENSE](https://github.com/SimoneAvogadro/android-reverse-engineering-skill/blob/master/LICENSE). The decompilers and other tools this plugin drives (jadx, Vineflower/Fernflower, dex2jar, Apktool, adb, Java) are third-party software, not bundled with the plugin and distributed under their own licenses. --- > 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/7269) · Original source: [github.com/SimoneAvogadro/android-reverse-engineering-skill](https://github.com/SimoneAvogadro/android-reverse-engineering-skill)