Android Reverse Engineering & API Extraction

Install

/plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill
/plugin install android-reverse-engineering@android-reverse-engineering-skill

This is third-party code. Review the repository files before installing.

What it does

The skill walks the agent through analysing an Android package. It starts with a quick fingerprint: app framework, HTTP stack, obfuscation level and native libraries. Then it decompiles with jadx or Fernflower/Vineflower and searches for Retrofit, OkHttp, Volley, Ktor and Apollo endpoints, auth headers and request signing schemes. For R8 builds a script rebuilds original Kotlin class names from metadata. The result is documentation of the API and call flows from screens down to the network layer.

Who it is for. For security researchers, mobile developers and integrators who need to understand an app's API without its source code.

Example request

Decompile app.apk and list every API endpoint with its method and headers

Limitations

Requires Java JDK 17+ and jadx, plus dex2jar to use Fernflower on APKs. PowerShell scripts are still experimental. Analysing other people's apps without permission may break laws and terms of service; responsibility lies with the user.

How to disable. Uninstall the android-reverse-engineering plugin via /plugin in Claude Code.

Security check

• Runs decompilers and shell scripts and may install dependencies
• Legal risks when analysing apps you do not own

README in short

The README lists the skill's phases from package fingerprinting to call tracing, environment requirements and two ways to install the plugin. It also covers running the scripts by hand and recovering Kotlin class names after R8. It ends with a lawful use disclaimer: security research, interoperability, malware analysis and education. Apache 2.0 licensed.

SKILL.md

---
name: android-reverse-engineering
description: Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints (Retrofit, OkHttp, Volley), and trace call flows from UI to network layer. Use when the user wants to decompile, analyze, or reverse engineer Android packages, find API endpoints, or follow call flows.
trigger: decompile APK|decompile XAPK|reverse engineer Android|extract API|analyze Android|jadx|fernflower|vineflower|follow call flow|decompile JAR|decompile AAR|Android reverse engineering|find API endpoints
---

# Android Reverse Engineering

Decompile Android APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower, trace call flows through application code and libraries, and produce structured documentation of extracted APIs. Two decompiler engines are supported — jadx for broad Android coverage and Fernflower for higher-quality output on complex Java code — and can be used together for comparison.

## Prerequisites

This skill requires **Java JDK 17+** and **jadx** to be installed. **Fernflower/Vineflower** and **dex2jar** are optional but recommended for better decompilation quality. Run the dependency checker to verify:

```bash
bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.sh
```

## Workflow

### Phase 0: Fingerprint the App (recommended before anything else)

Before installing tools or decompiling, run a fast triage to determine what
kind of app you are looking at. **Decompiling Java is mostly useless for
Flutter, React Native, Cordova/Capacitor, and Xamarin apps** — the real code
lives elsewhere. The fingerprint script tells you which.

```bash
bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/fingerprint.sh <file.apk|file.xapk>
```

Related