Reverse Engineering Android Apps with android-reverse-engineering-skill

The Problem

Reverse engineering Android apps sucks. APK files are obfuscated, HTTP APIs are buried under layers of abstraction, and figuring out how an app works without source code feels like deciphering ancient runes. If you've ever tried to decompile an APK just to find out what API endpoints it's hitting, you know the pain.

What This Does

The android-reverse-engineering-skill is a Claude Code plugin that takes a lot of the grunt work out of Android reverse engineering. It combines tools like jadx and Fernflower to decompile APKs, XAPKs, or JARs and extract useful data, like Retrofit endpoints, OkHttp calls, and even hardcoded auth tokens. It's like having a coworker who loves staring at decompiled code so you don’t have to.

The repo is structured around a plugin system (plugins/ directory) with scripts and Markdown files for everything from dependency checks (check-deps.sh) to advanced decompilation workflows (decompile.sh). The SKILL.md file outlines the capabilities, while the setup-guide.md helps you get the tools installed without wanting to throw your laptop out the window.

Real-World Use

Here’s a common scenario: You’ve got an APK, and your boss/client/curiosity demands that you figure out what API endpoints it’s hitting. With this plugin, you can: Decompile the APK using jadx: Extract API calls: Follow the call flow from LoginActivity down to the network layer using the generated code.

It also handles obfuscated code, so you don’t have to guess what a() or b() do. Want to see how Fernflower handles the same code compared to jadx? Use the --engine both option and compare the outputs side-by-side. It’s nerdy, but it works.

The Bottom Line

This repo is great for anyone who needs to reverse engineer Android apps regularly. It’s not beginner-friendly, and setting up all the dependencies can be a pain, but once it’s running, it’s a lifesaver. If you're dealing with APKs more than you'd like to admit, give this a shot. If not, well, lucky you.