The Problem

Developers and security analysts need a desktop UI that can decompile, edit, and re‑sign Android APKs without switching between command‑line tools. Existing workflows require manual tool installation, piecemeal editors, and platform‑specific scripts, which slows reverse‑engineering and introduces version‑skew.

What This Does

apkstudio ships a Qt 6 application that bundles the full toolchain (Java, Apktool, JADX, ADB, Uber APK Signer) and presents a single IDE‑like window. The UI lives in sources/mainwindow.{cpp,h} and coordinates workers such as sources/apkdecompileworker.{cpp,h} and sources/apkinstallworker.{cpp,h} to run external binaries. Syntax‑highlighted editing of .smali files is provided by sources/themedsyntaxhighlighter.{cpp,h} and sources/sourcecodeedit.{cpp,h}.

The project is built with CMake (CMakeLists.txt). All resources—icons, themes, and Qt resource collection (resources/all.qrc)—are compiled into the binary, so the executable runs out‑of‑the‑box on Linux, macOS, and Windows.

How It Is Wired

Execution starts at sources/main.cpp:

  1. main() creates a QApplication, reads the version from Git (processutils.cpp), and instantiates MainWindow (mainwindow.cpp).
  2. MainWindow builds the central UI: a QTreeView for the APK file tree, a SourceCodeEdit widget for code view, and dockable dialogs (e.g., ApkDecompileDialog). It also connects menu actions to slots that launch workers.
  3. Tool workers (ToolDownloadWorker, ApkDecompileWorker, ApkRecompileWorker, ApkSignWorker, AdbInstallWorker) inherit from QObject and run heavy external commands in a QThread. Their run() methods construct command‑line strings, invoke QProcess, and emit progress signals back to MainWindow.
  4. Settings dialogs (AppearanceSettingsWidget, BinarySettingsWidget, KeystoreGenerateDialog) read/write the INI‑style configuration stored in resources/*.def files.
  5. File viewers (ImageViewerWidget, HexEdit) are instantiated on demand from the tree view and display binary assets using Qt’s painting APIs.

The only external side‑effects are file system writes (decompiled sources, rebuilt APKs) and subprocess invocations of the bundled tools. No network or database access is present. The call graph is shallow: MainWindow is the hub, workers are leaf nodes, and UI widgets are isolated helpers. There are no circular dependencies detected.

How To Use It

# Clone with submodules (the upstream repo uses a .gitmodules entry)
git clone --recursive https://github.com/moses-y/apkstudio.git
cd apkstudio

# Configure a Release build (Qt 6 must be on the PATH or provide CMAKE_PREFIX_PATH)
cmake -B build -S . -DCMAKE_BUILD_TYPE=Release

# Build the binary
cmake --build build --config Release

Run the resulting executable (build/apkstudio on Unix, apkstudio.exe on Windows). The first launch triggers a download of required tools; you can override paths later via Settings → Tools.

Real‑World Use

A security analyst can drop an .apk onto the application, click Decompile, edit a suspicious smali method, then select Recompile & Sign. The rebuilt APK can be installed directly from the UI using the ADB Install button, eliminating manual adb install calls and ensuring the same tool versions are used throughout the analysis.

Code Health & Issues

  • HIGH – Pin GitHub Actions – .github/workflows/build.yml uses tags (jurplel/install-qt-action@v4, softprops/action-gh-release@v1). Replace tags with fixed commit SHA to avoid supply‑chain drift.
  • HIGH – No test suite – 29 source files, zero test files. Add unit tests for public APIs (e.g., ApkDecompileWorker::run) and integrate them into CI.
  • LOW – Missing job timeouts – build.yml lacks timeout-minutes; set a reasonable bound (e.g., timeout-minutes: 30) to prevent runaway jobs.

Measured static findings:

  • HIGH – Deep nesting in apkdecompiledialog.cpp, appearancesettingswidget.cpp, binarysettingswidget.cpp (max indentation depth 14). Refactor with early returns or extract helper functions.
  • HIGH – Oversized files mainwindow.cpp (≈ 1449 LOC) and tooldownloadworker.cpp. Split by responsibility (e.g., separate UI layout from worker orchestration).
  • MEDIUM – Duplicated code across keystoregeneratedialog.cpp, settingsdialog.cpp, and the keystore worker files. Consolidate shared logic into a utility class.

No license issues, no committed secrets, CI is present, but Docker support and a lockfile are absent.

The Bottom Line

apkstudio delivers a functional, cross‑platform Qt IDE for APK reverse engineering with all required tooling bundled. The codebase works but suffers from large, deeply nested source files and a complete lack of automated tests, which raises maintenance risk. It is suitable for teams that need a quick GUI front‑end and are prepared to invest in refactoring and test coverage before extending the project.