JADX

https://github.com/skylot/jadx

Load the APK in the GUI app

Command to load the source code without opening GUI:

jadx -d out/ app.apk
jadx-gui app.apk

Useful flags on big apps:

jadx -d out/ --deobf --show-bad-code -j 8 app.apk

--deobf           rename obfuscated identifiers consistently
--show-bad-code   emit smali where decompilation fails, instead of dropping it
-j                threads

apktool: resources, not code

JADX gives you Java. apktool gives you the manifest, resources and smali you can patch and rebuild.

# https://github.com/iBotPeaches/Apktool
apktool d app.apk -o app/
# edit app/AndroidManifest.xml, res/xml/network_security_config.xml
apktool b app/ -o patched.apk

# resign, or Android will refuse to install it
keytool -genkey -v -keystore k.jks -keyalg RSA -keysize 2048 -validity 10000 -alias a
apksigner sign --ks k.jks patched.apk

Patching network_security_config.xml to trust user CAs is the standard way to get Burp between the app and the API.

What to grep first

grep -rniE 'https?://[a-z0-9.-]+' out/ | grep -v android.com | sort -u | head -50
grep -rniE '(api[_-]?key|secret|token|password|passwd|bearer|authorization)' out/
grep -rniE 'AIza[0-9A-Za-z_-]{35}' out/            # google api key
grep -rniE 'AKIA[0-9A-Z]{16}' out/                 # aws
grep -rniE '[a-z0-9-]+\.firebaseio\.com' out/
grep -rniE 'amazonaws\.com|blob\.core\.windows\.net|storage\.googleapis\.com' out/

Also read res/values/strings.xml and assets/. Keys live there more often than in code.

Faster than decompiling

# https://github.com/dwisiswant0/apkleaks
apkleaks -f app.apk

# https://github.com/MobSF/Mobile-Security-Framework-MobSF
docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf

MobSF gives you the manifest analysis, the secrets and the exported components in one pass. Run it first, then go to JADX for the parts that matter.

Other decompilers

GDA-android-reversing-Too

https://github.com/charles2gan/GDA-android-reversing-Tool

URL	Description
https://github.com/skylot/jadx	Default choice
https://github.com/iBotPeaches/Apktool	Resources, manifest, rebuild
https://ghidra-sre.org/	Native `.so` libraries
https://github.com/pxb1988/dex2jar	dex → jar, for JD-GUI / Bytecode Viewer
https://github.com/Konloch/bytecode-viewer	Several decompilers side by side

Reach for Ghidra when the interesting logic is in lib/arm64-v8a/*.so. Obfuscated apps push crypto and key derivation into native code.

Flutter and React Native

Different toolchains, different pages:

Flutter
React Native: the JS bundle is in assets/index.android.bundle, unpack with hermes-dec if it is Hermes bytecode

Then

Android: manifest, exported components, intents

APK Decompilers