[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EN5SH3P5SFB9730WRPQ0F1":3,"skill-same:01M6EN5SH3P5SFB9730WRPQ0F1":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":42,"commitSha":43,"skillDirectory":44,"forksCount":45,"repositoryHtmlUrl":46,"repositoryHomepageUrl":47,"ownerHtmlUrl":48,"ownerBlogUrl":6,"ownerDescription":49,"updatedAt":50,"install":51,"resources":64},"01M6EN5SH3P5SFB9730WRPQ0F1","apktool",null,"Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract resources, examine AndroidManifest.xml, analyze smali code, or repackage modified APKs.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbrownfinesecurity\u002Fapktool\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[5,24,25,26,27,28,29,30,31,32,33,34,35,36],"android","code","extraction","xml","engineering","APK","unpacking","tool","analyze","extract","use","files","resources","2026-11-10 10:12:30",false,"---\nname: apktool\ndescription: Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract resources, examine AndroidManifest.xml, analyze smali code, or repackage modified APKs.\n---\n\n# Apktool - Android APK Unpacking and Resource Extraction\n\nYou are helping the user reverse engineer Android APK files using apktool for security analysis, vulnerability discovery, and understanding app internals.\n\n## Tool Overview\n\nApktool is a tool for reverse engineering Android APK files. It can decode resources to nearly original form and rebuild them after modifications. It's essential for:\n- Extracting readable AndroidManifest.xml\n- Decoding resources (XML layouts, strings, images)\n- Disassembling DEX to smali code\n- Analyzing app structure and permissions\n- Repackaging modified APKs\n\n## Prerequisites\n\n- **apktool** must be installed on the system\n- Java Runtime Environment (JRE) required\n- Sufficient disk space (unpacked APK is typically 2-5x original size)\n- Write permissions in output directory\n\n## Instructions\n\n### 1. Basic APK Unpacking (Most Common)\n\nWhen the user asks to unpack, decode, or analyze an APK:\n\n**Standard decode command:**\n```bash\napktool d \u003Capk-file> -o \u003Coutput-directory>\n```\n\n**Example:**\n```bash\napktool d app.apk -o app-unpacked\n```\n\n**With force overwrite (if directory exists):**\n```bash\napktool d app.apk -o app-unpacked -f\n```\n\n### 2. Understanding Output Structure\n\nAfter unpacking, the output directory contains:\n\n```\napp-unpacked\u002F\n├── AndroidManifest.xml          # Readable manifest (permissions, components)\n├── apktool.yml                  # Apktool metadata (version info, SDK levels)\n├── original\u002F                    # Original META-INF certificates\n│   └── META-INF\u002F\n├── res\u002F                         # Decoded resources\n│   ├── layout\u002F                  # XML layouts\n│   ├── values\u002F                  # Strings, colors, dimensions\n│   ├── drawable\u002F                # Images and drawables\n│   └── ...\n├── smali\u002F                       # Disassembled DEX code (smali format)\n│   └── com\u002Fcompany\u002Fapp\u002F        # Package structure\n├── assets\u002F                      # App assets (if present)\n├── lib\u002F                         # Native libraries (if present)\n│   ├── arm64-v8a\u002F\n│   ├── armeabi-v7a\u002F\n│   └── ...\n└── unknown\u002F                     # Files apktool couldn't classify\n```\n\n### 3. Selective Decoding (Performance Optimization)\n\n**Skip resources (code analysis only):**\n```bash\napktool d app.apk -o app-code-only -r\n# or\napktool d app.apk -o app-code-only --no-res\n```\n- Faster processing\n- Only extracts smali code and manifest\n- Use when you only need to analyze code logic\n\n**Skip source code (resource analysis only):**\n```bash\napktool d app.apk -o app-resources-only -s\n# or\napktool d app.apk -o app-resources-only --no-src\n```\n- Faster processing\n- Only extracts resources and manifest\n- Use when you only need resources, strings, layouts\n\n### 4. Common Analysis Tasks\n\n#### A. Examining AndroidManifest.xml\n\nThe manifest reveals critical security information:\n\n```bash\n# After unpacking\ncat app-unpacked\u002FAndroidManifest.xml\n```\n\n**Look for:**\n- **Permissions**: What device features\u002Fdata the app accesses\n- **Exported components**: Activities, services, receivers accessible from other apps\n- **Intent filters**: How the app responds to system\u002Fapp intents\n- **Backup settings**: `android:allowBackup=\"true\"` (security risk)\n- **Debuggable flag**: `android:debuggable=\"true\"` (major security issue)\n- **Network security config**: Custom certificate pinning, cleartext traffic\n- **Min\u002FTarget SDK versions**: Outdated versions may have vulnerabilities\n\n**Example analysis commands:**\n```bash\n# Find all permissions\ngrep \"uses-permission\" app-unpacked\u002FAndroidManifest.xml\n\n# Find exported components\ngrep \"exported=\\\"true\\\"\" app-unpacked\u002FAndroidManifest.xml\n\n# Check if debuggable\ngrep \"debuggable\" app-unpacked\u002FAndroidManifest.xml\n\n# Find all activities\ngrep \"android:name.*Activity\" app-unpacked\u002FAndroidManifest.xml\n```\n\n#### B. Extracting Strings and Resources\n\n```bash\n# View all string resources\ncat app-unpacked\u002Fres\u002Fvalues\u002Fstrings.xml\n\n# Search for API keys, URLs, credentials\ngrep -r \"api\" app-unpacked\u002Fres\u002Fvalues\u002F\ngrep -r \"http\" app-unpacked\u002Fres\u002Fvalues\u002F\ngrep -r \"password\\|secret\\|key\\|token\" app-unpacked\u002Fres\u002Fvalues\u002F\n\n# Find hardcoded URLs in resources\ngrep -rE \"https?:\u002F\u002F\" app-unpacked\u002Fres\u002F\n```\n\n#### C. Analyzing Smali Code\n\nSmali is the disassembled Dalvik bytecode format:\n\n```bash\n# Find specific class\nfind app-unpacked\u002Fsmali -name \"*Login*.smali\"\nfind app-unpacked\u002Fsmali -name \"*Auth*.smali\"\n\n# Search for security-relevant code\ngrep -r \"crypto\\|encrypt\\|decrypt\" app-unpacked\u002Fsmali\u002F\ngrep -r \"http\\|https\\|url\" app-unpacked\u002Fsmali\u002F\ngrep -r \"password\\|credential\\|token\" app-unpacked\u002Fsmali\u002F\n\n# Find native library usage\ngrep -r \"System.loadLibrary\" app-unpacked\u002Fsmali\u002F\n\n# Find file operations\ngrep -r \"openFileOutput\\|openFileInput\" app-unpacked\u002Fsmali\u002F\n```\n\n**Note**: Smali is harder to read than Java source. Consider using jadx for Java decompilation for easier analysis.\n\n#### D. Examining Native Libraries\n\n```bash\n# List native libraries\nls -lah app-unpacked\u002Flib\u002F\n\n# Check architectures supported\nls app-unpacked\u002Flib\u002F\n\n# Identify library types\nfile app-unpacked\u002Flib\u002Farm64-v8a\u002F*.so\n\n# Search for interesting strings in libraries\nstrings app-unpacked\u002Flib\u002Farm64-v8a\u002Flibnative.so | grep -i \"http\\|key\\|password\"\n```\n\n### 5. Repackaging APK (Build)\n\nAfter modifying resources or smali code:\n\n```bash\napktool b app-unpacked -o app-modified.apk\n```\n\n**Important**: Rebuilt APKs must be signed before installation:\n```bash\n# Generate keystore (one-time setup)\nkeytool -genkey -v -keystore my-release-key.jks -keyalg RSA -keysize 2048 -validity 10000 -alias my-key-alias\n\n# Sign APK\njarsigner -verbose -keystore my-release-key.jks app-modified.apk my-key-alias\n\n# Verify signature\njarsigner -verify app-modified.apk\n\n# Zipalign (optimization)\nzipalign -v 4 app-modified.apk app-modified-aligned.apk\n```\n\n### 6. Framework Management\n\nFor system apps or apps dependent on device manufacturer frameworks:\n\n```bash\n# Install framework\napktool if framework-res.apk\n\n# List installed frameworks\napktool list-frameworks\n\n# Decode with specific framework\napktool d -t \u003Ctag> app.apk\n```\n\n## Common Workflows\n\n### Workflow 1: Security Analysis\n\n```bash\n# 1. Unpack APK\napktool d target.apk -o target-unpacked\n\n# 2. Examine manifest for security issues\ncat target-unpacked\u002FAndroidManifest.xml\n\n# 3. Search for hardcoded credentials\ngrep -r \"password\\|api_key\\|secret\\|token\" target-unpacked\u002Fres\u002F\n\n# 4. Check for debuggable flag\ngrep \"debuggable\" target-unpacked\u002FAndroidManifest.xml\n\n# 5. Find exported components\ngrep \"exported=\\\"true\\\"\" target-unpacked\u002FAndroidManifest.xml\n\n# 6. Examine network security config\ncat target-unpacked\u002Fres\u002Fxml\u002Fnetwork_security_config.xml 2>\u002Fdev\u002Fnull\n```\n\n### Workflow 2: IoT App Analysis\n\nFor IoT companion apps, find device communication details:\n\n```bash\n# 1. Unpack APK\napktool d iot-app.apk -o iot-app-unpacked\n\n# 2. Search for device endpoints\ngrep -rE \"https?:\u002F\u002F[^\\\"']+\" iot-app-unpacked\u002Fres\u002F | grep -v \"google\\|android\"\n\n# 3. Find API keys\ngrep -r \"api\\|key\" iot-app-unpacked\u002Fres\u002Fvalues\u002Fstrings.xml\n\n# 4. Locate device communication code\nfind iot-app-unpacked\u002Fsmali -name \"*Device*.smali\"\nfind iot-app-unpacked\u002Fsmali -name \"*Network*.smali\"\nfind iot-app-unpacked\u002Fsmali -name \"*Api*.smali\"\n\n# 5. Check for certificate pinning\ngrep -r \"certificatePinner\\|TrustManager\" iot-app-unpacked\u002Fsmali\u002F\n```\n\n### Workflow 3: Resource Extraction Only\n\n```bash\n# Fast resource-only extraction\napktool d app.apk -o app-resources -s\n\n# Extract app icon\ncp app-resources\u002Fres\u002Fmipmap-xxxhdpi\u002Fic_launcher.png .\u002F\n\n# Extract strings for localization\ncat app-resources\u002Fres\u002Fvalues*\u002Fstrings.xml\n\n# Extract layouts for UI analysis\nls app-resources\u002Fres\u002Flayout\u002F\n```\n\n### Workflow 4: Quick Code Check (No Resources)\n\n```bash\n# Fast code-only extraction\napktool d app.apk -o app-code -r\n\n# Analyze smali quickly\ngrep -r \"http\" app-code\u002Fsmali\u002F | head -20\ngrep -r \"password\" app-code\u002Fsmali\u002F\n```\n\n## Output Formats\n\nApktool doesn't have built-in output format options, but you can structure your analysis:\n\n**For human-readable reports:**\n```bash\n# Generate analysis report\n{\n  echo \"=== APK Analysis Report ===\"\n  echo \"APK: app.apk\"\n  echo \"Date: $(date)\"\n  echo \"\"\n  echo \"=== Permissions ===\"\n  grep \"uses-permission\" app-unpacked\u002FAndroidManifest.xml\n  echo \"\"\n  echo \"=== Exported Components ===\"\n  grep \"exported=\\\"true\\\"\" app-unpacked\u002FAndroidManifest.xml\n  echo \"\"\n  echo \"=== Package Info ===\"\n  grep \"package=\" app-unpacked\u002FAndroidManifest.xml\n} > apk-analysis-report.txt\n```\n\n## Integration with IoTHackBot Tools\n\nApktool works well with other analysis workflows:\n\n1. **APK → Network Analysis**:\n   - Extract API endpoints from resources\n   - Use extracted URLs with curl\u002Fwget for testing\n   - Feed endpoints to network testing tools\n\n2. **APK → Credential Discovery**:\n   - Find hardcoded credentials in resources\n   - Test credentials against IoT devices\n   - Use with onvifscan or other device testing tools\n\n3. **APK → Code Analysis**:\n   - Extract smali code with apktool\n   - Decompile to Java with jadx for easier reading\n   - Cross-reference findings between both tools\n\n## Best Practices\n\n### 1. Always Examine the Manifest First\n\n```bash\napktool d app.apk -o app-unpacked\ncat app-unpacked\u002FAndroidManifest.xml | less\n```\n\nThe manifest provides the roadmap for further analysis.\n\n### 2. Use Selective Decoding for Speed\n\n- Code only: `-r` flag\n- Resources only: `-s` flag\n- Full decode: No flags (default)\n\n### 3. Search Systematically\n\n```bash\n# Create analysis script\ncat > analyze.sh \u003C\u003C 'EOF'\n#!\u002Fbin\u002Fbash\nAPK_DIR=\"$1\"\necho \"[+] Searching for URLs...\"\ngrep -rE \"https?:\u002F\u002F\" \"$APK_DIR\u002Fres\u002F\" | grep -v \"schema\\|google\\|android\"\necho \"[+] Searching for API keys...\"\ngrep -ri \"api.*key\\|apikey\" \"$APK_DIR\u002Fres\u002F\"\necho \"[+] Searching for secrets...\"\ngrep -ri \"secret\\|password\\|credential\" \"$APK_DIR\u002Fres\u002F\"\nEOF\nchmod +x analyze.sh\n.\u002Fanalyze.sh app-unpacked\n```\n\n### 4. Document Your Findings\n\nKeep notes on:\n- APK package name and version\n- Interesting permissions\n- Hardcoded credentials\u002FURLs\n- Exported components\n- Security misconfigurations\n\n### 5. Combine with Jadx\n\nUse both tools together:\n- **Apktool**: For resources, manifest, and detailed smali\n- **Jadx**: For readable Java source code\n\n## Troubleshooting\n\n### Problem: \"brut.directory.DirectoryException: Framework\"\n\n**Solution**: Install framework resources:\n```bash\napktool if \u003Cframework-res.apk>\n```\n\n### Problem: Decoding fails with resource errors\n\n**Solution**: Use `--keep-broken-res` flag:\n```bash\napktool d app.apk -o output --keep-broken-res\n```\n\n### Problem: \"Input file was not found or was not readable\"\n\n**Solution**: Check file path and permissions:\n```bash\nls -l app.apk\nfile app.apk  # Should show \"Zip archive data\"\n```\n\n### Problem: Out of memory error\n\n**Solution**: Increase Java heap size:\n```bash\nexport _JAVA_OPTIONS=\"-Xmx2048m\"\napktool d large-app.apk\n```\n\n### Problem: Build fails after modifications\n\n**Solution**: Validate your smali\u002FXML syntax:\n```bash\n# Check for syntax errors\napktool b app-unpacked -o test.apk --use-aapt2\n```\n\n### Problem: APK won't install after repackaging\n\n**Solution**: Sign the APK:\n```bash\njarsigner -verbose -keystore debug.keystore rebuilt.apk androiddebugkey\n```\n\n## Important Notes\n\n- Apktool requires Java Runtime Environment (JRE)\n- Decoded APKs are typically 2-5x larger than original\n- Smali code is more verbose than Java source (use jadx for Java)\n- Always work on copies of APK files, never originals\n- Repackaging requires signing before installation\n- Some obfuscated apps may have unreadable class\u002Fmethod names\n- System apps may require framework installation\n\n## Security and Ethics\n\n**IMPORTANT**: Only analyze APKs you own or have permission to analyze.\n\n- Respect intellectual property and licensing\n- Follow responsible disclosure for vulnerabilities\n- Don't distribute modified APKs without authorization\n- Be aware of terms of service and EULAs\n- Use for authorized security testing and research only\n\n## Example Analysis Session\n\n```bash\n# Complete analysis workflow\nTARGET=\"myapp.apk\"\nOUTPUT=\"myapp-analysis\"\n\n# 1. Unpack\necho \"[+] Unpacking APK...\"\napktool d \"$TARGET\" -o \"$OUTPUT\"\n\n# 2. Basic info\necho \"[+] Package info:\"\ngrep \"package=\" \"$OUTPUT\u002FAndroidManifest.xml\"\n\n# 3. Permissions\necho \"[+] Permissions:\"\ngrep \"uses-permission\" \"$OUTPUT\u002FAndroidManifest.xml\"\n\n# 4. Exported components\necho \"[+] Exported components:\"\ngrep \"exported=\\\"true\\\"\" \"$OUTPUT\u002FAndroidManifest.xml\"\n\n# 5. Search for secrets\necho \"[+] Searching for hardcoded secrets...\"\ngrep -r \"api.*key\\|password\\|secret\" \"$OUTPUT\u002Fres\u002F\" | grep -v \"^Binary\"\n\n# 6. Find URLs\necho \"[+] Finding URLs...\"\ngrep -rE \"https?:\u002F\u002F[^\\\"']+\" \"$OUTPUT\u002Fres\u002F\" | grep -v \"schema\\|xmlns\"\n\n# 7. Check debuggable\necho \"[+] Debug status:\"\ngrep \"debuggable\" \"$OUTPUT\u002FAndroidManifest.xml\" || echo \"Not debuggable (good)\"\n\n# 8. Summary\necho \"[+] Analysis complete. Output in: $OUTPUT\u002F\"\n```\n\n## Success Criteria\n\nA successful apktool analysis includes:\n\n- APK successfully decoded without errors\n- AndroidManifest.xml is readable and analyzed\n- Resources extracted and searchable\n- Smali code available for inspection\n- Security-relevant findings documented\n- Output organized in clear directory structure\n- Any modifications can be repackaged if needed\n\n## Quick Reference\n\n```bash\n# Decode (unpack)\napktool d \u003Capk> -o \u003Coutput-dir>\n\n# Decode with force overwrite\napktool d \u003Capk> -o \u003Coutput-dir> -f\n\n# Decode without resources (faster)\napktool d \u003Capk> -o \u003Coutput-dir> -r\n\n# Decode without source (faster)\napktool d \u003Capk> -o \u003Coutput-dir> -s\n\n# Build (repack)\napktool b \u003Cunpacked-dir> -o \u003Coutput-apk>\n\n# Install framework\napktool if \u003Cframework.apk>\n\n# Empty framework cache\napktool empty-framework-dir\n```\n","# Apktool - Android APK Unpacking and Resource Extraction\n\nYou are helping the user reverse engineer Android APK files using apktool for security analysis, vulnerability discovery, and understanding app internals.\n\n## Tool Overview\n\nApktool is a tool for reverse engineering Android APK files. It can decode resources to nearly original form and rebuild them after modifications. It's essential for:\n- Extracting readable AndroidManifest.xml\n- Decoding resources (XML layouts, strings, images)\n- Disassembling DEX to smali code\n- Analyzing app structure and permissions\n- Repackaging modified APKs\n\n## Prerequisites\n\n- **apktool** must be installed on the system\n- Java Runtime Environment (JRE) required\n- Sufficient disk space (unpacked APK is typically 2-5x original size)\n- Write permissions in output directory\n\n## Instructions\n\n### 1. Basic APK Unpacking (Most Common)\n\nWhen the user asks to unpack, decode, or analyze an APK:\n\n**Standard decode command:**\n```bash\napktool d \u003Capk-file> -o \u003Coutput-directory>\n```\n\n**Example:**\n```bash\napktool d app.apk -o app-unpacked\n```\n\n**With force overwrite (if directory exists):**\n```bash\napktool d app.apk -o app-unpacked -f\n```\n\n### 2. Understanding Output Structure\n\nAfter unpacking, the output directory contains:\n\n```\napp-unpacked\u002F\n├── AndroidManifest.xml          # Readable manifest (permissions, components)\n├── apktool.yml                  # Apktool metadata (version info, SDK levels)\n├── original\u002F                    # Original META-INF certificates\n│   └── META-INF\u002F\n├── res\u002F                         # Decoded resources\n│   ├── layout\u002F                  # XML layouts\n│   ├── values\u002F                  # Strings, colors, dimensions\n│   ├── drawable\u002F                # Images and drawables\n│   └── ...\n├── smali\u002F                       # Disassembled DEX code (smali format)\n│   └── com\u002Fcompany\u002Fapp\u002F        # Package structure\n├── assets\u002F                      # App assets (if present)\n├── lib\u002F                         # Native libraries (if present)\n│   ├── arm64-v8a\u002F\n│   ├── armeabi-v7a\u002F\n│   └── ...\n└── unknown\u002F                     # Files apktool couldn't classify\n```\n\n### 3. Selective Decoding (Performance Optimization)\n\n**Skip resources (code analysis only):**\n```bash\napktool d app.apk -o app-code-only -r\n# or\napktool d app.apk -o app-code-only --no-res\n```\n- Faster processing\n- Only extracts smali code and manifest\n- Use when you only need to analyze code logic\n\n**Skip source code (resource analysis only):**\n```bash\napktool d app.apk -o app-resources-only -s\n# or\napktool d app.apk -o app-resources-only --no-src\n```\n- Faster processing\n- Only extracts resources and manifest\n- Use when you only need resources, strings, layouts\n\n### 4. Common Analysis Tasks\n\n#### A. Examining AndroidManifest.xml\n\nThe manifest reveals critical security information:\n\n```bash\n# After unpacking\ncat app-unpacked\u002FAndroidManifest.xml\n```\n\n**Look for:**\n- **Permissions**: What device features\u002Fdata the app accesses\n- **Exported components**: Activities, services, receivers accessible from other apps\n- **Intent filters**: How the app responds to system\u002Fapp intents\n- **Backup settings**: `android:allowBackup=\"true\"` (security risk)\n- **Debuggable flag**: `android:debuggable=\"true\"` (major security issue)\n- **Network security config**: Custom certificate pinning, cleartext traffic\n- **Min\u002FTarget SDK versions**: Outdated versions may have vulnerabilities\n\n**Example analysis commands:**\n```bash\n# Find all permissions\ngrep \"uses-permission\" app-unpacked\u002FAndroidManifest.xml\n\n# Find exported components\ngrep \"exported=\\\"true\\\"\" app-unpacked\u002FAndroidManifest.xml\n\n# Check if debuggable\ngrep \"debuggable\" app-unpacked\u002FAndroidManifest.xml\n\n# Find all activities\ngrep \"android:name.*Activity\" app-unpacked\u002FAndroidManifest.xml\n```\n\n#### B. Extracting Strings and Resources\n\n```bash\n# View all string resources\ncat app-unpacked\u002Fres\u002Fvalues\u002Fstrings.xml\n\n# Search for API keys, URLs, credentials\ngrep -r \"api\" app-unpacked\u002Fres\u002Fvalues\u002F\ngrep -r \"http\" app-unpacked\u002Fres\u002Fvalues\u002F\ngrep -r \"password\\|secret\\|key\\|token\" app-unpacked\u002Fres\u002Fvalues\u002F\n\n# Find hardcoded URLs in resources\ngrep -rE \"https?:\u002F\u002F\" app-unpacked\u002Fres\u002F\n```\n\n#### C. Analyzing Smali Code\n\nSmali is the disassembled Dalvik bytecode format:\n\n```bash\n# Find specific class\nfind app-unpacked\u002Fsmali -name \"*Login*.smali\"\nfind app-unpacked\u002Fsmali -name \"*Auth*.smali\"\n\n# Search for security-relevant code\ngrep -r \"crypto\\|encrypt\\|decrypt\" app-unpacked\u002Fsmali\u002F\ngrep -r \"http\\|https\\|url\" app-unpacked\u002Fsmali\u002F\ngrep -r \"password\\|credential\\|token\" app-unpacked\u002Fsmali\u002F\n\n# Find native library usage\ngrep -r \"System.loadLibrary\" app-unpacked\u002Fsmali\u002F\n\n# Find file operations\ngrep -r \"openFileOutput\\|openFileInput\" app-unpacked\u002Fsmali\u002F\n```\n\n**Note**: Smali is harder to read than Java source. Consider using jadx for Java decompilation for easier analysis.\n\n#### D. Examining Native Libraries\n\n```bash\n# List native libraries\nls -lah app-unpacked\u002Flib\u002F\n\n# Check architectures supported\nls app-unpacked\u002Flib\u002F\n\n# Identify library types\nfile app-unpacked\u002Flib\u002Farm64-v8a\u002F*.so\n\n# Search for interesting strings in libraries\nstrings app-unpacked\u002Flib\u002Farm64-v8a\u002Flibnative.so | grep -i \"http\\|key\\|password\"\n```\n\n### 5. Repackaging APK (Build)\n\nAfter modifying resources or smali code:\n\n```bash\napktool b app-unpacked -o app-modified.apk\n```\n\n**Important**: Rebuilt APKs must be signed before installation:\n```bash\n# Generate keystore (one-time setup)\nkeytool -genkey -v -keystore my-release-key.jks -keyalg RSA -keysize 2048 -validity 10000 -alias my-key-alias\n\n# Sign APK\njarsigner -verbose -keystore my-release-key.jks app-modified.apk my-key-alias\n\n# Verify signature\njarsigner -verify app-modified.apk\n\n# Zipalign (optimization)\nzipalign -v 4 app-modified.apk app-modified-aligned.apk\n```\n\n### 6. Framework Management\n\nFor system apps or apps dependent on device manufacturer frameworks:\n\n```bash\n# Install framework\napktool if framework-res.apk\n\n# List installed frameworks\napktool list-frameworks\n\n# Decode with specific framework\napktool d -t \u003Ctag> app.apk\n```\n\n## Common Workflows\n\n### Workflow 1: Security Analysis\n\n```bash\n# 1. Unpack APK\napktool d target.apk -o target-unpacked\n\n# 2. Examine manifest for security issues\ncat target-unpacked\u002FAndroidManifest.xml\n\n# 3. Search for hardcoded credentials\ngrep -r \"password\\|api_key\\|secret\\|token\" target-unpacked\u002Fres\u002F\n\n# 4. Check for debuggable flag\ngrep \"debuggable\" target-unpacked\u002FAndroidManifest.xml\n\n# 5. Find exported components\ngrep \"exported=\\\"true\\\"\" target-unpacked\u002FAndroidManifest.xml\n\n# 6. Examine network security config\ncat target-unpacked\u002Fres\u002Fxml\u002Fnetwork_security_config.xml 2>\u002Fdev\u002Fnull\n```\n\n### Workflow 2: IoT App Analysis\n\nFor IoT companion apps, find device communication details:\n\n```bash\n# 1. Unpack APK\napktool d iot-app.apk -o iot-app-unpacked\n\n# 2. Search for device endpoints\ngrep -rE \"https?:\u002F\u002F[^\\\"']+\" iot-app-unpacked\u002Fres\u002F | grep -v \"google\\|android\"\n\n# 3. Find API keys\ngrep -r \"api\\|key\" iot-app-unpacked\u002Fres\u002Fvalues\u002Fstrings.xml\n\n# 4. Locate device communication code\nfind iot-app-unpacked\u002Fsmali -name \"*Device*.smali\"\nfind iot-app-unpacked\u002Fsmali -name \"*Network*.smali\"\nfind iot-app-unpacked\u002Fsmali -name \"*Api*.smali\"\n\n# 5. Check for certificate pinning\ngrep -r \"certificatePinner\\|TrustManager\" iot-app-unpacked\u002Fsmali\u002F\n```\n\n### Workflow 3: Resource Extraction Only\n\n```bash\n# Fast resource-only extraction\napktool d app.apk -o app-resources -s\n\n# Extract app icon\ncp app-resources\u002Fres\u002Fmipmap-xxxhdpi\u002Fic_launcher.png .\u002F\n\n# Extract strings for localization\ncat app-resources\u002Fres\u002Fvalues*\u002Fstrings.xml\n\n# Extract layouts for UI analysis\nls app-resources\u002Fres\u002Flayout\u002F\n```\n\n### Workflow 4: Quick Code Check (No Resources)\n\n```bash\n# Fast code-only extraction\napktool d app.apk -o app-code -r\n\n# Analyze smali quickly\ngrep -r \"http\" app-code\u002Fsmali\u002F | head -20\ngrep -r \"password\" app-code\u002Fsmali\u002F\n```\n\n## Output Formats\n\nApktool doesn't have built-in output format options, but you can structure your analysis:\n\n**For human-readable reports:**\n```bash\n# Generate analysis report\n{\n  echo \"=== APK Analysis Report ===\"\n  echo \"APK: app.apk\"\n  echo \"Date: $(date)\"\n  echo \"\"\n  echo \"=== Permissions ===\"\n  grep \"uses-permission\" app-unpacked\u002FAndroidManifest.xml\n  echo \"\"\n  echo \"=== Exported Components ===\"\n  grep \"exported=\\\"true\\\"\" app-unpacked\u002FAndroidManifest.xml\n  echo \"\"\n  echo \"=== Package Info ===\"\n  grep \"package=\" app-unpacked\u002FAndroidManifest.xml\n} > apk-analysis-report.txt\n```\n\n## Integration with IoTHackBot Tools\n\nApktool works well with other analysis workflows:\n\n1. **APK → Network Analysis**:\n   - Extract API endpoints from resources\n   - Use extracted URLs with curl\u002Fwget for testing\n   - Feed endpoints to network testing tools\n\n2. **APK → Credential Discovery**:\n   - Find hardcoded credentials in resources\n   - Test credentials against IoT devices\n   - Use with onvifscan or other device testing tools\n\n3. **APK → Code Analysis**:\n   - Extract smali code with apktool\n   - Decompile to Java with jadx for easier reading\n   - Cross-reference findings between both tools\n\n## Best Practices\n\n### 1. Always Examine the Manifest First\n\n```bash\napktool d app.apk -o app-unpacked\ncat app-unpacked\u002FAndroidManifest.xml | less\n```\n\nThe manifest provides the roadmap for further analysis.\n\n### 2. Use Selective Decoding for Speed\n\n- Code only: `-r` flag\n- Resources only: `-s` flag\n- Full decode: No flags (default)\n\n### 3. Search Systematically\n\n```bash\n# Create analysis script\ncat > analyze.sh \u003C\u003C 'EOF'\n#!\u002Fbin\u002Fbash\nAPK_DIR=\"$1\"\necho \"[+] Searching for URLs...\"\ngrep -rE \"https?:\u002F\u002F\" \"$APK_DIR\u002Fres\u002F\" | grep -v \"schema\\|google\\|android\"\necho \"[+] Searching for API keys...\"\ngrep -ri \"api.*key\\|apikey\" \"$APK_DIR\u002Fres\u002F\"\necho \"[+] Searching for secrets...\"\ngrep -ri \"secret\\|password\\|credential\" \"$APK_DIR\u002Fres\u002F\"\nEOF\nchmod +x analyze.sh\n.\u002Fanalyze.sh app-unpacked\n```\n\n### 4. Document Your Findings\n\nKeep notes on:\n- APK package name and version\n- Interesting permissions\n- Hardcoded credentials\u002FURLs\n- Exported components\n- Security misconfigurations\n\n### 5. Combine with Jadx\n\nUse both tools together:\n- **Apktool**: For resources, manifest, and detailed smali\n- **Jadx**: For readable Java source code\n\n## Troubleshooting\n\n### Problem: \"brut.directory.DirectoryException: Framework\"\n\n**Solution**: Install framework resources:\n```bash\napktool if \u003Cframework-res.apk>\n```\n\n### Problem: Decoding fails with resource errors\n\n**Solution**: Use `--keep-broken-res` flag:\n```bash\napktool d app.apk -o output --keep-broken-res\n```\n\n### Problem: \"Input file was not found or was not readable\"\n\n**Solution**: Check file path and permissions:\n```bash\nls -l app.apk\nfile app.apk  # Should show \"Zip archive data\"\n```\n\n### Problem: Out of memory error\n\n**Solution**: Increase Java heap size:\n```bash\nexport _JAVA_OPTIONS=\"-Xmx2048m\"\napktool d large-app.apk\n```\n\n### Problem: Build fails after modifications\n\n**Solution**: Validate your smali\u002FXML syntax:\n```bash\n# Check for syntax errors\napktool b app-unpacked -o test.apk --use-aapt2\n```\n\n### Problem: APK won't install after repackaging\n\n**Solution**: Sign the APK:\n```bash\njarsigner -verbose -keystore debug.keystore rebuilt.apk androiddebugkey\n```\n\n## Important Notes\n\n- Apktool requires Java Runtime Environment (JRE)\n- Decoded APKs are typically 2-5x larger than original\n- Smali code is more verbose than Java source (use jadx for Java)\n- Always work on copies of APK files, never originals\n- Repackaging requires signing before installation\n- Some obfuscated apps may have unreadable class\u002Fmethod names\n- System apps may require framework installation\n\n## Security and Ethics\n\n**IMPORTANT**: Only analyze APKs you own or have permission to analyze.\n\n- Respect intellectual property and licensing\n- Follow responsible disclosure for vulnerabilities\n- Don't distribute modified APKs without authorization\n- Be aware of terms of service and EULAs\n- Use for authorized security testing and research only\n\n## Example Analysis Session\n\n```bash\n# Complete analysis workflow\nTARGET=\"myapp.apk\"\nOUTPUT=\"myapp-analysis\"\n\n# 1. Unpack\necho \"[+] Unpacking APK...\"\napktool d \"$TARGET\" -o \"$OUTPUT\"\n\n# 2. Basic info\necho \"[+] Package info:\"\ngrep \"package=\" \"$OUTPUT\u002FAndroidManifest.xml\"\n\n# 3. Permissions\necho \"[+] Permissions:\"\ngrep \"uses-permission\" \"$OUTPUT\u002FAndroidManifest.xml\"\n\n# 4. Exported components\necho \"[+] Exported components:\"\ngrep \"exported=\\\"true\\\"\" \"$OUTPUT\u002FAndroidManifest.xml\"\n\n# 5. Search for secrets\necho \"[+] Searching for hardcoded secrets...\"\ngrep -r \"api.*key\\|password\\|secret\" \"$OUTPUT\u002Fres\u002F\" | grep -v \"^Binary\"\n\n# 6. Find URLs\necho \"[+] Finding URLs...\"\ngrep -rE \"https?:\u002F\u002F[^\\\"']+\" \"$OUTPUT\u002Fres\u002F\" | grep -v \"schema\\|xmlns\"\n\n# 7. Check debuggable\necho \"[+] Debug status:\"\ngrep \"debuggable\" \"$OUTPUT\u002FAndroidManifest.xml\" || echo \"Not debuggable (good)\"\n\n# 8. Summary\necho \"[+] Analysis complete. Output in: $OUTPUT\u002F\"\n```\n\n## Success Criteria\n\nA successful apktool analysis includes:\n\n- APK successfully decoded without errors\n- AndroidManifest.xml is readable and analyzed\n- Resources extracted and searchable\n- Smali code available for inspection\n- Security-relevant findings documented\n- Output organized in clear directory structure\n- Any modifications can be repackaged if needed\n\n## Quick Reference\n\n```bash\n# Decode (unpack)\napktool d \u003Capk> -o \u003Coutput-dir>\n\n# Decode with force overwrite\napktool d \u003Capk> -o \u003Coutput-dir> -f\n\n# Decode without resources (faster)\napktool d \u003Capk> -o \u003Coutput-dir> -r\n\n# Decode without source (faster)\napktool d \u003Capk> -o \u003Coutput-dir> -s\n\n# Build (repack)\napktool b \u003Cunpacked-dir> -o \u003Coutput-apk>\n\n# Install framework\napktool if \u003Cframework.apk>\n\n# Empty framework cache\napktool empty-framework-dir\n```\n",{"name":5,"description":7},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fbrownfinesecurity\u002Fapktool",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill apktool",{"tool":57,"command":58},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill apktool",{"tool":60,"command":61},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill apktool","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbrownfinesecurity\u002Fapktool\u002FSKILL.md",true,[65],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"skill-report.json","REFERENCE","参考文档",16671,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbrownfinesecurity\u002Fapktool\u002Fskill-report.json",[72,86,96,105,111,118],{"skillNo":73,"name":74,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":82,"publishedAt":37},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[77],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[83,84,85],"model","model hierarchy","model hierarchy skill",{"skillNo":87,"name":88,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":92,"publishedAt":37},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[91],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},[93,94,95],"MCP","zoom","zoom mcp",{"skillNo":97,"name":98,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":37},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[102,103,104,94],"sdk","zoom apps sdk","apps",{"skillNo":106,"name":107,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":37},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[107],{"skillNo":112,"name":113,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":37},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[116],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},[113],{"skillNo":119,"name":120,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":37},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[120]]