reverse-engineering-android-malware-with-jadx
Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest permissions, receivers, services, and native libraries. Activates for requests involving Android malware analysis, APK reverse engineering, mobile malware investigation, or Android threat analysis. '
- License 许可
- Apache-2.0
- 最近更新
- 2026-04-24
- Stars
- ★ 0
- Forks
- 0
01 前言 Front Matter
- name
- reverse-engineering-android-malware-with-jadx
- tags
- [ "malware", "Android", "reverse-engineering", "JADX", "mobile-malware" ]
- author
- mahipal
- domain
- cybersecurity
- license
- Apache-2.0
- version
- 1.0.0
- nist_csf
- [ "DE.AE-02", "RS.AN-03", "ID.RA-01", "DE.CM-01" ]
- subdomain
- malware-analysis
- description
- Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest permissions, receivers, services, and native libraries. Activates for requests involving Android malware analysis, APK reverse engineering, mobile malware investigation, or Android threat analysis. '
02 资源文件 4
- 参考文档agents/openai.yaml338 B
- 许可证LICENSE11.0 KB
- 参考文档references/api-reference.md2.4 KB
- 脚本scripts/agent.py7.6 KB
03 SKILL.md 正文
reverse engineering android malware with jadx
Use this skill when the task matches the description above. Keep the initial response concise and only open bundled references or scripts when they are clearly needed.
Quick cues
- A suspicious Android APK has been reported as malicious or flagged by mobile threat detection
- Analyzing Android banking trojans, spyware, SMS stealers, or adware samples
- Determining what data an app collects, where it sends it, and what permissions it abuses
- Extracting C2 server addresses, encryption keys, and configuration data from Android malware
- Understanding overlay attack mechanisms used by banking trojans
- JADX 1.5+ installed (download from https://github.com/skylot/jadx/releases)
- Android SDK with
aapt2andadbtools for APK inspection - apktool for full APK disassembly including smali code and resources
Available sections
- Reverse Engineering Android Malware with JADX
- When to Use
- Prerequisites
- Workflow
- Step 1: Extract APK Metadata and Permissions
- Get APK basic info
- Extract AndroidManifest.xml
- Analyze permissions with androguard
- Dangerous permissions
- Components
- Step 2: Decompile with JADX
- Open in JADX GUI
Bundled resources
- references
- scripts
Open these resources only if the current task needs deeper detail or executable helpers.
04 同仓库更多 Skills
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
web-artifacts-builder
Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components - not for simple single-file HTML/JSX artifacts.
theme-factory
Toolkit for styling artifacts with a theme. These artifacts can be slides, docs, reportings, HTML landing pages, etc. There are 10 pre-set themes with colors/fonts that you can apply to any artifact that has been creating, or can generate a new theme on-the-fly.
slack-gif-creator
Knowledge and utilities for creating animated GIFs optimized for Slack. Provides constraints, validation tools, and animation concepts. Use when users request animated GIFs for Slack like "make me a GIF of X doing Y for Slack.
skill-creator
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
railway-database
Add official Railway database services (Postgres, Redis, MySQL, MongoDB). Use when user wants to add a database, says "add postgres", "add redis", "add database", "connect to database", or "wire up the database". For other templates (Ghost, Strapi, n8n), use the railway-templates skill.