Android Reverse Engineering Skill for Claude Code

1. Introduction

• This document provides a detailed description of the Android Reverse Engineering & API Extraction Claude Code skill. It is a specialized tool designed to decompile Android application packages (APK, XAPK), as well as Java archives (JAR, AAR), and to extract and document the HTTP APIs used by the app. The core value proposition is to enable researchers, security professionals, and developers to document and reproduce network interactions without the original source code.
• The skill is built to reveal practical network interfaces such as Retrofit endpoints, OkHttp calls, hardcoded URLs, and authentication patterns, while preserving the ability to map these calls back to higher-level app components for traceability and reproducibility.
• Beyond API extraction, the skill emphasizes understanding how an app flows from user interactions to network communication. It traces call flows through Activities and Fragments, to ViewModels and repositories, and finally to the HTTP layers, so that analysts can reconstruct end-to-end data paths.
• It also aims to provide insights into the app’s overall structure, including the manifest, package organization, and overarching architectural patterns. In addition, it addresses the realities of obfuscated code, offering strategies for navigating common obfuscation tools such as ProGuard and R8 to retain usable information during analysis.

1. What it does

• Decompilation capabilities:
• Decompiles APK, XAPK, JAR, and AAR files using prominent decompilation engines. The tool can employ jadx for Java bytecode conversion, and it can integrate Fernflower or Vineflower for enhanced output on complex Java code. The design supports a single engine or side-by-side comparison to help users validate results.
• API extraction and documentation:
• Scans decompiled code to identify network interactions, focusing on Retrofit endpoints, OkHttp calls, hardcoded URLs, and authentication mechanisms. It aggregates these findings into a coherent API map that can be documented and reproduced without access to the original sources.
• Call-flow tracing:
• Traces the flow of calls from UI components (Activities, Fragments) through architectural layers (ViewModels, repositories) down to the HTTP layer. This enables a clear understanding of how data travels through the app and where network requests originate.
• Structural analysis:
• Analyzes the app’s structural elements, including the Android manifest and package layout. It identifies architectural patterns such as MVVM, repository patterns, and potential service or broadcast usage, helping analysts discern design decisions and data flows.
• Obfuscation handling:
• Recognizes obfuscated code patterns and provides strategies to navigate ProGuard/R8 output. The aim is to recover meaningful identifiers and relationships, even when source code is heavily transformed.

1. Core capabilities and workflows

• Multi-engine decompilation:
• The skill supports both a default single-engine mode and a comparative, side-by-side mode using Fernflower (or Vineflower) alongside jadx. This dual approach helps users cross-verify results and resolve ambiguities that may arise from obfuscated or optimized bytecode.
• Comprehensive API discovery:
• By focusing on Retrofit and OkHttp usage, the tool extracts endpoint definitions, parameter mappings, headers, tokens, and other authentication artifacts. It also highlights hardcoded URLs that often reveal target domains, environments (development, staging, production), and potential leakage of secrets.
• Call-flow reconstruction:
• The workflow emphasizes the ability to map user actions to resulting HTTP calls. By following the chain from Activities to Fragments, through ViewModels and repositories, to HTTP clients, analysts can reproduce the complete sequence of events that the app triggers during typical operations (login, data fetch, refresh, logout, etc.).
• Application structure and design insights:
• The analysis extends beyond network calls to present a view of software architecture. It can reveal modular boundaries, dependency directions, and common Android patterns, which aids in understanding how the app is organized and how data moves through its layers.
• Obfuscation navigation strategies:
• When confronted with obfuscated identifiers, the tool suggests practical strategies to re-link decompiled symbols with their intended roles. This includes pattern-based reasoning, cross-referencing API usage, and leveraging structural cues to infer method purposes.

1. Requirements

• Required:
• Java JDK 17 or newer. This ensures compatibility with the decompilation tools and the Java bytecode landscape encountered in modern Android apps.
• jadx (CLI). The primary decompiler used to convert DEX/JAR content into readable Java source, enabling further analysis of API calls and data flows.
• Optional (recommended):
• Vineflower or Fernflower. These decompilers provide improved output on complex Java code and can be used in tandem with jadx for a more robust result, especially when code is heavily optimized or obfuscated.
• dex2jar. This tool is needed to convert DEX files to JAR files so that Fernflower or Vineflower can process them, particularly when the workflow requires an alternative decompilation path or deeper Java-level analysis.
• Additional notes:
• A detailed installation guide is available in the setup guide referenced by the skill documentation. Following the setup guide ensures the correct integration of these tools and the proper configuration of the environment for reliable decompilation and analysis.

1. Installation

• From GitHub (recommended):
• In Claude Code, execute:
  • /plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill
  • /plugin install android-reverse-engineering@android-reverse-engineering-skill
• Outcome: The skill becomes permanently available in all future sessions, simplifying access and reuse across projects.
• From a local clone:
• Steps:
  • git clone https://github.com/SimoneAvogadro/android-reverse-engineering-skill.git
  • In Claude Code, run:
  • /plugin marketplace add /path/to/android-reverse-engineering-skill
  • /plugin install android-reverse-engineering@android-reverse-engineering-skill
• Outcome: The local clone becomes the source of truth for the skill, enabling offline or isolated usage within Claude Code.

1. Usage

• Slash command workflow:
• /decompile path/to/app.apk
• This command triggers a full workflow: dependency checks, decompilation, and initial structure analysis. It is designed for rapid, end-to-end processing of a single application artifact.
• Natural language activation:
• The skill responds to natural-language prompts such as:
  • Decompile this APK
  • Reverse engineer this Android app
  • Extract API endpoints from this app
  • Follow the call flow from LoginActivity
  • Analyze this AAR library
• These prompts enable quick, conversational control over complex analysis tasks without memorizing exact commands.
• Manual scripts (standalone utility):
• The toolkit provides a set of scripts that can be invoked directly to perform discrete tasks, enabling users to customize their workflows or integrate the tool into larger automation pipelines. Representative scripts include:
  • check-deps.sh: Verifies the presence of required dependencies and environment setup.
  • install-dep.sh: Installs missing dependencies, auto-detecting OS and package manager.
  • decompile.sh: Decompiles an APK (default), XAPK, or a JAR/AAR. It supports:
  • decompile.sh app.apk
  • decompile.sh app-bundle.xapk (auto-extracts and decompiles each APK inside)
  • decompile.sh --engine fernflower library.jar (to use Fernflower explicitly)
  • decompile.sh --engine both --deobf app.apk (to run both engines and compare results)
  • find-api-calls.sh: Locates API calls within the decompiled sources and can filter by Retrofit endpoints, URLs, and other patterns:
  • find-api-calls.sh output/sources/
  • find-api-calls.sh output/sources/ --retrofit
  • find-api-calls.sh output/sources/ --urls
• Illustrative usage example:
• A user can first run the dependency check, install any missing tools if required, choose a decompiler engine, decompile an APK, and then run a dedicated script to extract API calls. The process can be performed in sequence or invoked from a single slash command that orchestrates all steps.

1. Detailed script and workflow walk-through

• Phase 1: Dependency verification
• The system checks for Java JDK 17+, jadx, and optional decompilers like Vineflower or Fernflower. If a required component is missing, the install-dep.sh script prompts for OS and package-manager-specific installation commands.
• Phase 2: Decompilation strategy
• The default engine is jadx, with optional Fernflower or Vineflower for more nuanced code structures. The user can select a single engine or opt to run both engines to compare outputs and reconcile discrepancies.
• Phase 3: Initial structure and heuristic analysis
• After decompilation, the skill conducts an initial pass to identify key project components: manifests, resource modules, package names, and high-level architecture patterns. This phase sets the stage for deeper API extraction and call-flow tracing.
• Phase 4: API extraction
• The tool scans for network calls, focusing on Retrofit interfaces, OkHttp usage, and hardcoded endpoints. It captures authentication headers and tokens where visible, documenting patterns and potential security implications.
• Phase 5: Call-flow mapping
• Analysts gain a map from UI entry points through ViewModels and repositories to HTTP calls. The trace highlights data paths, request sequences, and potential state transitions that correspond to user actions.
• Phase 6: Obfuscation handling and interpretation
• When identifiers are obfuscated, the tool provides strategies to infer meanings through structural cues, usage context, and cross-referenced API calls. Analysts can annotate findings to maintain clarity despite obfuscated naming.
• Phase 7: Documentation generation
• The extracted data can be compiled into API documentation that details endpoints, HTTP methods, headers, tokens, and the relationship to app modules. This documentation is intended to be reproduceable and testable, even without the original source code.

1. Repository structure (conceptual overview)

• android-reverse-engineering-skill/
• .claude-plugin/
  • marketplace.json: Marketplace catalog entry describing the skill for Claude Code users.
• plugins/
  • android-reverse-engineering/
  • .claude-plugin/
    • plugin.json: Plugin manifest used by Claude Code to load and configure the skill.
  • skills/
    • android-reverse-engineering/
    • SKILL.md: Core workflow description, outlining the five-phase process from decompilation to analysis.
    • references/
      • setup-guide.md: Detailed steps for setting up the environment and prerequisites.
      • jadx-usage.md: Guidance on using jadx effectively.
      • fernflower-usage.md: Guidance on using Fernflower and Vineflower.
      • api-extraction-patterns.md: Patterns and heuristics for identifying API calls.
      • call-flow-analysis.md: Methodologies for analyzing call flows through app layers.
    • scripts/
      • check-deps.sh: Dependency validation script.
      • install-dep.sh: OS-aware installation script for missing tools.
      • decompile.sh: Script to run the decompilation workflow with optional engines.
      • find-api-calls.sh: Script to locate API calls within decompiled sources.
  • commands/
    • decompile.md: Documentation for the /decompile slash command and its options.
• LICENSE
• README.md

1. Visual and reference materials

• The underlying tooling ecosystem includes well-known decompilers and auxiliary tools. While the specific input describes the use of jadx for decompilation and Fernflower/Vineflower as alternative engines, it also notes dex2jar as a companion tool to enable Fernflower on APK/DEX files.
• Understanding these tools is important for practitioners who want to replicate, customize, or extend the workflow. The references section lists primary sources for the decompilers and related tooling, as well as a project-specific setup guide that provides installation instructions.

1. References

• Jadx — Dex to Java decompiler: A widely used tool for converting Dalvik/DEX bytecode to Java source, enabling readable analysis of Android applications.
• Fernflower — JetBrains analytical decompiler: A high-quality decompiler used to enhance output quality for complex Java code.
• Vineflower — Fernflower community fork: An actively maintained fork that improves upon Fernflower’s capabilities and compatibility.
• dex2jar — DEX to JAR converter: A utility that converts Android DEX files to JARs to enable alternative decompilation paths.
• Apktool — Android resource decoder: Useful for decoding resources and resources-related analysis, often complementary to code decompilation.

1. Legal and safety considerations

• Disclaimer:
• This plugin is provided strictly for lawful purposes, including but not limited to security research and authorized penetration testing, interoperability analysis permitted under applicable law, malware analysis and incident response, and educational use and CTF competitions. These are legitimate use cases where reverse engineering is permitted by contract, law, or policy.
• Users are solely responsible for ensuring that their use of this tool complies with all applicable laws, regulations, and terms of service. Unauthorized reverse engineering of software you do not own or do not have permission to analyze may violate intellectual property laws and computer fraud statutes in your jurisdiction. The authors disclaim liability for misuse.
• Practical usage guidance:
• Always obtain explicit authorization before analyzing third-party apps or software. Use cases should align with legal boundaries and any governing regulations in your jurisdiction.

1. Licensing

• Apache 2.0 license:
• The project is released under the Apache License, Version 2.0. This license governs distribution, modification, and usage rights, and it requires proper attribution and a copy of the license with any redistributed or modified works.

1. Images and visual content

• Images in the input:
• The provided input does not include embedded images or graphic assets. Consequently, no images are embedded in this description.
• Visual references (if needed in the future):
• When available, add schematic diagrams illustrating the call-flow from UI components to HTTP calls, or a workflow diagram showing the five phases (dependency check, decompilation, structure analysis, API extraction, and documentation generation). These visuals can help readers quickly grasp the end-to-end process and the relationships between components.

1. About usage scope and outcomes

• Intended audience and benefits:
• This skill is valuable for security researchers, app developers performing security assessments, interoperability analysts, and educators teaching reverse engineering concepts. By providing an end-to-end workflow that decompiles code, documents APIs, and maps call flows, it helps teams understand external network interactions and identify potential security or privacy concerns.
• Typical outputs:
• A documented map of Retrofit endpoints, OkHttp calls, and hardcoded URLs.
• A traced call-flow diagram (described textually here for accessibility) from user actions through UI layers to HTTP requests.
• A structural analysis report highlighting packaging, manifests, and architectural patterns.
• An obfuscation-handling note with suggested steps to recover meaningful names and relationships in the presence of ProGuard/R8 output.

1. Summary and practical takeaways

• The Android Reverse Engineering & API Extraction Claude Code skill embodies a cohesive workflow that starts with decompilation, proceeds through API extraction, and culminates in call-flow analysis and structural understanding. It emphasizes the practical ability to reproduce and document network interactions in Android apps without access to source code, while acknowledging the challenges posed by obfuscation.
• By integrating standard decompilation tools (jadx and Fernflower/Vineflower) and supporting both single-engine and dual-engine workflows, the skill offers flexibility to adapt to varied code quality and obfuscation levels.
• The installation and usage pathways are designed for accessibility, enabling users to run either through a dedicated slash command or via natural-language prompts, with optional script-based automation for more complex or repeatable tasks.
• The accompanying repository structure and references provide a clear pathway for learning, customization, and extension, ensuring that practitioners can adapt the workflow to evolving Android security and reverse-engineering practices.

Images: No images were provided in the input. If images become available, they can be incorporated as visual aids illustrating the decompilation flow, the call-flow mapping, or a sample API extraction output.