Apktool — Android APK Reverse Engineering

Introduction

Apktool is a widely used open-source tool for reverse engineering Android APK files. It can decode resources to nearly original form, disassemble DEX bytecode to smali, and rebuild modified packages back into APKs. The project is maintained by iBotPeaches and is a standard tool in Android security research and modding workflows.

What Apktool Does

• Decodes APK resources (layouts, strings, manifests) back to their original XML form
• Disassembles DEX bytecode into smali, a human-readable assembly format for Dalvik
• Rebuilds modified smali code and resources into a valid APK file
• Handles framework resources for manufacturer-specific Android builds
• Supports batch processing of multiple APK files in scripted workflows

Architecture Overview

Apktool is a Java application that wraps several components for Android binary processing. Resource decoding relies on a custom AXML parser that reverses the Android binary XML format. DEX disassembly uses the smali/baksmali library to convert Dalvik bytecode into readable assembly. The rebuild pipeline recompiles smali back to DEX, re-encodes resources using aapt/aapt2, and packages everything into a new APK structure ready for signing.

Self-Hosting & Configuration

• Requires Java 8 or higher; distributed as a single JAR file with a wrapper script
• Install framework files for device-specific APKs using apktool if framework-res.apk
• Configuration stored in $HOME/.local/share/apktool/ on Linux or %USERPROFILE%AppDataLocalapktool on Windows
• Use the --use-aapt2 flag to enable aapt2 for improved resource compilation
• Integrates with Android build toolchains and can be called from CI pipelines

Key Features

• Lossless resource decoding that preserves the original directory structure and file names
• Smali debugging support allowing step-through debugging of disassembled code
• Automatic handling of 9-patch PNG images and binary XML formats
• Framework management for decoding APKs that depend on vendor frameworks
• Active maintenance with support for the latest Android SDK and resource formats

Comparison with Similar Tools

• jadx: Decompiles DEX directly to Java source code for reading, but does not support rebuilding; Apktool uses smali for a decode-modify-rebuild workflow
• APK Studio: Provides a GUI wrapper around Apktool and other tools; Apktool itself is command-line focused
• dex2jar + JD-GUI: Converts DEX to JAR for Java decompilation but loses Android resource context; Apktool preserves full APK structure
• Android Studio APK Analyzer: Built into the IDE for inspection only; Apktool supports both analysis and modification

FAQ

Q: Do I need to sign the APK after rebuilding with Apktool? A: Yes. Apktool produces an unsigned APK. You must sign it with apksigner or jarsigner and optionally zipalign it before installing on a device.

Q: Can Apktool decompile DEX code to Java? A: No. Apktool disassembles DEX to smali (Dalvik assembly). For Java source output, use a decompiler like jadx or dex2jar in combination with Apktool.

Q: Why does decoding fail with "Could not decode arsc file"? A: This usually means the APK uses a framework not installed in Apktool. Install the device's framework-res.apk with apktool if framework-res.apk before decoding.

Q: Does Apktool work with app bundles (AAB)? A: Apktool operates on APK files. For AAB files, use bundletool to generate APKs first, then process them with Apktool.

Sources

• Repository: https://github.com/iBotPeaches/Apktool
• Documentation: https://ibotpeaches.github.io/Apktool/