brownfinesecurity
Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.
bunx add-skill brownfinesecurity/iothackbot -s jadxLoadingβ¦
You are helping the user decompile Android APK files using jadx to convert DEX bytecode into readable Java source code for security analysis, vulnerability discovery, and understanding app internals.
Jadx is a dex to Java decompiler that produces clean, readable Java source code from Android APK files. Unlike apktool (which produces smali), jadx generates actual Java code that's much easier to read and analyze. It's essential for:
Jadx provides two interfaces:
CLI (jadx): Command-line interface
GUI (jadx-gui): Graphical interface
When to use each:
Standard decompile command:
jadx <apk-file> -d <output-directory>
Example:
jadx app.apk -d app-decompiled
With deobfuscation (recommended for obfuscated apps):
jadx --deobf app.apk -d app-decompiled
After decompilation, the output directory contains:
app-decompiled/
βββ sources/ # Java source code
β βββ com/company/app/ # Package structure
β βββ MainActivity.java
β βββ utils/
β βββ network/
β βββ ...
βββ resources/ # Decoded resources
βββ AndroidManifest.xml # Readable manifest
βββ res/ # Resources
β βββ layout/ # XML layouts
β βββ values/ # Strings, colors
β βββ drawable/ # Images
β βββ ...
βββ assets/ # App assets
Multi-threaded decompilation (faster):
jadx -j 4 app.apk -d output
# -j specifies number of threads (default: CPU cores)
Skip resources (code only, much faster):
jadx --no-res app.apk -d output
Skip source code (resources only):
jadx --no-src app.apk -d output
Enable deobfuscation:
jadx --deobf app.apk -d output
Deobfuscation map output:
jadx --deobf --deobf-rewrite-cfg --deobf-use-sourcename app.apk -d output
Show inconsistent/bad code:
jadx --show-bad-code app.apk -d output
Export as Gradle project:
jadx --export-gradle app.apk -d output
Fallback mode (when decompilation fails):
jadx --fallback app.apk -d output
After decompilation, search for common security issues:
# Search for API keys
grep -r "api.*key\|apikey\|API_KEY" app-decompiled/sources/
# Search for passwords and credentials
grep -r "password\|credential\|secret" app-decompiled/sources/
# Search for hardcoded URLs
grep -rE "https?://[^\"]+" app-decompiled/sources/
# Search for encryption keys
grep -r "AES\|DES\|RSA\|encryption.*key" app-decompiled/sources/
# Search for tokens
grep -r "token\|auth.*token\|bearer" app-decompiled/sources/
# Search for database passwords
grep -r "jdbc\|database\|db.*password" app-decompiled/sources/
SQL Injection:
grep -r "SELECT.*FROM.*WHERE" app-decompiled/sources/ | grep -v "PreparedStatement"
grep -r "rawQuery\|execSQL" app-decompiled/sources/
Insecure Crypto:
grep -r "DES\|MD5\|SHA1" app-decompiled/sources/
grep -r "SecureRandom.*setSeed" app-decompiled/sources/
grep -r "Cipher.getInstance" app-decompiled/sources/ | grep -v "AES/GCM"
Insecure Storage:
grep -r "SharedPreferences" app-decompiled/sources/
grep -r "MODE_WORLD_READABLE\|MODE_WORLD_WRITABLE" app-decompiled/sources/
grep -r "openFileOutput" app-decompiled/sources/
WebView vulnerabilities:
grep -r "setJavaScriptEnabled.*true" app-decompiled/sources/
grep -r "addJavascriptInterface" app-decompiled/sources/
grep -r "WebView.*loadUrl" app-decompiled/sources/
Certificate pinning bypass:
grep -r "TrustManager\|HostnameVerifier" app-decompiled/sources/
grep -r "checkServerTrusted" app-decompiled/sources/
Find entry points:
# Main activities
grep -r "extends Activity\|extends AppCompatActivity" app-decompiled/sources/
# Application class
grep -r "extends Application" app-decompiled/sources/
# Services
grep -r "extends Service" app-decompiled/sources/
# Broadcast receivers
grep -r "extends BroadcastReceiver" app-decompiled/sources/
Trace network communication:
# Find HTTP client usage
grep -r "HttpURLConnection\|OkHttpClient\|Retrofit" app-decompiled/sources/
# Find API endpoints
grep -r "@GET\|@POST\|@PUT\|@DELETE" app-decompiled/sources/
# Find base URLs
grep -r "baseUrl\|BASE_URL\|API_URL" app-decompiled/sources/
Find authentication logic:
grep -r "login\|Login\|authenticate\|Authorization" app-decompiled/sources/
grep -r "jwt\|JWT\|bearer\|Bearer" app-decompiled/sources/
After identifying interesting classes, read them directly:
# View specific class
cat app-decompiled/sources/com/example/app/LoginActivity.java
# Use less for pagination
less app-decompiled/sources/com/example/app/network/ApiClient.java
# Search within specific class
grep "password" app-decompiled/sources/com/example/app/LoginActivity.java
Launch GUI:
jadx-gui app.apk
GUI features:
GUI workflow:
Both tools complement each other:
Jadx strengths:
Apktool strengths:
Recommended workflow:
# Use jadx for code analysis
jadx --deobf app.apk -d app-jadx
# Use apktool for resources and smali
apktool d app.apk -o app-apktool
# Analyze both outputs
grep -r "API_KEY" app-jadx/sources/
grep -r "api_key" app-apktool/res/
# 1. Decompile with deobfuscation
jadx --deobf app.apk -d app-decompiled
# 2. Search for hardcoded secrets
echo "[+] Searching for API keys..."
grep -ri "api.*key\|apikey" app-decompiled/sources/ | tee findings-apikeys.txt
echo "[+] Searching for passwords..."
grep -ri "password\|passwd\|pwd" app-decompiled/sources/ | tee findings-passwords.txt
echo "[+] Searching for URLs..."
grep -rE "https?://[^\"]+" app-decompiled/sources/ | tee findings-urls.txt
# 3. Check crypto usage
echo "[+] Checking crypto implementations..."
grep -r "Cipher\|SecretKey\|KeyStore" app-decompiled/sources/ | tee findings-crypto.txt
# 4. Check for insecure storage
echo "[+] Checking storage mechanisms..."
grep -r "SharedPreferences\|SQLite\|openFileOutput" app-decompiled/sources/ | tee findings-storage.txt
# 5. Summary
echo "[+] Analysis complete. Check findings-*.txt files"
For IoT companion apps, find device communication:
# 1. Decompile
jadx --deobf iot-app.apk -d iot-app-decompiled
# 2. Find device communication
echo "[+] Finding device endpoints..."
grep -rE "https?://[^\"]+" iot-app-decompiled/sources/ | \
grep -v "google\|android\|facebook" | \
tee device-endpoints.txt
# 3. Find API structure
echo "[+] Finding API definitions..."
grep -r "@GET\|@POST\|@PUT" iot-app-decompiled/sources/ | tee api-endpoints.txt
# 4. Find authentication
echo "[+] Finding auth mechanisms..."
grep -r "Authorization\|authentication\|apiKey" iot-app-decompiled/sources/ | tee auth-methods.txt
# 5. Find device discovery
echo "[+] Finding device discovery..."
grep -r "discover\|scan\|broadcast\|mdns" iot-app-decompiled/sources/ | tee device-discovery.txt
# 6. Check for certificate pinning
echo "[+] Checking certificate pinning..."
grep -r "CertificatePinner\|TrustManager" iot-app-decompiled/sources/ | tee cert-pinning.txt
# Fast decompilation without resources
jadx --no-res --deobf app.apk -d app-code
# Search for common credential patterns
grep -r "username.*password\|user.*pass" app-code/sources/
grep -r "admin\|root\|default.*password" app-code/sources/
grep -r "hardcoded\|TODO.*password\|FIXME.*password" app-code/sources/
# Decompile
jadx app.apk -d app-decompiled
# Find Retrofit/REST API definitions
find app-decompiled/sources -name "*Api*.java" -o -name "*Service*.java" -o -name "*Client*.java"
# Extract all endpoints
grep -r "@GET\|@POST\|@PUT\|@DELETE\|@PATCH" app-decompiled/sources/ | \
sed 's/.*@\(GET\|POST\|PUT\|DELETE\|PATCH\)("\([^"]*\)".*/\1 \2/' | \
sort -u
# Find base URLs
grep -r "baseUrl\|BASE_URL\|API_BASE" app-decompiled/sources/
# Decompile multiple APKs
for apk in *.apk; do
name=$(basename "$apk" .apk)
echo "[+] Processing $apk..."
jadx --no-res --deobf "$apk" -d "decompiled-$name"
# Quick search for secrets
grep -r "api.*key\|password\|secret" "decompiled-$name/sources/" > "findings-$name.txt"
done
echo "[+] All APKs processed. Check findings-*.txt files"
# Most production apps are obfuscated
jadx --deobf app.apk -d output
Without --deobf, you'll see code like:
public class a {
public void b(String c) { ... }
}
With --deobf, jadx attempts meaningful names:
public class NetworkClient {
public void sendRequest(String url) { ... }
}
# Faster decompilation
jadx -j 8 large-app.apk -d output
# 3-5x faster when you only need code
jadx --no-res app.apk -d output
Create a search checklist:
For complex apps:
Static analysis (jadx) + dynamic analysis:
Solution: Use fallback mode or show bad code:
jadx --fallback --show-bad-code app.apk -d output
Solution: Enable deobfuscation:
jadx --deobf app.apk -d output
Solution: Increase Java heap size:
export JAVA_OPTS="-Xmx4096m"
jadx app.apk -d output
Or use the built-in option:
jadx -Xmx4096m app.apk -d output
Solution: Skip resources or use more threads:
jadx --no-res -j 8 app.apk -d output
Solution: Use --show-bad-code to see partial decompilation:
jadx --show-bad-code app.apk -d output
Solution: Use CLI first to check for errors:
jadx app.apk -d test-output
# If successful, try GUI again
jadx --export-gradle app.apk -d app-project
cd app-project
./gradlew build
Creates a buildable Android Studio project.
jadx --deobf --deobf-use-sourcename app.apk -d output
# Check output/mapping.txt for name mappings
# All options combined
jadx \
--deobf \
--deobf-use-sourcename \
--show-bad-code \
--no-imports \
--no-inline-anonymous \
--no-replace-consts \
app.apk -d output
Jadx fits into the IoTHackBot workflow:
APK β API Discovery:
APK β Credential Extraction:
APK β Protocol Analysis:
APK β Device Enumeration:
# Basic decompilation
jadx <apk> -d <output-dir>
# With deobfuscation (recommended)
jadx --deobf <apk> -d <output-dir>
# Fast (no resources)
jadx --no-res <apk> -d <output-dir>
# Multi-threaded
jadx -j <threads> <apk> -d <output-dir>
# Show problematic code
jadx --show-bad-code <apk> -d <output-dir>
# Export as Gradle project
jadx --export-gradle <apk> -d <output-dir>
# GUI mode
jadx-gui <apk>
# Fallback mode
jadx --fallback <apk> -d <output-dir>
Use this checklist when analyzing APKs with jadx:
IMPORTANT: Only decompile APKs you own or have permission to analyze.
A successful jadx analysis includes:
Use when you need to run Flow type checking, or when seeing Flow type errors in React code.
Use when you want to validate changes before committing, or when you need to check all React contribution requirements.
Use when feature flag tests fail, flags need updating, understanding @gate pragmas, debugging channel-specific test failures, or adding new flags to React.
Use when you need to check feature flag states, compare channels, or debug why a feature behaves differently across release channels.