apk.sh
Makes reverse engineering Android apps easier, automating repetitive tasks like pulling, decoding, rebuilding and patching an APK.
A Bash script that automates pulling, decoding, patching, and rebuilding Android APK files, including injecting a Frida monitoring gadget for dynamic analysis without needing a rooted device.
apk.sh is a Bash script that automates common tasks involved in inspecting and modifying Android app files. Android apps are distributed as APK files, which are compressed archives containing compiled code, resources, and metadata. To understand what an app does at a technical level, security researchers and developers often need to pull the APK off a device, decode it into a readable form, modify it, and reinstall it. apk.sh chains these steps together so you do not have to run each tool separately.
The script wraps two main underlying tools. It uses apktool to disassemble an APK into human-readable files and to reassemble modified files back into a working APK. It uses Frida, a dynamic analysis toolkit, to inject a monitoring library called frida-gadget.so into the app so the app can be inspected or scripted as it runs. The Frida gadget approach means you do not need a rooted Android device to instrument the app, which makes the workflow accessible on ordinary hardware.
The four primary subcommands are pull, decode, build, and patch. Pull downloads an APK from a connected device or emulator by package name. Decode turns an APK into a folder of readable files. Build turns a modified folder back into a signed APK ready to install. Patch modifies an APK to load the Frida gadget when the app starts, which is what allows dynamic analysis. A separate rename subcommand changes the package name of an APK.
The tool supports app bundles and split APKs, which are apps distributed as multiple separate APK files. When pulling or patching a split APK, apk.sh combines the pieces into a single unified APK. Architecture support covers arm, arm64, x86, and x86_64 devices. The signing step uses apksigner, and the script requires a handful of standard Android development tools to be installed on your machine.
Where it fits
- Pull an APK from a connected Android device and decode it into readable files to inspect what the app does.
- Patch an APK to load the Frida gadget so you can trace its network calls and function behaviour without rooting the phone.
- Rebuild a modified APK, sign it, and reinstall it on a device for security testing or reverse engineering research.
- Rename the package name of an APK to install two versions of the same app side-by-side on a device.