Android app reverse engineering with AI: APK to working code

A guide published on AI-assisted Android app reverse engineering documents a workflow that pulls an APK from an owned device, decompiles it with JADX and Apktool, and hands the code tree to an AI agent such as Claude Code or OpenCode for analysis. The guide cites four projects, including a Kyocera softkey API reconstruction using OpenCode with Gemini 3 Flash that consumed 47,573 tokens at about $0.05, and a Bluetti EP760 home battery integration built with Claude Code that took an evening for the cloud gateway and a weekend for Bluetooth. The guide warns the approach fails on native libraries under lib/<abi>/*.so, Flutter apps compiled ahead of time to native machine code, React Native Hermes bytecode bundles, and certificate-pinned traffic, and it excludes licence-check bypass, root or tamper detection, and DRM from scope.

Android app reverse engineering with AI: APK to working code Pull an APK from your own phone, decompile it with JADX and Apktool, hand the tree to an AI agent, and check its answers on a real device. Decompiled Android apps are large, obfuscated and tedious to read, which makes them a good fit for an AI agent. People have used this to connect home batteries to Home Assistant, recover an undocumented phone API for about five cents, and work out what pre-installed software on a cheap projector was doing. This guide covers the workflow for apps on devices you own, for interoperability, your own development or defensive analysis. Before you start before-you-start - An Android device you own , with Developer options and USB debugging turned on. Android hides Developer options by default; the developer options page https://developer.android.com/studio/debug/dev-options explains how to show them. - adb from Android's platform-tools. - Java : JADX needs 64-bit Java 11 or later unless you use its with-jre bundle. Apktool needs at least Java 8. - An agent that can read files and run shell commands: Claude Code https://reversedwithai.com/tools/claude-code , or OpenCode with a model of your choice as in the Kyocera project. - Cost: the Kyocera reconstruction used 47,573 tokens, about $0.05. Larger apps cost more. Michael Still notes he would not pay to analyse very large, heavily obfuscated apps himself. Out of scope: bypassing licence checks, root or tamper detection, DRM, or anything that lets an app run in a way its maker blocks. The projects below only read code to understand how an app talks to hardware or to the OS. What it took in the projects what-it-took-in-the-projects | Project | Goal | Agent and model | Time and cost reported | |---|---|---|---| | Kyocera softkey API https://reversedwithai.com/p/kyocera-softkey-api-gemini-opencode | Rebuild one hidden system API | OpenCode with Gemini 3 Flash | Seconds per run; 47,573 tokens, about $0.05 | | Bluetti EP760 https://reversedwithai.com/p/bluetti-ep760-home-assistant | Talk to a home battery without the vendor app | Claude Code | Cloud gateway in an evening, Bluetooth over a weekend | | Emaldo home battery https://reversedwithai.com/p/emaldo-home-battery | Read a battery's local protocol | Claude Code | One day, per the write-up's title | | Android projector https://reversedwithai.com/p/android-projector-malware | Find out what pre-installed apps were doing | Claude Code | Not stated | The pattern: one narrow question about one app finishes in hours, not weeks. A whole-app rewrite is a different project. When this approach is not enough when-this-approach-is-not-enough JADX only shows code that was compiled to DEX. Look inside the APK before you start, because some apps keep their logic elsewhere: - Native libraries. Code under lib/<abi / .so is machine code called through JNI. JADX shows only the Java side of the call. Open the .so in Ghidra, ideally through an MCP server so the agent can read it setup guide https://reversedwithai.com/learn/set-up-ghidramcp-with-claude-code . - Flutter apps. Flutter compiles the app's Dart code ahead of time into native machine code Flutter FAQ https://docs.flutter.dev/resources/faq , which ships as a native library under lib/ . JADX will show little beyond the Flutter engine's Java wrapper. - React Native apps. The logic is a JavaScript bundle in assets/ , often index.android.bundle . With Hermes it is precompiled bytecode rather than readable JavaScript Hermes docs https://reactnative.dev/docs/hermes . - Certificate pinning. If you also want to watch the app's traffic, an app that pins its server certificate will refuse your proxy network security configuration https://developer.android.com/privacy-and-security/security-config . Reading the decompiled code still works. Getting around the pin is out of scope here. For a protocol over Bluetooth rather than the internet, the capture route in the Bluetooth guide https://reversedwithai.com/learn/reverse-engineer-a-bluetooth-device-with-ai usually beats reading the app. Step 1: Get the APK from your own device step-1-get-the-apk-from-your-own-device The most reliable source is the phone where the app is already installed. These are the documented adb and package manager commands: adb devices confirm the phone is connected adb shell pm list packages vendor filter package names containing "vendor" adb shell pm list packages -3 or list third-party apps only adb shell pm path com.vendor.app print the APK path s adb pull /data/app/.../base.apk ./apks/ copy each path printed above Modern apps are often split into a base.apk plus split APKs, so pm path may print several lines. Tom Barrasso's Kyocera script https://barrasso.me/posts/2026-01-11-android-reverse-engineering-with-opencode/ ran pm path for each package and pulled every base and split APK. He picked candidates from about 200 packages on a Kyocera flip phone, partly by intuition and partly by asking an LLM. For system apps that came with the device, the same commands work. Zane St. John listed the projector's packages https://zanestjohn.com/blog/reing-with-claude-code and flagged the ones whose namespace did not match the vendor. Michael Still got the Bluetti app from a Play Store mirroring site because Claude could not download it from the Play Store. If you have the device and the app, pulling it yourself avoids trusting a third party's copy. Step 2: Decompile with JADX and Apktool step-2-decompile-with-jadx-and-apktool Use both tools. They give the agent different views. - JADX https://reversedwithai.com/tools/jadx turns DEX bytecode into readable Java. Install it from its GitHub releases https://github.com/skylot/jadx/releases , with brew install jadx on macOS, sudo pacman -S jadx on Arch, or flatpak install flathub com.github.skylot.jadx . - Apktool https://apktool.org/docs/install decodes resources, the manifest and Smali. The current release is 3.0.3. Install it with the wrapper script and jar from the install page, or brew install apktool . jadx -d out/jadx --show-bad-code apks/base.apk apktool d -f apks/base.apk -o out/apktool --show-bad-code keeps methods JADX could not decompile cleanly instead of dropping them. The JADX README https://github.com/skylot/jadx also lists --deobf to rename very short obfuscated names and -e to export a Gradle project. JADX's usage line accepts several input files, plus .apks , .xapk and .apkm bundles. With Apktool, -o sets the output folder and -f overwrites an existing one CLI parameters https://apktool.org/docs/cli-parameters . Smali is worth keeping even when the Java looks fine. Barrasso's whole reconstruction worked from Apktool's Smali output. Step 3: Set up the agent's workspace step-3-set-up-the-agents-workspace Put the outputs in one folder and start the agent there: myapp-re/ apks/ the files you pulled out/jadx/ Java sources and resources out/apktool/ Smali, AndroidManifest.xml, res/ captures/ traffic logs, if you have them NOTES.md findings, each marked confirmed or inferred Put a few standing rules in the project instructions CLAUDE.md for Claude Code : treat out/ as read-only, cite a file and line for every claim, mark anything not seen in code or traffic as inferred, and write findings to NOTES.md . St. John's projector brief had the same parts: the decompiled source, the available tools, a written mission with deliverables, an instruction to think carefully before major steps, a todo list, and hints about where to start. Do your own first pass if you can. The Emaldo author had already decompiled the app, grepped for BLE UUIDs and noted the API endpoints before he opened Claude Code. Step 4: Ask for specific things step-4-ask-for-specific-things Broad questions get broad answers. These worked in the projects: - Reconstruct an API. Barrasso grepped the Smali, found a help screen that called the hidden KCfpSoftkeyGuide class, and asked Gemini 3 Flash in OpenCode to "Reassemble" that Smali file into its original Java class, concentrating on the Kyocera APIs it calls. The run took seconds. - Implement a protocol from the client code. Claude Code read the decompiled Bluetti app and built a cloud-to-MQTT gateway in an evening, then a BLE implementation over a weekend. - Map what an app does. On the projector, Claude wrote its own helper scripts to decode obfuscated strings, mapped the components and traced how they talked to each other. - Explain obfuscated code. On Emaldo, Claude traced classes with names like n0.a and n0.b to find which key each message type used. Ask the agent to write a small client or test, not just an explanation. Running code is what you can check. Check it works check-it-works Test on the real device, and keep a log of what passed: - Barrasso added the reconstructed softkey API to his podcast app, PodLP, and ran it on a Kyocera DuraXV Extreme. A softkey bar that previously stayed on screen after the volume dialog stopped doing so. - Still's Bluetti gateway had been running for a couple of weeks at the time of his write-up. - Use adb logcat https://developer.android.com/tools/logcat while you test to see your app's errors and the system's reaction. For a protocol, compare your client's output against the vendor app on the same device. The Bluetooth guide https://reversedwithai.com/learn/reverse-engineer-a-bluetooth-device-with-ai covers capturing that traffic. Defensive analysis of suspicious apps defensive-analysis-of-suspicious-apps The projector project is a defensive investigation. St. John noticed DNS queries from a new projector on his Pi-hole before he had opened any app. He pulled the pre-installed APKs, decompiled them with JADX and gave Claude Code the source. Claude found that the software enrols the owner's network in a residential proxy service. His recommendations: disable the packages, block the domains at the router or DNS, isolate such devices on their own network segment with outbound traffic blocked, and remember that a factory reset may reinstall the software. If you do this, analyse decompiled code in an isolated VM, keep the device off your main network, and do not run or share the sample. Static reading is enough to understand behaviour. Where AI goes wrong where-ai-goes-wrong - Stubs that look like code. Gemini's KCfpSoftkeyGuide methods were empty placeholders, because the framework implementation was not in the APK it read. Resource labels were guessed, and the listener method was missing until Barrasso searched further. The API had also already been documented by others, so check for prior work kyocera-softkey-api-gemini-opencode https://reversedwithai.com/p/kyocera-softkey-api-gemini-opencode . - Wrong assumptions about the other side. The projector agent's first client assumed responses looked like requests. It fixed this by re-reading the code android-projector-malware https://reversedwithai.com/p/android-projector-malware . - Giving up on crypto too early. Claude only got past Bluetti's authentication after being told to read the decompiled Java harder. It also confused two protocol paths that the app contains for different hardware bluetti-ep760-home-assistant https://reversedwithai.com/p/bluetti-ep760-home-assistant . - Trusting the source over the wire. On Emaldo, hours of reading obfuscated code led to the wrong framing. A capture from the real app in an emulator showed the actual format, with method codes byte-swapped relative to the Java. JADX could not display some method names at all emaldo-home-battery https://reversedwithai.com/p/emaldo-home-battery . Projects that use this projects-that-use-this - Bluetti EP760 into Home Assistant https://reversedwithai.com/p/bluetti-ep760-home-assistant : JADX output read by Claude Code, ending in MQTT and an ESP32. - Kyocera softkey API https://reversedwithai.com/p/kyocera-softkey-api-gemini-opencode : adb, Apktool and Gemini in OpenCode for about $0.05. - Android projector malware https://reversedwithai.com/p/android-projector-malware : defensive analysis of pre-installed apps. - Emaldo home battery https://reversedwithai.com/p/emaldo-home-battery : decompiled app plus packet capture. - Amaran lights https://reversedwithai.com/p/amaran-bluetooth-mesh : Claude Code decompiled the Android and desktop apps on its own. Further reading further-reading - Android Debug Bridge adb https://developer.android.com/tools/adb - JADX https://github.com/skylot/jadx - Apktool documentation https://apktool.org/docs/install - Quickly reverse engineer hidden Android APIs with Gemini and OpenCode https://barrasso.me/posts/2026-01-11-android-reverse-engineering-with-opencode/