Jadx and Apktool: Complete Android Reverse Engineering Guide 2026

Jadx and Apktool are the two most important reverse engineering tools in the Android security toolkit. Jadx produces readable Java source from APKs; Apktool decodes to Smali and lets you repackage. This guide covers the complete reverse engineering workflow from first decompilation to patching.

Installing the Tools

bash — decompile

# Install jadx (macOS)

$ brew install jadx

jadx 1.5.0 installed

$ jadx -d output/ target.apk

INFO – 247 classes, 1834 methods

INFO – done in 8.2s

Hunting for Hardcoded Secrets

The first thing every penetration tester does after decompilation is search for hardcoded credentials. API keys, private keys, and passwords committed to source code are extraordinarily common and rank in the OWASP Mobile Top 10:

bash — find secrets

$ grep -r “api_key\|apiKey\|secret\|token” output/ –include=”*.java” -l

output/sources/com/bank/app/BuildConfig.java

output/sources/com/bank/app/network/ApiService.java

$ grep -A2 “API_KEY” output/sources/com/bank/app/BuildConfig.java

public static final String BUILD_API_KEY = “sk_live_4eC39HqLyjWDarjtT1zdp7dc”;

[-] Live API key found in BuildConfig!

Reading Smali: What You Need to Know

When Jadx can’t decompile obfuscated code cleanly, you need to read Smali directly. Key patterns to recognize:

Smali	Java Equivalent	Notes
`invoke-virtual`	instance method call	Most common
`invoke-static`	static method call	Utils, helpers
`const-string`	String literal	Look for secrets here
`iget/iput`	field read/write	Instance fields
`if-eqz`	if (x == 0)	Branch conditions

Apktool: Decode, Modify, Repack

bash — apktool

$ apktool d target.apk -o decoded/

I: Baksmaling classes.dex…

I: Finished.

# Edit smali, then rebuild

$ apktool b decoded/ -o patched.apk

$ apksigner sign –ks debug.keystore patched.apk

[+] patched.apk signed successfully

Bypassing Root Detection via Smali Patch

# Find the isRooted() method and replace its body:
.method public isRooted()Z
    .registers 2
    const/4 v0, 0x0    # return false (not rooted)
    return v0
.end method

Analyzing Native Libraries

# Quick string analysis of native library
strings decoded/lib/arm64-v8a/libnative.so | grep -E "api|key|secret|https"

# Check exported symbols
objdump -T decoded/lib/arm64-v8a/libnative.so | grep " g "

# Open in Ghidra for full decompilation
# File > Import File > decoded/lib/arm64-v8a/libnative.so

Jadx Tips for Obfuscated Code

Enable deobfuscation in Preferences — Jadx renames single-letter identifiers based on usage context
Find usages: right-click any class or method → Find Usages to trace data flow
Rename variables: right-click any identifier → Rename, stored in the project file
Export Gradle project: File → Save as Gradle project generates an Android Studio-compatible project

The complete reverse engineering workflow: jadx-gui for source review and secret hunting → Apktool when you need to patch behavior → Ghidra for native code. For hands-on practice against purpose-built vulnerable Android apps, explore Mobile Hacking Lab.