Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.

Jadx Android APK Decompiler You are helping the user decompile Android APK files using jadx to convert DEX bytecode into readable Java source code for security analysis, vulnerability discovery, and understanding app internals. Tool Overview Jadx is a dex to Java decompiler that produces clean, readable Java source code from Android APK files. Unlike apktool (which produces smali), jadx generates actual Java code that's much easier to read and analyze. It's essential for: Converting DEX bytecode to readable Java source Understanding app logic and control flow Finding security vulnerabilities in code Discovering hardcoded credentials, API keys, URLs Analyzing encryption/authentication implementations Searching through code with familiar Java syntax Prerequisites jadx (and optionally jadx gui ) must be installed Java Runtime Environment (JRE) required Sufficient disk space (decompiled output is typically 3 10x APK size) Write permissions in output directory GUI vs CLI Jadx provides two interfaces: CLI (jadx) : Command line interface Best for automation and scripting Batch processing multiple APKs Integration with other tools Headless server environments GUI (jadx gui) : Graphical interface Interactive code browsing Built in search functionality Cross references and navigation Easier for manual analysis Syntax highlighting When to use each: Use CLI for automated analysis, scripting, CI/CD pipelines Use GUI for interactive exploration and deep dive analysis Instructions 1. Basic APK Decompilation (Most Common) Standard decompile command: Example: With deobfuscation (recommended for obfuscated apps): 2. Understanding Output Structure After decompilation, the output directory contains: 3. Decompilation Options A. Performance Options Multi threaded decompilation (faster): Skip resources (code only, much faster): Skip source code (resources only): B. Deobfuscation Options Enable deobfuscation: Renames obfuscated classes (a.b.c → meaningful names) Attempts to recover original names Makes code much more readable Essential for obfuscated/minified apps Deobfuscation map output: More aggressive deobfuscation Uses source file names as hints for renamed identifiers C. Output Control Show inconsistent/bad code: Shows code that couldn't be decompiled cleanly Useful for finding obfuscation or anti decompilation tricks May contain syntax errors but reveals structure Export as Gradle project: Creates buildable Gradle Android project Useful for rebuilding/modifying app Includes build.gradle files Fallback mode (when decompilation fails): Uses alternative decompilation strategy Produces less clean code but handles edge cases 4. Common Analysis Tasks A. Searching for Sensitive Information After decompilation, search for common security issues: B. Finding Security Vulnerabilities SQL Injection: Insecure Crypto: Insecure Storage: WebView vulnerabilities: Certificate pinning bypass: C. Understanding App Logic Find entry points: Trace network communication: Find authentication logic: D. Analyzing Specific Classes After identifying interesting classes, read them directly: 5. GUI Mode (Interactive Analysis) Launch GUI: GUI features: Full text search : Ctrl+Shift+F (search all code) Find usage : Right click on class/method → "Find usage" Go to declaration : Ctrl+Click on any class/method Decompilation : Click any class to see Java code Save decompiled code : File → Save all Export options : File → Export as Gradle project GUI workflow: 1. Open APK with jadx gui 2. Browse package structure in left panel 3. Use search (Ctrl+Shift+F) to find keywords 4. Click results to view code in context 5. Follow cross references with Ctrl+Click 6. Save interesting findings 6. Integration with Other Tools Combine Jadx with Apktool Both tools complement each other: Jadx strengths: Readable Java source code Easy to understand logic Fast searching through code Apktool strengths: Accurate resource extraction Smali code (closer to original) Can rebuild/repackage APKs Recommended workflow: Common Workflows Workflow 1: Security Assessment Workflow 2: IoT App Analysis For IoT companion apps, find device communication: Workflow 3: Quick Credential Check Workflow 4: API Endpoint Discovery Workflow 5: Batch Processing Multiple APKs Best Practices 1. Always Use Deobfuscation for Production Apps Without deobf , you'll see code like: With deobf , jadx attempts meaningful names: 2. Use Multi threading for Large Apps 3. Skip Resources for Code Only Analysis 4. Search Systematically Work through the Security Analysis Checklist at the end of this skill rather than grepping ad hoc. 5. Use GUI for Deep Analysis For complex apps: 1. Use CLI for initial decompilation 2. Search for interesting patterns 3. Open in GUI for detailed exploration 4. Use cross references to trace code flow 6. Combine with Runtime Analysis Static analysis (jadx) + dynamic analysis: Use jadx to find API endpoints Test endpoints with curl/burp Use jadx to understand auth flow Test auth with runtime instrumentation (Frida) Troubleshooting Problem: Decompilation fails with errors Solution : Use fallback mode or show bad code: Problem: Code is unreadable (obfuscated) Solution : Enable deobfuscation: Problem: Out of memory error Solution : Increase Java heap size via the JVM options the jadx launcher reads ( JAVA OPTS or JADX OPTS ): (jadx has no Xmx argument of its own; the heap size must be passed to the JVM, not to jadx.) Problem: Decompilation is very slow Solution : Skip resources or use more threads: Problem: Some methods show "Can't load method" Solution : Use show bad code to see partial decompilation: Problem: GUI won't open APK Solution : Use CLI first to check for errors: Advanced Features Export as Gradle Project Creates a buildable Android Studio project. Generate Deobfuscation Map Custom Decompilation Options Integration with IoTHackBot Tools Jadx fits into the IoTHackBot workflow: 1. APK → API Discovery : Decompile IoT app with jadx Extract API endpoints Test endpoints with network tools 2. APK → Credential Extraction : Find hardcoded credentials Test against IoT devices Use with onvifscan, telnetshell 3. APK → Protocol Analysis : Understand device communication protocol Capture traffic with iotnet Replay/modify with custom scripts 4. APK → Device Enumeration : Find device discovery mechanisms Use wsdiscovery for ONVIF devices Use nmap for network scanning Quick Reference Security Analysis Checklist Use this checklist when analyzing APKs with jadx: [ ] Decompile with deobfuscation enabled [ ] Search for hardcoded API keys [ ] Search for hardcoded credentials [ ] Find all HTTP/HTTPS URLs [ ] Check crypto implementations (algorithms, key generation) [ ] Check certificate pinning implementation [ ] Find SharedPreferences usage (storage security) [ ] Check WebView security settings [ ] Find database operations (SQL injection) [ ] Check for debug/logging code [ ] Find exported components (from manifest) [ ] Check authentication/authorization logic [ ] Find file operations (path traversal) [ ] Check for native library loading [ ] Document all findings Important Notes Jadx produces Java source, which is approximate (not original) Some optimizations/obfuscations may produce uncompilable code Decompiled code may differ slightly from original source Always cross check findings with runtime analysis Jadx works best with apps compiled with standard tools Heavily obfuscated/protected apps may have limited decompilation Some anti tampering mechanisms detect decompilation Security and Ethics IMPORTANT : Only decompile APKs you own or have permission to analyze. Respect intellectual property and licensing Follow responsible disclosure for vulnerabilities Don't distribute decompiled source code Be aware of terms of service and EULAs Use for authorized security testing and research only Some jurisdictions have laws against reverse engineering Success Criteria A successful jadx analysis includes: APK successfully decompiled to readable Java code Deobfuscation applied (if app was obfuscated) All source code searchable and readable Security relevant findings documented API endpoints and URLs extracted Crypto and authentication logic understood Integration points with other systems identified Findings verified with runtime testing when possible