Extract an Installed APK with ADB, Including Split Packages

Prepare an authorized device

Use a test device you control, enable USB debugging deliberately and authorize only the intended development computer. Confirm which device ADB is targeting before reading files. Do not use a production user's device as an unplanned extraction lab.

adb devices
adb shell pm path com.example.app

Replace the example package with the installed application ID. When several devices are connected, use adb -s SERIAL ... for each command so the source remains unambiguous. ADB reference.

Preserve every reported package path

pm path can print multiple package: lines. Copy each path and pull it to a dedicated folder, for example:

adb pull /data/app/ACTUAL_INSTALL_PATH/base.apk ./extracted/base.apk
adb pull /data/app/ACTUAL_INSTALL_PATH/split_config.arm64_v8a.apk ./extracted/

The paths shown are placeholders. Use only the paths returned on your device; installation directories are not stable identifiers. Record the full returned list even if some entries are not relevant to your immediate analysis.

Understand what extraction does not include

Pulling package APKs does not back up private databases, account tokens, user preferences or all downloaded content. It is not a complete app backup. Protected app data remains governed by Android's sandbox and the device's security model.

On-demand features or asset packs that were never downloaded might not be present. A device-specific split set is also not a universal release for every CPU, density or language. Bundle delivery structure.

Verify the set before relying on it

Check application IDs, version codes and signing information across the files. Keep them together under one extraction record. Combining a base from one version with configuration splits from another can fail installation or create misleading analysis results.

For your own distribution tests, prefer generating a coherent APK set from the original AAB using bundletool. That is more reproducible than assembling files collected from unrelated devices.

Close the debugging session

When finished, remove temporary artifacts that contain confidential information and revoke debugging access where appropriate. Do not upload extracted commercial builds to public scanners without authorization.

APKLint can inspect the APKs you select, but a single uploaded base APK does not necessarily describe the complete installed application. State that limitation in any security, size or compatibility conclusion derived from the extraction.