Reverse Engineer an APK You Own: A Reproducible Analysis Notebook

Preserve the artifact and objective

Record the source, SHA-256 hash, package, version and signing fingerprint. Keep the original unchanged. Use a working copy in an isolated directory and write down the tool versions used.

Question: did release B include the expected network configuration?
Inputs: release A and release B, with hashes
Method: manifest/resource inspection and code cross-reference
Finding: exact file or class location
Limitations: decompiler warnings and missing splits

This structure keeps an observation separate from an assumption about the original project.

Inspect structure before reconstructing code

Use APK Analyzer or its CLI to examine the package inventory. Then use a maintained decompiler such as JADX where Java-like output helps answer the question. Treat reconstructed code as an interpretation of bytecode, not a guaranteed copy of the original source.

If JADX reports failures, preserve those warnings. A missing or simplified method in the output does not prove the code was absent from the application.

Compare like with like

Compare the same build type, ABI and delivery format. A universal debug APK and a device-specific release split set differ for reasons unrelated to a code change. Normalize the comparison before attributing every size or file difference to a regression.

For a suspected dependency change, corroborate package observations with your resolved Gradle graph and release records when available.

Keep the work inside authorized boundaries

Inspect only applications and systems you own or have permission to assess. Embedded URLs do not grant permission to probe third-party services. Avoid modifying license checks, redistributing proprietary content or using production credentials in experiments.

Connect findings to a fix

A useful result names the artifact, evidence location and engineering action. APKLint's decompiler and inspection tools can accelerate preliminary review, but an APK cannot reliably restore your full Android Studio project, signing keys, repository history or original build configuration. Use source control and build archives for recovery whenever possible.