Can I skip resource or source decoding?

Yes. Set --no-res to leave resources packed when you only need code, or --no-src to skip smali when you only need the manifest and resources.

When do I need --frame-path or --frame-tag?

For apps that reference a device custom framework, common on vendor or system APKs. --frame-path points at framework files; --frame-tag selects a tagged set so resource references resolve.

How do I pull URLs and secrets from the decoded folder?

Point apkurlgrep at the folder for endpoints, and run a secret scanner over smali and resources. Plain grep works too once everything is text.

Can it rebuild the APK after I edit the smali?

Not with this node. Upstream apktool has apktool b for rebuild. Trickest exposes decode only, so rebuild locally when you need a modified package.

Updated Jul 15, 2026

Utilities

Unpack an Android APK into smali, resources, and manifest

Decode Android APK files into smali sources and resources.

Unpack an APK for static analysis Surface endpoints and secrets in app code Read the manifest for attack surface

overview

What apktool-decode does

Reach for apktool-decode when an APK is opaque and you need a greppable tree before endpoint or secret scanners run. It turns one package into smali, decoded resources, and a readable AndroidManifest.xml.

Input is apk-file (FILE); output is a FOLDER. Set --no-res or --no-src to skip a half on large builds. Use --frame-path or --frame-tag when vendor frameworks must resolve or resource decode fails.

Trickest runs it as a managed node: batch APKs, then chain apkurlgrep or a secret scanner on each decoded folder. Decode only; rebuild stays local with upstream apktool b.

source bitbucket.org/iBotPeaches/apktool

use cases

Where apktool-decode fits

Unpack an APK for static analysis

Decode an APK into smali, resources, and a readable manifest so the app's logic, permissions, and components can be reviewed offline.

Surface endpoints and secrets in app code

Produce a source tree that endpoint extractors and secret scanners can grep for hardcoded URLs, API keys, and credentials.

Read the manifest for attack surface

Decode AndroidManifest.xml to inspect exported activities, services, and permissions that define what the app exposes.

Decode a batch of APKs at scale

Run the node across a set of collected APKs in one workflow, writing a decoded tree per app so a fleet of mobile builds can be reviewed in a single pass.

reference

apktool-decode inputs and flags

5 inputs

Name	Type	Flag	Description
apk-file	FILE	·	APK file to decode.
no-res	BOOLEAN	--no-res	Do not decode resources.
no-src	BOOLEAN	--no-src	Do not decode sources.
frame-path	FOLDER	--frame-path	Use framework files located in this folder.
frame-tag	STRING	--frame-tag	Use framework files tagged by this tag.

Showing key inputs. apktool-decode exposes 5 inputs in total.

example

Run apktool-decode

apktool-decode · command

# decode an APK, skip resources, write to a named folderapktool d example.apk --no-res -o example-decoded

sample output

I: Using Apktool 2.9.3 on example.apkI: Loading resource table...I: Decoding AndroidManifest.xml with resources...I: Loading resource table from file: /root/.local/share/apktool/framework/1.apkI: Regular manifest package...I: Decoding file-resources...I: Decoding values */* XMLs...I: Baksmaling classes.dex...I: Copying assets and libs...

guidance

Choosing apktool-decode

Use when you have an APK and need its source tree, resources, and manifest before static review. It unpacks only. Follow with apkurlgrep for URLs, or jadx when Java reconstruction beats smali.

apkurlgrep

Extracts endpoints from an APK directly. Run on decoded output, or alone when you only need URLs.

jadx

Decompiles APKs to readable Java instead of smali. Prefer when Java reconstruction is the goal.

faq

apktool-decode questions

A folder with smali disassembly, decoded resources, and a readable AndroidManifest.xml. That tree is what you grep and feed to the next node.

Run apktool-decode yourself

An APK feeds apktool-decode, which unpacks it into a source tree that apkurlgrep mines for endpoints before they land as a queryable output.

Open apktool-decode in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.