Utilities
Unpack an Android APK into smali, resources, and manifest
Decode Android APK files into smali sources and resources.
overview
What apktool-decode does
Reach for apktool-decode when an APK is opaque and you need a greppable tree before endpoint or secret scanners run. It turns one package into smali, decoded resources, and a readable AndroidManifest.xml.
Input is apk-file (FILE); output is a FOLDER. Set --no-res or --no-src to skip a half on large builds. Use --frame-path or --frame-tag when vendor frameworks must resolve or resource decode fails.
Trickest runs it as a managed node: batch APKs, then chain apkurlgrep or a secret scanner on each decoded folder. Decode only; rebuild stays local with upstream apktool b.
use cases
Where apktool-decode fits
Unpack an APK for static analysis
Decode an APK into smali, resources, and a readable manifest so the app's logic, permissions, and components can be reviewed offline.
Surface endpoints and secrets in app code
Produce a source tree that endpoint extractors and secret scanners can grep for hardcoded URLs, API keys, and credentials.
Read the manifest for attack surface
Decode AndroidManifest.xml to inspect exported activities, services, and permissions that define what the app exposes.
Decode a batch of APKs at scale
Run the node across a set of collected APKs in one workflow, writing a decoded tree per app so a fleet of mobile builds can be reviewed in a single pass.
reference
apktool-decode inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| apk-file | FILE | · | APK file to decode. |
| no-res | BOOLEAN | --no-res | Do not decode resources. |
| no-src | BOOLEAN | --no-src | Do not decode sources. |
| frame-path | FOLDER | --frame-path | Use framework files located in this folder. |
| frame-tag | STRING | --frame-tag | Use framework files tagged by this tag. |
Showing key inputs. apktool-decode exposes 5 inputs in total.
example
Run apktool-decode
# decode an APK, skip resources, write to a named folderapktool d example.apk --no-res -o example-decodedI: Using Apktool 2.9.3 on example.apkI: Loading resource table...I: Decoding AndroidManifest.xml with resources...I: Loading resource table from file: /root/.local/share/apktool/framework/1.apkI: Regular manifest package...I: Decoding file-resources...I: Decoding values */* XMLs...I: Baksmaling classes.dex...I: Copying assets and libs...guidance
Choosing apktool-decode
Use when you have an APK and need its source tree, resources, and manifest before static review. It unpacks only. Follow with apkurlgrep for URLs, or jadx when Java reconstruction beats smali.
apkurlgrep
Extracts endpoints from an APK directly. Run on decoded output, or alone when you only need URLs.
jadx
Decompiles APKs to readable Java instead of smali. Prefer when Java reconstruction is the goal.
faq
apktool-decode questions
related
More Utilities tools
browser-fetch
Headless Chromium render: requested URL, final URL, status, and title next to the page.
cewl
Spider a URL and return a wordlist for password crackers.
csvkit
SQL on one CSV. The table name is the file stem.
dnsgen
Wordlist and mined-word subdomain permutation.
duckdb
In-process SQL on CSV, JSON, and Parquet. No server.
edge-tts
Microsoft Edge neural speech from text or a script file. No API key.
Run apktool-decode yourself
An APK feeds apktool-decode, which unpacks it into a source tree that apkurlgrep mines for endpoints before they land as a queryable output.
Facts on this page come from the live Trickest tool library.