newliver666/apk-reverse

What it solves

apk-reverse is a specialized toolkit and procedural guide designed for Android APK reverse engineering. It addresses the complexity of modifying Android applications, specifically focusing on tasks like debloating, removing advertisements, patching DEX files, and bypassing security measures such as packers, hardening, and anti-analysis techniques. It provides a structured methodology to prevent common failures in the reverse engineering process, such as creating an APK that installs but fails at runtime due to signing certificate checks.

How it works

Rather than being a simple tutorial, the project is structured as an "Agent Skill." It is designed to be loaded by an AI agent (such as Claude Code or Codex) to guide it through a complex technical workflow. The system uses a gated procedure (SKILL.md) that forces the agent to meet specific criteria before proceeding to the next step, preventing the agent from reasoning from first principles and making costly mistakes.

It consists of three main components:

• Procedural Guidance: A set of override rules, a symptom index for known failures, and gates to ensure environment and build truth.
• Reference Library: On-demand documentation covering specific technical domains like Dart AOT, native libraries (.so), Frida dynamic analysis, and Dex patching.
• Parameterized Scripts: Tools like doctor.py for environment verification and other scripts for automation.

Who it’s for

This tool is for security researchers, reverse engineers, and AI agents acting as technical assistants who need to perform surgical modifications to Android APKs and ensure the deliverable is a stable, installable, and functioning patched application.

Highlights

• Anti-Analysis Bypass: Specialized techniques for handling packed/hardened targets and native libraries that deliberately crash the process to prevent analysis.
• Surgical Patching: Focuses on equal-length byte edits to avoid breaking the app's structure, with specific guidance on avoiding the verifier's move-result rule.
• Runtime Analysis: Integration with Frida RPC and memory dumps to handle code virtualization and custom linkers.
• Cross-Platform Tooling: Support for both PC-based toolchains and on-device tools like MT Manager and LSPosed.
• Surgical Ad Removal: A taxonomy of ads and a methodology for patching decisions rather than just the data.
• Agent-Centric Design: Specifically engineered to prevent AI "drift" and repeated failures through a strict gated workflow.