README

Android Reverse Engineering & API Extraction — Claude Code skill

  

A Claude Code skill that decompiles Android APK/XAPK/JAR/AAR files and extracts the HTTP APIs used by the app — Retrofit endpoints, OkHttp calls, hardcoded URLs, authentication patterns — so you can document and reproduce them without the original source code.

 First-class Kotlin support: modern Android apps are Kotlin/KMP, heavily obfuscated with R8. This skill recovers the original Kotlin class names from metadata R8 cannot strip, and extracts APIs from Ktor, Apollo (GraphQL) and Koin — not just the classic Retrofit/OkHttp stack. See Kotlin name recovery below.

 Windows / PowerShell support (experimental): The .ps1 scripts alongside the bash ones are a recent community contribution, still being stabilised. For any issues please open an issue on this repository (not on the contributors' upstream forks): the PowerShell scripts are maintained here by @SimoneAvogadro.

 Table of Contents

- What it does
- Requirements
- Installation
- Usage
- Repository Structure
- References
- Acknowledgments
- Disclaimer
- License

 What it does

| Capability | Description |
|------------|-------------|
| Fingerprint first (Phase 0) | Triage an APK/XAPK in seconds — detect the framework (Flutter / React Native / Cordova / Xamarin / native-Kotlin), HTTP stack, obfuscation level and native libs before spending time on a full decompile |
| Decompile | APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower (single engine or side-by-side comparison) |
| Recover Kotlin names | Rebuild original Repository / ViewModel / UseCase class names from R8-obfuscated binaries using Kotlin metadata that R8 cannot strip |
| Extract APIs | Retrofit, OkHttp, Volley and modern Kotlin/KMP stacks: Ktor, Apollo (GraphQL), Koin DI — endpoints, hardcoded URLs, auth headers, tokens and HMAC request-signing schemes |
| Trace call flows | From Activities/Fragments through ViewModels and repositories down to HTTP calls |
| Analyze structure | Manifest, packages, architecture patterns |
| Handle obfuscation | R8-resistant path/URL extraction plus strategies for navigating ProGuard/R8 output |

 Requirements

Required:

- Java JDK 17+
- jadx (CLI)

Optional (recommended):

- Vineflower or Fernflower — better output on complex Java code
- dex2jar — needed to use Fernflower on APK/DEX files

See plugins/android-reverse-engineering/skills/android-reverse-engineering/references/setup-guide.md for detailed installation instructions.

 Installation

 From GitHub (recommended)

Inside Claude Code, run:

text
/plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill
/plugin install android-reverse-engineering@android-reverse-engineering-skill


The skill will be permanently available in all future sessions.

 From a local clone

bash
git clone https://github.com/SimoneAvogadro/android-reverse-engineering-skill.git


Then in Claude Code:

text
/plugin marketplace add /path/to/android-reverse-engineering-ski