jadx

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

.claude/skills

Audit 0.4.1 · source sha 045751296488 · 21 Oct 2026Report an issue or request a re-scan

• Publisherbrownfinesecurity GitHub organizationOwner of the repository this skill is read from
• Source folderbrownfinesecurity/iothackbot/skills/jadxThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict045751296488A new audit runs when the source changes
• Repository statusNot archivedLast push 141 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app…

---
name: jadx
description: Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.
---

# Jadx - Android APK Decompiler

You are helping the user decompile Android APK files using jadx to convert DEX bytecode into readable Java source code for security analysis, vulnerability discovery, and understanding app internals.

## Tool Overview

Jadx is a dex to Java decompiler that produces clean, readable Java source code from Android APK files. Unlike apktool (which produces smali), jadx generates actual Java code that's much easier to read and analyze. It's essential for:
- Converting DEX bytecode to readable Java source
- Understanding app logic and control flow
- Finding security vulnerabilities in code
- Discovering hardcoded credentials, API keys, URLs
- Analyzing encryption/authentication implementations
- Searching through code with familiar Java syntax

## Prerequisites

- **jadx** (and optionally **jadx-gui**) must be installed
- Java Runtime Environment (JRE) required
- Sufficient disk space (decompiled output is typically 3-10x APK size)
- Write permissions in output directory

## GUI vs CLI

Jadx provides two interfaces:

**CLI (jadx)**: Command-line interface
- Best for automation and scripting
- Batch processing multiple APKs
- Integration with other tools
- Headless server environments

**GUI (jadx-gui)**: Graphical interface
- Interactive code browsing
- Built-in search functionality
- Cross-references and navigation
- Easier for manual analysis
- Syntax highlighting

**When to use each:**
- Use **CLI** for automated analysis, scripting, CI/CD pipelines
- Use **GUI** for interactive exploration and deep-dive analysis

## Instructions

### 1. Basic APK Decompilation (Most Common)

**Standard decompile command:**
```bash
jadx <apk-file> -d <output-directory>
```

**Example:**
```bash
jadx app.apk -d app-decompiled
```

**With deobfuscation (recommended for obfuscated apps):**
```bash
jadx --deobf app.apk -d app-decompiled
```

### 2. Understanding Output Structure

After decompilation, the output directory contains:

```
app-decompiled/
├── sources/                           # Java source code
│   └── com/company/app/              # Package structure
│       ├── MainActivity.java
│       ├── utils/
│       ├── network/
│       └── ...
└── resources/                         # Decoded resources
    ├── AndroidManifest.xml           # Readable manifest
    ├── res/                          # Resources
    │   ├── layout/                   # XML layouts
    │   ├── values/                   # Strings, colors
    │   ├── drawable/                 # Images
    │   └── ...
    └── assets/                       # App assets
```

### 3. Decompilation Options

#### A. Performance Options

**Multi-threaded decompilation (faster):**
```bash
jadx -j 4 app.apk -d output
# -j specifies number of threads (default: CPU cores)
```

**Skip resources (code only, much faster):**
```bash
jadx --no-res app.apk -d output
```

**Skip source code (resources only):**
```bash
jadx --no-src app.apk -d output
```

#### B. Deobfuscation Options

**Enable deobfuscation:**
```bash
jadx --deobf app.apk -d output
```
- Renames obfuscated classes (a.b.c → meaningful names)
- Attempts to recover original names
- Makes code much more readable
- Essential for obfuscated/minified apps

**Deobfuscation map output:**
```bash
jadx --deobf --deobf-use-sourcename app.apk -d output
```
- More aggressive deobfuscation
- Uses source file names as hints for renamed identifiers

#### C. Output Control

**Show inconsistent/bad code:**
```bash
jadx --show-bad-code app.apk -d output
```
- Shows code that couldn't be decompiled cleanly
- Useful for finding obfuscation or anti-decompilation tricks
- May contain syntax errors but reveals structure

**Export as Gradle project:**
```bash
jadx --export-gradle app.apk -d output
```
- Creates buildable Gradle Android project
- Useful for rebuilding/modifying app
- Includes build.gradle files

**Fallback mode (when decompilation fails):**
```bash
jadx --fallback app.apk -d output
```
- Uses alternative decompilation strategy
- Produces less clean code but handles edge cases

### 4. Common Analysis Tasks

#### A. Searching for Sensitive Information

**After decompilation, search for common security issues:**

```bash
# Search for API keys
grep -r "api.*key\|apikey\|API_KEY" app-decompiled/sources/

# Search for passwords and credentials
grep -r "password\|credential\|secret" app-decompiled/sources/

# Search for hardcoded URLs
grep -rE "https?://[^\"]+" app-decompiled/sources/

# Search for encryption keys
grep -r "AES\|DES\|RSA\|encryption.*key" app-decompiled/sources/

# Search for tokens
grep -r "token\|auth.*token\|bearer" app-decompiled/sources/

# Search for database passwords
grep -r "jdbc\|database\|db.*password" app-decompiled/sources/
```

#### B. Finding Security Vulnerabilities

**SQL Injection:**
```bash
grep -r "SELECT.*FROM.*WHERE" app-decompiled/sources/ | grep -v "PreparedStatement"
grep -r "rawQuery\|execSQL" app-decompiled/sources/
```

**Insecure Crypto:**
```bash
grep -r "DES\|MD5\|SHA1" app-decompiled/sources/
grep -r "SecureRandom.*setSeed" app-decompiled/sources/
grep -r "Cipher.getInstance" app-decompiled/sources/ | grep -v "AES/GCM"
```

**Insecure Storage:**
```bash
grep -r "SharedPreferences" app-decompiled/sources/
grep -r "MODE_WORLD_READABLE\|MODE_WORLD_WRITABLE" app-decompiled/sources/
grep -r "openFileOutput" app-decompiled/sources/
```

**WebView vulnerabilities:**
```bash
grep -r "setJavaScriptEnabled.*true" app-decompiled/sources/
grep -r "addJavascriptInterface" app-decompiled/sources/
grep -r "WebView.*loadUrl" app-decompiled/sources/
```

**Certificate pinning bypass:**
```bash
grep -r "TrustManager\|HostnameVerifier" app-decompiled/sources/
grep -r "checkS

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/brownfinesecurity/iothackbot
git -C iothackbot checkout 045751296488

Works in

1. 2026-10-21
   ✓SAFE B 89 / 100

   first audit · source 045751296488

Questions about jadx

• github.com/brownfinesecurity/iothackbot/tree/master/skills/jadx — the audited source at commit 045751296488 and every finding aboveObserved · 21 Oct 2026

Spotted something wrong? Report a correction · Methodology