Start with the container
An APK is a ZIP archive: manifest, DEX bytecode, resources, assets, and native libraries. An AAB is a publishing bundle, not the file an Android device directly runs.
unzip app.apk -d app_unpacked/
Ready
SPECIALIST CONSOLE
Read the package.Know the limits.
A direct technical mentor for Android packaging, static analysis, and wrapper-app architecture.
GROUND TRUTH
You can inspect code shipped to the device. Server-side logic stays on the server.
AppScopeReverse-engineering mentor
Analyzing the package…
START WITH A FOCUSED QUESTION
FIELD PLAYBOOK
A clean mental model for inspection
Use these checkpoints to keep your assignment technically honest.
Recover structure, not magic
JADX reconstructs Java-like code; APKTool decodes resources and emits smali. Obfuscation can rename symbols, but it cannot erase shipped behavior.
jadx-gui app.apkSeparate client from backend
API endpoints, tokens, and request formats may be visible in the client. The server's database, private logic, and secret keys are not inside the APK.
jadx -d out/ app.apkTreat wrappers as boundaries
A wrapper can launch, isolate, embed, or virtualize another app. Its visibility depends on permissions, process boundaries, and the target's defenses.
apktool d app.apk -o decoded/