jadx

jadx turns an Android app file (such as an APK) back into Java source code that you can read on screen. This review covers one use: checking how an app you built yourself looks in the form you ship it.

This review is for people who build Android apps and want to see, before release, what someone can read from the APK. After reading it, you can do the following:

• Install jadx and start the GUI and command-line versions
• Open your own APK and read the manifest and the code
• Search strings to check that no API keys or test endpoints remain in the app

##What jadx is for

jadx is a decompiler that produces Java code from Dex, the executable format of Android apps. According to the official README, it can:

• Produce Java code from APK, dex, aab, apks, apkm, xapk, and zip files
• Also handle jar, class, aar, and smali files
• Decode AndroidManifest.xml and other resources from resources.arsc
• Rename unreadable names with its built-in deobfuscator

The GUI adds syntax highlighting, jump to declaration, find usage, and full-text search. It also has a smali debugger.

##How it works

##Network connections

Here is what we could confirm:

• The GUI checks for a new version at startup by default. The check code asks the GitHub API (api.github.com) for the latest release.
• The plugins command has options to list available plugins, install them, and update them. It fetches plugins from outside only when you use it.
• I found no code that sends the contents of the APK you open to the outside. I could not confirm whether the command-line version makes any network connection.

To stop the update check, clear “Check for updates on startup” in the GUI settings.

##Requirements

These are the conditions in the README (as of v1.5.6).

##Try it safely with your own APK

1. From the official releases page, download the zip that fits your system. If you don’t want to install Java on Windows, pick the zip with with-jre in the name.
2. Unpack the zip. The bin folder holds jadx (command line) and jadx-gui (GUI). For the Windows download, run jadx-gui-<version>.exe inside the unpacked folder.
3. Prepare an APK that you built. A real release build shows you the same file that users get.
4. Start jadx-gui and open the APK.
5. Open AndroidManifest.xml and check that the permissions and settings you declared are what you intended.
6. Use full-text search for words such as http, api, key, token, and password. If you left a secret or a test endpoint in the code, it shows up.
7. If you find one, go back to your source code and fix it. Keep secrets such as keys on the server side instead of in the app.

You can also write everything out in one go from the command line.

1. Run it with an output folder.

   jadx -d out app.apk

2. Search the files in the out folder with your editor or a search tool.

If the names are short and hard to read, add --deobf to rename them.

##Common uses

jadx --help lists all options. The official wiki has a Troubleshooting Q&A page for code that doesn’t decompile well.

##How jadx differs from MobSF and Ghidra

A good order is to make a list with MobSF first, then check the places that look suspicious in jadx.

##Cautions

##Read next

• MobSFa tool that checks your own mobile app and lists findingscd ../mobsf
• Ghidraa reverse engineering tool for reading compiled programscd ../ghidra
• mitmproxya tool that sits between an app and the network to inspect trafficcd ../mitmproxy
• How to set up a safe test labcat ~/guides/lab-setup.md