Extract Android apk from Market and Decompile it to Java Source

Posted in Android, Code By rajivvishwa On April 20, 2011

This post talks about process of extracting apk file of any app available in market and then decompiling it to Java source. This can be helpful for those who perform code review (for security vulnerabilities) on apps whose source code is not available. Once Java source code is obtained, we can either do manual code review or run any free/commercial automated code scanners.

Download .apk file from market

Search in market for the app you want to decompile and install it on your phone.
Install Astro File Manager from market (link). Open Astro > Tools > Application Manager/Backup and select the application to backup on to the SD card .
Mount phone as USB drive and access '\backups\apps\' folder to find the apk of target app (lets call it targetapp.apk) . Copy it to your local drive.

Decomiling apk to Dex format

Download Dex2Jar (link) (Android runs applications which are in Dalvik Executable (.dex) format).
Run the command to convert apk to jar

dex2jar targetapp.apk file(./dex2jar targetapp.apk on terminal)

File ‘targetapp.apk.dex2jar.jar’ is created

Viewing/Decompiling the Jar files to Java

Method 1 : Use JavaDecompiler (JD)

Open ‘targetapp.apk.dex2jar.jar’ with jd-gui (link)
File > Save All Sources to sava the class files in jar to java files.

Method 2: JAD

Extract contents of jar file on to a folder named src. Use and unarchival utility like 7zip
Keep ‘src’ folder in the same directory where JAD and targetapp jar is present
Open JAD in cmd and execute the following command
jad -o -r -sjava -dsrc src/**/*.class (./jad on terminal)