Extract Android apk from Market and Decompile it to Java Source

This post talks about process of extracting apk file of any app available in market and then decompiling it to Java source. This can be helpful for those who perform code review (for security vulnerabilities) on apps whose source code is not available. Once Java source code is obtained, we can either do manual code review or run any free/commercial automated code scanners.

Download .apk file from market

  1. Search in market for the app you want to decompile and install it on your phone.
  2. Install Astro File Manager from market (link). Open Astro > Tools > Application Manager/Backup and select the application to backup on to the SD card .
  3. Mount phone as USB drive and access '\backups\apps\' folder to find the apk of target app (lets call it targetapp.apk) . Copy it to your local drive.

Decomiling apk to Dex format

  1. Download Dex2Jar (link) (Android runs applications which are in Dalvik Executable (.dex) format).
  2. Run the command to convert apk to jar

dex2jar targetapp.apk file(./dex2jar targetapp.apk on terminal)

File ‘targetapp.apk.dex2jar.jar’ is created

Converting Apk (Dex) to Jar

Viewing/Decompiling the Jar files to Java

Method 1 : Use JavaDecompiler (JD)

  1. Open ‘targetapp.apk.dex2jar.jar’ with jd-gui (link)
  2. File > Save All Sources to sava the class files in jar to java files.

JD GUI Viewer

Method 2: JAD

  1. Extract contents of jar file on to a folder named src. Use and unarchival utility like 7zip
  2. Keep ‘src’ folder in the same directory where JAD and targetapp jar is present
  3. Open JAD in cmd and execute the following command
  4. jad -o -r -sjava -dsrc src/**/*.class (./jad on terminal)

Extract jar contents to src folder

Running jad command

Now src will contain decompiled Java files ready for manual code review.

Decompiled java files

Tools Used

  1. Sample app – RemoteDroid (Opensource – link)
  2. Astro File Manager (Android Market – link)
  3. Dex2Jar (link)
  4. jd-gui (link)
  5. JAD (link)
Dex2Jar Info
App Name Dex2Jar
License free
Type
  • portable
  • code
App URL Download
More Info link
  • Chiweez

    I’m still very new to Java and Android apps in general. One question I have for you. When I view an .apk file with jd-gui, should I expect to see the manifest file? Or any XML file for that matter?

    • http://a4apphack.com/ Rajiv Vishwa

      You can extract contents of apk file as you would do with any archive file. Then you can use any XML viewer to view the manifest/any other XML files. BTW we cannot directly view any apk file with JD-GUI, we first have to convert it to a jar in order to view it. I hope I cleared your doubt.

      Sorry for the delay in response, I kinda missed out your comment.

      • Fsgsdgs

        jd-gui is not working….. error i got 
        http://techdutta.com

      • Zedgemember

        Can we run this .jar file in any cell phones which is based on java???

  • Gauravee1

    i dint find any jad file in that folder

    • http://a4apphack.com/ Rajiv Vishwa

      Hi Gauravee1, I’ve updated the link for downloading JAD. As mentioned in the post, there are 2 methods by which you can decompile the jar files to java source 1. using ‘jd-gui’ or 2. using ‘JAD’. 

      I’m creating a batch application that automates the entire process i.e, specify the apk file and batch will give you corresponding *.java files . Will update the info soon.

  • Brandon Gray

    Hello, im am a noob when it comes to programming in java, and i was wondering how i can i get this into eclipse so that i can modify the src code and run it on my android phone?

  • Pa Nikx

    dex2jar is not working… in the cmd it said that “is not recognized as an internal or external command, operable or batch file.” what am i doing wrong?

    • android

      @14c92b01ef2244c3f8d33ce472a0e213:disqus please type in cmd as C://dex2> (here type that dex2jar xxx.apk) instead dont type C://dex2/dex2jar xxx.apk . sometimes it doesnt work..

  • ezio

    Works perfect! Thanks a lot :)

  • android

    Superb..

  • Sugam

    Thanks Works for me!!!!!!!!!!!!!!!!!!!!Thank you vey much

    • Nagaraj

      please explain me breifly about this

  • Xmoraleda

    The code I got back from JD-GUI was very odd (some activities were split up into multiple activities like Activity$1 Activity$2 etc). I can do to prevent this?

  • Montassar Zarroug

    good but with decompile class java some code does not existe for example in some activity (R.layout.main)
    can you,please ,explain this problem

    • Xmoraleda

      I also feel the same, I guess the decompilation is not entirely clear. I do not know why. Unfortunately, I see, it must be filled out by hand what is not done well. Can anyone confirm this?

  • Sumanthkumarc

    can the jar. file installed on java phones??

    • http://a4apphack.com/ Rajiv Vishwa

      What do you mean by Java phones? 

  • Xmoraleda

    I think that decompiling is not entirely clear because in many cases can not be used directly because the generated code will not compile. I do not know why. Unfortunately, I see, has to be completed by hand what is not decompiled correctly. Can anyone confirm this? Is there any solution?

    • http://a4apphack.com/ Rajiv Vishwa

      Decompilation is not reversing class files completely back to java sourcecode. I’m just pasting the wiki definition for reference.

      “The decompiler does not reconstruct the original source code, and its output is far less intelligible to a human than original source code.”

      Its mainly meant for analysis, to understand the logic of the code. So as you mentioned, one might have to fix the code before he can compile and run it successfully.

      (Sorry for delay in response)

  • MANI

    I cant seem to convert the file on the command line, it failes to commit

    • http://a4apphack.com/ Rajiv Vishwa

      You mean dex2jar command? what error do you get?

  • Shikhar Chauhan4

     please tell how to make dex2jar as regognisable command

    • http://a4apphack.com/ Rajiv Vishwa

      Dex2Jar is not a tool thats written by me, you can probably check on the google code site (link on the post) to understand about the commands. I’m not sure if I understand what you mean by ‘recognizable command’

  • Tawohid

    When I click the dex2jar link there are 4 options

    dex2jar contains 4 compment
    dex-reader is designed to read the Dalvik Executable (.dex/.odex) format. It has a light weight API similar with ASM. An example heredex-translator is designed to do the convert job. It reads the dex instruction to dex-ir format, after some optimize, convert to ASM format.dex-ir used by dex-translator, is designed to represent the dex instructiondex-tools tools to work with .class files. here is an examplewhich one should i click

  • Krnktch

    i have doneall the steps ofdex2jar but jd gui stops working whem im going to save all the sources

  • Pingback: Decompile APK | JavaZzzzz….

  • Sanket Khanwalkar

    I have done all the steps of dex2jar but jd gui stops working whem im trying to save all the sources. Kindly help !!!

  • http://twitter.com/KANGtotx Marydel Palomares

    andami naman wtf!

  • Patambay_lang_kadyot69

    help..at the very last step..where i use the jad..  where i put in cmd the command jad -o -r  -sjava -dsrc src/**/*.class.. i will always got the error “No matching files found”?! is jad works on windows 7?

  • Ammu

    I am not able to run dex2jar tarapp.apk command.It says,dex2jar not recognised.But,When I opened the download folder,I could see dex2.jar as windows batch file not in MS-Dos batch file.
    How to get rid of this!!!!

  • Powerboy2988

    Special thanks for sharing your knowledge… with this command, i can`t access to xml layout,,,
    What can i do for access these? 

    Thanks again :)

  • http://twitter.com/mysterious_man tbt

    awesome article.. thanks for share
     

  • Atanas Neshkov

    AndroChef Java Decompiler successfully decompiles obfuscated Java 6 and Java 7 .class and .jar files. It allows you to decompile Java and Dalvik bytecode (DEX, APK) into readable Java source:  http://www.neshkov.com/ac_decompiler.html

  • Pingback: Java Decompiler « Technology addict

  • Pingback: Android Decompile APK « tediscript.wordpress.com

  • Pingback: [DEV] CM7 Community Style - Android Forums

  • Cjiahui

    help! after i download the file, they are in windows batch file, how to run command? when i click any windows batch file, it closes immediately. 

  • Tubas007

    Muito bom o post me ajudou muito.

    Very good post has help me must.

    Thanks for Share.

  • Pingback: How to programmatically sign out of Google Talk on Android | Jeff Mixon

  • agc

    Sir…how to change back jar to dex…

  • manish yadav

    Great tool

  • offroadies

    on symbian JAVA files run acc to screen resolution
    so
    by using this technique can I also set a screen resolution for my phone ?

  • offroadies

    on symbian JAVA files run acc to screen resolution
    so
    by using this technique can I also set a screen resolution for my phone ?

  • Morten

    To be able to use the dex2jar you need to install the Java JDK (Java Development Kit).
    If not the bat file will not run.

  • jeelan

    I am getting this error

  • Pingback: Batch File Decompiles Android apk to Java Source With a Single Command | a4apphack

  • Johnpaul Williams

    Has anyone been able to get a project to completely decompile to working code?

  • Devang7399

    please anyone convert whatsapp for me!!!

  • adman

    why would you show people how to do this. People spend time money and hard work, not so that others cna hack their work..

    • http://a4apphack.com/ Rajiv Vishwa

      First line of the article says it all. This post is not meant to plagiarize/steal proprietary content. This can help security testers who are doing black box testing to perform code review. So that you can educate the developers how to secure sensitive information. Hope you now understand what I mean

  • Steve

    I am getting an empty screen when I open a .jar file made from an .apk… Anyone know a way to fix this? Ps. the size of the file is also largely reduced from 29mb to just 256kb…

  • integranet mx

    hi, everything fine… after decomplier whats next step to do the right thig to make it run on symbian.
    Thanks for advanced

  • antika

    can ane one convert whatsapp for me plzzzzzzz !!

  • http://www.ijiami.cn/ Old Scholars

    http://www.ijiami.cn

    The is China doing Android app source protection.

  • http://www.ijiami.cn/ Old Scholars

    http://www.ijiami.cn

    The is China doing Android app source protection.

  • Sonali Kohli

    Hi,
    First of all thanks a lot for this great tutorial, such an amazing much needed, so useful keep it up God Bless You
    Using this Tutorial, I am able to get Java, XML files, resources, drawables, manifest etc.
    Actually i am facing some issues in Java code, in short getting many Errors like:
    1. The type of the expression must be an array type but it resolved to Object
    2. Type mismatch: cannot convert from int to LinearLayout
    3. Type mismatch: cannot convert from LinearLayout to int
    4. The method setVisibility(int) in the type View is not applicable for the arguments (LinearLayout)
    5. Type mismatch: cannot convert from int to boolean
    6. – monitorenter cannot be resolved to a variable
    7. – Syntax error, insert “AssignmentOperator Expression” to complete Expression
    8. The label label175 is missing
    9. The local variable localObject may not have been initialized
    Thanks again, i will wait for your reply…