Comprehensive Guide to Using JADX for APK Analysis

 Guide to Using JADX for APK Analysis

JADX (Java Decompiler) is an open-source tool that allows you to decompile APK files into readable Java code. This is an essential tool for Android app pentesting, helping you inspect the app's source code for vulnerabilities like hardcoded credentials, API keys, insecure configurations, and logic flaws.

Here’s a complete guide:

Step 1: Download and Install JADX

1. Download JADX:

   • Visit the official repository: https://github.com/skylot/jadx.
   • Download the latest release as a ZIP file from the Releases section (look for jadx-release.zip).
   • 
     
     
     
     
      
     

2. Extract the ZIP File:

   • Extract the downloaded ZIP file into a folder on your system.

 

3.  Run JADX GUI:

• Navigate to the extracted folder.
• Double-click on jadx-gui.bat (on Windows) to launch the GUI.
• If using a terminal, navigate to the JADX directory and run:

   jadx-gui 
   
   
  Step 2: Prepare the APK
  Before you analyze the APK, ensure it’s ready for decompilation:
  1. Obtain the APK:
   If the APK is installed on your device:
   adb pull /data/app/<package_name>-1/base.apk 
   Replace <package_name> with the app's package name (use adb shell pm list packages to find it). 
   
  Step 3: Load APK into JADX
  1. Open the JADX GUI application.
  2. Drag and drop the APK file into the JADX window or use File > Open File to select the APK.
  3. Wait for JADX to decompile the APK; this may take a few seconds. 
   
   
   
   
   
  Step 4: Analyze Decompiled Code
  Once the APK is loaded, start exploring its contents:
  4.1 AndroidManifest.xml
  Open AndroidManifest.xml from the sidebar.
  Look for:
  Dangerous permissions (READ_SMS, WRITE_EXTERNAL_STORAGE, etc.).
  Exported activities, services, and broadcast receivers (android:exported="true").
  Insecure configurations like android:debuggable="true".
   
   
  Decompiled Source Code
  Browse through the decompiled Java files in the src folder.
  Focus on:
  Hardcoded Credentials: Look for passwords, API keys, or sensitive tokens.
  Logic Vulnerabilities: Check for insecure logic in methods.
  Network Configurations: Look for plaintext HTTP connections or insecure certificates.
   
  Resources
  Inspect the res folder for:
  UI layouts (.xml files) to identify hidden or unused features.
  Drawable resources for sensitive images. 
   
  Step 5: Search for Specific Keywords
  JADX provides a search bar for quick keyword searches:
  1.  Use Ctrl + F or the search bar to look for keywords like:  
  a. Password
  b. keys
  c. http:// (for links)
  d. secret
  e. debug
  Step 6: Save Decompiled Code (Optional)
  1. To export the decompiled code:
  2. Go to File > Save As and choose a destination folder.
  3. The code will be saved in a readable structure for offline analysis.