Android APK Decompilation with apktool

Discovery Date: 2026-06-25

Setup

Prerequisites

pkg install apktool
# Java 17 (OpenJDK) - required for apktool
export JAVA_HOME=/data/data/com.termux/files/usr/lib/jvm/java-17-openjdk
export PATH=$JAVA_HOME/bin:$PATH

Verify Installation

apktool --version  # Should show version (e.g., 3.0.2)
java -version       # Should show OpenJDK 17

Decompilation Process

Step 1: Locate APK

# Find installed app APK path
pm path com.tencent.mm
# Output: package:/data/app/.../base.apk

Step 2: Decompile

apktool d /data/app/.../base.apk -o /data/data/com.termux/files/home/wechat_decompiled

Output Structure

wechat_decompiled/
├── AndroidManifest.xml      # App manifest
├── apktool.yml              # apktool config
├── assets/                  # Asset files
├── lib/                     # Native libraries (.so)
├── res/                     # Resources
├── smali/                   # Main dex smali code
├── smali_classes2/          # Additional dex files
├── smali_classes3/
├── ...
└── smali_classes16/         # WeChat has 16 dex files

WeChat Specific Findings

APK Size

• Original: 261MB (base.apk)
• Decompiled: 2.4GB

Key Classes Found

Message Sending

Class	Method	Function
com.tencent.mm.ui.chatting.component.sk	p0(String, int, String)	Send text message
com.tencent.mm.ui.chatting.component.tk	<init>(...)	Send task
com.tencent.mm.storage.g9	Various	MsgInfoStorage

Application Structure

Class	Function
com.tencent.mm.app.MMApplicationLike	Application entry point
com.tencent.mm.ui.chatting.ChattingUI	Main chat activity
com.tencent.mm.ui.chatting.ChattingUIFragment	Chat fragment
com.tencent.mm.pluginsdk.ui.chat.ChatFooter	Input/footer area

Send Message Flow (from smali analysis)

SendTextComponent.p0(msg, type, extra)
  ├── Check message content (non-empty)
  ├── Process commands (CommandProcessorEvent)
  ├── Performance optimization (WXHardCoderJNI)
  ├── Get chat info (username, z3 object, sender)
  ├── Handle paste content (similar_paste_seq)
  ├── Handle friend verification (ticket)
  ├── Create send task (tk)
  └── Execute via thread pool (ku5.t0.h())

Dependencies Analysis

Why direct calling is impossible:

1. Requires full Application context (Tinker, multi-process)
2. Needs ChattingUI/Fragment lifecycle
3. Requires database (SQLCipher encrypted)
4. Needs network connection and authentication
5. Component system with dependency injection

ContentProvider Interfaces

WeChat exposes some ContentProviders:

<provider android:authorities="com.tencent.mm.plugin.ext.message"
          android:name="com.tencent.mm.plugin.ext.provider.ExtControlProviderMsg"
          android:readPermission="com.tencent.mm.ext.permission.READ"
          android:writePermission="com.tencent.mm.ext.permission.WRITE"/>

Issue: Requires com.tencent.mm.ext.permission.READ/WRITE - only available to WeChat itself.

Hook Targets for Frida

Primary Target

Java.perform(function() {
    var SendTextComponent = Java.use("com.tencent.mm.ui.chatting.component.sk");

    SendTextComponent.p0.overload('java.lang.String', 'int', 'java.lang.String')
        .implementation = function(arg1, arg2, arg3) {
        console.log("[HOOK] SendTextComponent.p0 called");
        console.log("[HOOK] msg: " + arg1);
        console.log("[HOOK] type: " + arg2);
        console.log("[HOOK] extra: " + arg3);
        return this.p0(arg1, arg2, arg3);
    };
});

Secondary Targets

• com.tencent.mm.ui.chatting.component.tk - Send task constructor
• com.tencent.mm.storage.g9 - Message storage operations
• com.tencent.mm.pluginsdk.ui.chat.ChatFooter - Input/footer UI

Common Pitfalls

1. smali is not Java: Decompiled code is smali bytecode, not source Java
2. Obfuscated names: Many classes use short names (a, b, c, sk, tk, etc.)
3. Multi-dex: Large apps have multiple dex files (smali_classes2-16)
4. Native libraries: Some functionality is in .so files (lib/ directory)
5. Resource IDs: Hardcoded IDs may change between versions

Tools for Analysis

Search smali

# Find classes containing "send"
grep -rl "sendMessage\|sendMsg\|SendMessage" smali*/

# Find specific class
find smali* -name "*ChattingUI*"

# Search method definitions
grep -n "\.method.*send" smali/com/tencent/mm/.../*.smali

Read smali

# View class structure
head -100 smali/com/tencent/mm/ui/chatting/component/sk.smali

# Find method definitions
grep -n "\.method" smali/.../sk.smali

Related References

• frida-android-setup.md - Frida setup and hooking
• wechat-send-message-mechanism.md - WeChat message sending internals
• wechat-internal-send-api.md - Detailed sk.p0() smali analysis with full dependency chain