# Android APK Decompilation with apktool

## Discovery Date: 2026-06-25

## Setup

### Prerequisites
```bash
pkg install apktool
# Java 17 (OpenJDK) - required for apktool
export JAVA_HOME=/data/data/com.termux/files/usr/lib/jvm/java-17-openjdk
export PATH=$JAVA_HOME/bin:$PATH
```

### Verify Installation
```bash
apktool --version  # Should show version (e.g., 3.0.2)
java -version       # Should show OpenJDK 17
```

## Decompilation Process

### Step 1: Locate APK
```bash
# Find installed app APK path
pm path com.tencent.mm
# Output: package:/data/app/.../base.apk
```

### Step 2: Decompile
```bash
apktool d /data/app/.../base.apk -o /data/data/com.termux/files/home/wechat_decompiled
```

### Output Structure
```
wechat_decompiled/
├── AndroidManifest.xml      # App manifest
├── apktool.yml              # apktool config
├── assets/                  # Asset files
├── lib/                     # Native libraries (.so)
├── res/                     # Resources
├── smali/                   # Main dex smali code
├── smali_classes2/          # Additional dex files
├── smali_classes3/
├── ...
└── smali_classes16/         # WeChat has 16 dex files
```

## WeChat Specific Findings

### APK Size
- Original: 261MB (base.apk)
- Decompiled: 2.4GB

### Key Classes Found

#### Message Sending
| Class | Method | Function |
|-------|--------|----------|
| `com.tencent.mm.ui.chatting.component.sk` | `p0(String, int, String)` | Send text message |
| `com.tencent.mm.ui.chatting.component.tk` | `<init>(...)` | Send task |
| `com.tencent.mm.storage.g9` | Various | MsgInfoStorage |

#### Application Structure
| Class | Function |
|-------|----------|
| `com.tencent.mm.app.MMApplicationLike` | Application entry point |
| `com.tencent.mm.ui.chatting.ChattingUI` | Main chat activity |
| `com.tencent.mm.ui.chatting.ChattingUIFragment` | Chat fragment |
| `com.tencent.mm.pluginsdk.ui.chat.ChatFooter` | Input/footer area |

### Send Message Flow (from smali analysis)

```
SendTextComponent.p0(msg, type, extra)
  ├── Check message content (non-empty)
  ├── Process commands (CommandProcessorEvent)
  ├── Performance optimization (WXHardCoderJNI)
  ├── Get chat info (username, z3 object, sender)
  ├── Handle paste content (similar_paste_seq)
  ├── Handle friend verification (ticket)
  ├── Create send task (tk)
  └── Execute via thread pool (ku5.t0.h())
```

### Dependencies Analysis

**Why direct calling is impossible:**
1. Requires full Application context (Tinker, multi-process)
2. Needs ChattingUI/Fragment lifecycle
3. Requires database (SQLCipher encrypted)
4. Needs network connection and authentication
5. Component system with dependency injection

## ContentProvider Interfaces

WeChat exposes some ContentProviders:

```xml
<provider android:authorities="com.tencent.mm.plugin.ext.message"
          android:name="com.tencent.mm.plugin.ext.provider.ExtControlProviderMsg"
          android:readPermission="com.tencent.mm.ext.permission.READ"
          android:writePermission="com.tencent.mm.ext.permission.WRITE"/>
```

**Issue**: Requires `com.tencent.mm.ext.permission.READ/WRITE` - only available to WeChat itself.

## Hook Targets for Frida

### Primary Target
```javascript
Java.perform(function() {
    var SendTextComponent = Java.use("com.tencent.mm.ui.chatting.component.sk");
    
    SendTextComponent.p0.overload('java.lang.String', 'int', 'java.lang.String')
        .implementation = function(arg1, arg2, arg3) {
        console.log("[HOOK] SendTextComponent.p0 called");
        console.log("[HOOK] msg: " + arg1);
        console.log("[HOOK] type: " + arg2);
        console.log("[HOOK] extra: " + arg3);
        return this.p0(arg1, arg2, arg3);
    };
});
```

### Secondary Targets
- `com.tencent.mm.ui.chatting.component.tk` - Send task constructor
- `com.tencent.mm.storage.g9` - Message storage operations
- `com.tencent.mm.pluginsdk.ui.chat.ChatFooter` - Input/footer UI

## Common Pitfalls

1. **smali is not Java**: Decompiled code is smali bytecode, not source Java
2. **Obfuscated names**: Many classes use short names (a, b, c, sk, tk, etc.)
3. **Multi-dex**: Large apps have multiple dex files (smali_classes2-16)
4. **Native libraries**: Some functionality is in .so files (lib/ directory)
5. **Resource IDs**: Hardcoded IDs may change between versions

## Tools for Analysis

### Search smali
```bash
# Find classes containing "send"
grep -rl "sendMessage\|sendMsg\|SendMessage" smali*/

# Find specific class
find smali* -name "*ChattingUI*"

# Search method definitions
grep -n "\.method.*send" smali/com/tencent/mm/.../*.smali
```

### Read smali
```bash
# View class structure
head -100 smali/com/tencent/mm/ui/chatting/component/sk.smali

# Find method definitions
grep -n "\.method" smali/.../sk.smali
```

## Related References

- `frida-android-setup.md` - Frida setup and hooking
- `wechat-send-message-mechanism.md` - WeChat message sending internals
- `wechat-internal-send-api.md` - Detailed sk.p0() smali analysis with full dependency chain