A CLI tool that decompiles Android APKs into readable Java source with reconstructed R.* references.
apk2gold is a command-line tool that decompiles Android APK files into readable Java source code and resources. It automates the complex, multi-tool process typically required for Android app decompilation, saving time and reducing confusion. A key feature is its attempt to reconstruct human-readable R.* references from opaque integer constants, improving code analysis.
Security researchers analyzing Android apps for vulnerabilities, developers reverse-engineering or learning from third-party apps, and anyone needing to inspect the internal structure of APK files without manual tool chaining.
Developers choose apk2gold because it bundles multiple decompilation steps into one simple command, outputs a cohesive project structure ideal for IDE import, and uniquely attempts to restore R.* references for better code readability compared to raw integer values.
CLI tool for decompiling Android apps to Java. It does resources! It does Java! Its real easy!
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Wraps apktool, dex2jar, and jd-cmd into one `apk2gold <apk>` command, eliminating the need to manually chain multiple decompilation steps as described in the README.
Generates a collocated directory tree with both Java source and resources, making it easy to import into IDEs like Eclipse for cohesive analysis, as highlighted in the 'Collocation of source files' section.
Attempts to replace opaque resource integers with human-readable R.* names using heuristics, improving code readability for security researchers, though it's noted to be guess-based.
Retains Smali output from apktool in a `/.smali` folder, providing a reference in case Java decompilation fails, as mentioned in the usage section.
The R.* reference matching relies on heuristics that can produce weird or incorrect results, as admitted in the README, requiring manual adjustment via rreassoc.py for accuracy.
Requires python, git, mercurial, and maven for installation and operation, which can be cumbersome to set up, especially on non-Linux systems like OSX where jd-cmd may not build easily.
The decompiled output is explicitly not intended to be recompiled, limiting its use for app modification or repackaging, as stated in the 'Looking at the result' section.