All scripts auto-detect the workspace by looking at their own location, so you can rename or move the base folder at any time without breaking anything.
Every script supports
--helpto list its options and defaults. All generated artifacts, caches, and backups live underwork/, so nothing touches the rest of your Mac.
cd /path/to/your/workspace # e.g. ~/Downloads/mywork
[ -f work/env.sh ] && source work/env.sh # optional overrides; scripts auto-detect bundled JDKsIf you bundle tools (apktool, uber-apk-signer, platform-tools, etc.) place them inside the tools/ directory within the workspace. Apktool framework files are cached under work/apkfw, so nothing leaks outside the folder.
./scripts/tools_install.sh- Downloads the latest releases of apktool, uber-apk-signer, JADX, Android platform-tools, and the Temurin LTS JDK straight into
tools/. - Updates
work/env.shautomatically soJAVA_HOMEpoints at the freshly installed JDK (kept relative to the workspace). - Accepts
--only NAMEto install a specific tool,--forceto refresh an existing bundle, and--listto show supported names. - Set
APKTOOL_VERSION,UBER_APK_SIGNER_VERSION,JADX_VERSION,JDK_VERSION, orJDK_FEATURE_VERSIONto pin versions; leave them unset to track the current LTS releases.
./scripts/with_env.sh java -version
./scripts/with_env.sh --shell # open an interactive shell using the bundled JDK- Wrap any command to inherit the workspace environment (useful for one-off tools).
--shelldrops you into an interactive shell with all variables set; exit to return to your original session.
./scripts/decode.sh --apk /path/to/App.apk- Decodes into
work/decoded. - Creates
work/backups/decoded_*.tar.gzsnapshots before overwriting existing output (disable via--no-backup). - Pass
--openif you want the decoded folder opened in VS Code after completion.
./scripts/rebuild_and_sign.sh- Rebuilds from
work/decoded, generateswork/unsigned.apk, and produces signed APKs underwork/out/. - Accepts flags for custom keystore paths/passwords and
--freshto clear previous signed builds. - Verifies signatures by default (
--skip-verifyto opt out). - Prints an
adb installcommand whenadbis available intools/platform-toolsor onPATH.
./scripts/jadx_readonly.sh --apk /path/to/App.apk- Exports sources to
work/jadx_out(pass--out-dirto customize). - Tries Gradle project export first, gracefully falls back if JADX cannot generate it.
- Use
--keepto reuse the existing output folder.
./scripts/wireless_adb.sh --install-
Guides you through pairing and connecting to a device over Wi‑Fi.
-
Installs the most recent signed APK from
work/outwhen--installis specified. -
Run
--addto get interactive prompts for pairing/connecting when you don’t want to type the addresses manually. -
If multiple devices are online, you’ll get a numbered prompt; pass
--device SERIALto skip the prompt next time. -
Use
--list-onlyto simply list connected devices. -
Pair and connect in one go by copying the values from Android’s Wireless Debugging screens:
./scripts/wireless_adb.sh --pair 192.168.1.50:37099 --code 123456 --connect 192.168.1.50:5555
--pairuses the short-lived IP:PORT from Pair device with pairing code,--codeis the six-digit pairing code, and--connectuses the persistent IP:PORT shown on the main Wireless Debugging screen.
./scripts/reset_work.sh- Clears
work/decoded,work/out,work/unsigned.apk,work/backups, andwork/jadx_out. - Keep backups or JADX exports with
--keep-backups/--keep-jadx. - Add
--reset-frameworkif you also want to dropwork/apkfw(apktool framework cache). - Use
--dry-runto preview pending removals.
./scripts/cleanup_all.sh --yes- Deletes the entire workspace directory. The script must live inside the workspace, so this wipes everything created by the toolkit.
- Use
--dry-runto preview what would be removed.
After decoding, search smali quickly:
rg "Lcom/example/your/TargetClass;" work/decoded/smali*
rg "methodName(.*)" work/decoded/smali*Because the workspace is self-contained, you can back it up or delete it safely—just restore the folder later and the scripts will continue to work from their new location.