What does the Jadx AI skill do?

Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.

Why use Jadx on TypingMind?

Because you install it once and use it with any model. Jadx is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

How do I install Jadx in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/BrownFineSecurity/iothackbot/tree/master/skills/jadx. TypingMind reads its SKILL.md and installs it as a skill you can enable per chat.

Which AI models can use Jadx?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

How many AI models can I use with Jadx?

As many as you like. As long as a model supports skills, you can use Jadx with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Is the Jadx AI skill free?

Yes. It is published on GitHub by BrownFineSecurity under the MIT license. You only pay your own AI provider for the tokens you use.

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

Jadx by BrownFineSecurity — AI Skill for Any LLM

Jadx - Android APK Decompiler

You are helping the user decompile Android APK files using jadx to convert DEX bytecode into readable Java source code for security analysis, vulnerability discovery, and understanding app internals.

Tool Overview

Jadx is a dex to Java decompiler that produces clean, readable Java source code from Android APK files. Unlike apktool (which produces smali), jadx generates actual Java code that's much easier to read and analyze. It's essential for:

Converting DEX bytecode to readable Java source
Understanding app logic and control flow
Finding security vulnerabilities in code
Discovering hardcoded credentials, API keys, URLs
Analyzing encryption/authentication implementations
Searching through code with familiar Java syntax

Prerequisites

jadx (and optionally jadx-gui) must be installed
Java Runtime Environment (JRE) required
Sufficient disk space (decompiled output is typically 3-10x APK size)
Write permissions in output directory

GUI vs CLI

Jadx provides two interfaces:

CLI (jadx): Command-line interface

Best for automation and scripting
Batch processing multiple APKs
Integration with other tools
Headless server environments

GUI (jadx-gui): Graphical interface

Interactive code browsing
Built-in search functionality
Cross-references and navigation
Easier for manual analysis
Syntax highlighting

When to use each:

Use CLI for automated analysis, scripting, CI/CD pipelines
Use GUI for interactive exploration and deep-dive analysis

Instructions

1. Basic APK Decompilation (Most Common)

Standard decompile command:

bash
jadx <apk-file> -d <output-directory>

Example:

bash
jadx app.apk -d app-decompiled

With deobfuscation (recommended for obfuscated apps):

bash
jadx --deobf app.apk -d app-decompiled

2. Understanding Output Structure

After decompilation, the output directory contains:


app-decompiled/
├── sources/                           # Java source code
│   └── com/company/app/              # Package structure
│       ├── MainActivity.java
│       ├── utils/
│       ├── network/
│       └── ...
└── resources/                         # Decoded resources
    ├── AndroidManifest.xml           # Readable manifest
    ├── res/                          # Resources
    │   ├── layout/                   # XML layouts
    │   ├── values/                   # Strings, colors
    │   ├── drawable/                 # Images
    │   └── ...
    └── assets/                       # App assets

3. Decompilation Options

A. Performance Options

Multi-threaded decompilation (faster):

bash
jadx -j 4 app.apk -d output
# -j specifies number of threads (default: CPU cores)

Skip resources (code only, much faster):

bash
jadx --no-res app.apk -d output

Skip source code (resources only):

bash
jadx --no-src app.apk -d output

B. Deobfuscation Options

Enable deobfuscation:

bash
jadx --deobf app.apk -d output

Renames obfuscated classes (a.b.c → meaningful names)
Attempts to recover original names
Makes code much more readable
Essential for obfuscated/minified apps

Deobfuscation map output:

bash
jadx --deobf --deobf-use-sourcename app.apk -d output

More aggressive deobfuscation
Uses source file names as hints for renamed identifiers

C. Output Control

Show inconsistent/bad code:

bash
jadx --show-bad-code app.apk -d output

Shows code that couldn't be decompiled cleanly
Useful for finding obfuscation or anti-decompilation tricks
May contain syntax errors but reveals structure

Export as Gradle project:

bash
jadx --export-gradle app.apk -d output

Creates buildable Gradle Android project
Useful for rebuilding/modifying app
Includes build.gradle files

Fallback mode (when decompilation fails):

bash
jadx --fallback app.apk -d output

Uses alternative decompilation strategy
Produces less clean code but handles edge cases

4. Common Analysis Tasks

A. Searching for Sensitive Information

After decompilation, search for common security issues:

bash
# Search for API keys
grep -r "api.*key\|apikey\|API_KEY" app-decompiled/sources/

# Search for passwords and credentials
grep -r "password\|credential\|secret" app-decompiled/sources/

# Search for hardcoded URLs
grep -rE "https?://[^\"]+" app-decompiled/sources/

# Search for encryption keys
grep -r "AES\|DES\|RSA\|encryption.*key" app-decompiled/sources/

# Search for tokens
grep -r "token\|auth.*token\|bearer" app-decompiled/sources/

# Search for database passwords
grep -r "jdbc\|database\|db.*password" app-decompiled/sources/

B. Finding Security Vulnerabilities

SQL Injection:

bash
grep -r "SELECT.*FROM.*WHERE" app-decompiled/sources/ | grep -v "PreparedStatement"
grep -r "rawQuery\|execSQL" app-decompiled/sources/

Insecure Crypto:

bash
grep -r "DES\|MD5\|SHA1" app-decompiled/sources/
grep -r "SecureRandom.*setSeed" app-decompiled/sources/
grep -r "Cipher.getInstance" app-decompiled/sources/ | grep -v "AES/GCM"

Insecure Storage:

bash
grep -r "SharedPreferences" app-decompiled/sources/
grep -r "MODE_WORLD_READABLE\|MODE_WORLD_WRITABLE" app-decompiled/sources/
grep -r "openFileOutput" app-decompiled/sources/

WebView vulnerabilities:

bash
grep -r "setJavaScriptEnabled.*true" app-decompiled/sources/
grep -r "addJavascriptInterface" app-decompiled/sources/
grep -r "WebView.*loadUrl" app-decompiled/sources/

Certificate pinning bypass:

bash
grep -r "TrustManager\|HostnameVerifier" app-decompiled/sources/
grep -r "checkServerTrusted" app-decompiled/sources/

C. Understanding App Logic

Find entry points:

bash
# Main activities
grep -r "extends Activity\|extends AppCompatActivity" app-decompiled/sources/

# Application class
grep -r "extends Application" app-decompiled/sources/

# Services
grep -r "extends Service" app-decompiled/sources/

# Broadcast receivers
grep -r "extends BroadcastReceiver" app-decompiled/sources/

Trace network communication:

bash
# Find HTTP client usage
grep -r "HttpURLConnection\|OkHttpClient\|Retrofit" app-decompiled/sources/

# Find API endpoints
grep -r "@GET\|@POST\|@PUT\|@DELETE" app-decompiled/sources/

# Find base URLs
grep -r "baseUrl\|BASE_URL\|API_URL" app-decompiled/sources/

Find authentication logic:

bash
grep -r "login\|Login\|authenticate\|Authorization" app-decompiled/sources/
grep -r "jwt\|JWT\|bearer\|Bearer" app-decompiled/sources/

D. Analyzing Specific Classes

After identifying interesting classes, read them directly:

bash
# View specific class
cat app-decompiled/sources/com/example/app/LoginActivity.java

# Use less for pagination
less app-decompiled/sources/com/example/app/network/ApiClient.java

# Search within specific class
grep "password" app-decompiled/sources/com/example/app/LoginActivity.java

5. GUI Mode (Interactive Analysis)

Launch GUI:

bash
jadx-gui app.apk

GUI features:

Full-text search: Ctrl+Shift+F (search all code)
Find usage: Right-click on class/method → "Find usage"
Go to declaration: Ctrl+Click on any class/method
Decompilation: Click any class to see Java code
Save decompiled code: File → Save all
Export options: File → Export as Gradle project

GUI workflow:

Open APK with jadx-gui
Browse package structure in left panel
Use search (Ctrl+Shift+F) to find keywords
Click results to view code in context
Follow cross-references with Ctrl+Click
Save interesting findings

6. Integration with Other Tools

Combine Jadx with Apktool

Both tools complement each other:

Jadx strengths:

Readable Java source code
Easy to understand logic
Fast searching through code

Apktool strengths:

Accurate resource extraction
Smali code (closer to original)
Can rebuild/repackage APKs

Recommended workflow:

bash
# Use jadx for code analysis
jadx --deobf app.apk -d app-jadx

# Use apktool for resources and smali
apktool d app.apk -o app-apktool

# Analyze both outputs
grep -r "API_KEY" app-jadx/sources/
grep -r "api_key" app-apktool/res/

Common Workflows

Workflow 1: Security Assessment

bash
# 1. Decompile with deobfuscation
jadx --deobf app.apk -d app-decompiled

# 2. Search for hardcoded secrets
echo "[+] Searching for API keys..."
grep -ri "api.*key\|apikey" app-decompiled/sources/ | tee findings-apikeys.txt

echo "[+] Searching for passwords..."
grep -ri "password\|passwd\|pwd" app-decompiled/sources/ | tee findings-passwords.txt

echo "[+] Searching for URLs..."
grep -rE "https?://[^\"]+" app-decompiled/sources/ | tee findings-urls.txt

# 3. Check crypto usage
echo "[+] Checking crypto implementations..."
grep -r "Cipher\|SecretKey\|KeyStore" app-decompiled/sources/ | tee findings-crypto.txt

# 4. Check for insecure storage
echo "[+] Checking storage mechanisms..."
grep -r "SharedPreferences\|SQLite\|openFileOutput" app-decompiled/sources/ | tee findings-storage.txt

# 5. Summary
echo "[+] Analysis complete. Check findings-*.txt files"

Workflow 2: IoT App Analysis

For IoT companion apps, find device communication:

bash
# 1. Decompile
jadx --deobf iot-app.apk -d iot-app-decompiled

# 2. Find device communication
echo "[+] Finding device endpoints..."
grep -rE "https?://[^\"]+" iot-app-decompiled/sources/ | \
  grep -v "google\|android\|facebook" | \
  tee device-endpoints.txt

# 3. Find API structure
echo "[+] Finding API definitions..."
grep -r "@GET\|@POST\|@PUT" iot-app-decompiled/sources/ | tee api-endpoints.txt

# 4. Find authentication
echo "[+] Finding auth mechanisms..."
grep -r "Authorization\|authentication\|apiKey" iot-app-decompiled/sources/ | tee auth-methods.txt

# 5. Find device discovery
echo "[+] Finding device discovery..."
grep -r "discover\|scan\|broadcast\|mdns" iot-app-decompiled/sources/ | tee device-discovery.txt

# 6. Check for certificate pinning
echo "[+] Checking certificate pinning..."
grep -r "CertificatePinner\|TrustManager" iot-app-decompiled/sources/ | tee cert-pinning.txt

Workflow 3: Quick Credential Check

bash
# Fast decompilation without resources
jadx --no-res --deobf app.apk -d app-code

# Search for common credential patterns
grep -r "username.*password\|user.*pass" app-code/sources/
grep -r "admin\|root\|default.*password" app-code/sources/
grep -r "hardcoded\|TODO.*password\|FIXME.*password" app-code/sources/

Workflow 4: API Endpoint Discovery

bash
# Decompile
jadx app.apk -d app-decompiled

# Find Retrofit/REST API definitions
find app-decompiled/sources -name "*Api*.java" -o -name "*Service*.java" -o -name "*Client*.java"

# Extract all endpoints
grep -r "@GET\|@POST\|@PUT\|@DELETE\|@PATCH" app-decompiled/sources/ | \
  sed 's/.*@\(GET\|POST\|PUT\|DELETE\|PATCH\)("\([^"]*\)".*/\1 \2/' | \
  sort -u

# Find base URLs
grep -r "baseUrl\|BASE_URL\|API_BASE" app-decompiled/sources/

Workflow 5: Batch Processing Multiple APKs

bash
# Decompile multiple APKs
for apk in *.apk; do
  name=$(basename "$apk" .apk)
  echo "[+] Processing $apk..."
  jadx --no-res --deobf "$apk" -d "decompiled-$name"

  # Quick search for secrets
  grep -r "api.*key\|password\|secret" "decompiled-$name/sources/" > "findings-$name.txt"
done

echo "[+] All APKs processed. Check findings-*.txt files"

Best Practices

1. Always Use Deobfuscation for Production Apps

bash
# Most production apps are obfuscated
jadx --deobf app.apk -d output

Without --deobf, you'll see code like:

java
public class a {
    public void b(String c) { ... }
}

With --deobf, jadx attempts meaningful names:

java
public class NetworkClient {
    public void sendRequest(String url) { ... }
}

2. Use Multi-threading for Large Apps

bash
# Faster decompilation
jadx -j 8 large-app.apk -d output

3. Skip Resources for Code-Only Analysis

bash
# 3-5x faster when you only need code
jadx --no-res app.apk -d output

4. Search Systematically

Work through the Security Analysis Checklist at the end of this skill rather than grepping ad hoc.

5. Use GUI for Deep Analysis

For complex apps:

Use CLI for initial decompilation
Search for interesting patterns
Open in GUI for detailed exploration
Use cross-references to trace code flow

6. Combine with Runtime Analysis

Static analysis (jadx) + dynamic analysis:

Use jadx to find API endpoints
Test endpoints with curl/burp
Use jadx to understand auth flow
Test auth with runtime instrumentation (Frida)

Troubleshooting

Problem: Decompilation fails with errors

Solution: Use fallback mode or show bad code:

bash
jadx --fallback --show-bad-code app.apk -d output

Problem: Code is unreadable (obfuscated)

Solution: Enable deobfuscation:

bash
jadx --deobf app.apk -d output

Problem: Out of memory error

Solution: Increase Java heap size via the JVM options the jadx launcher reads (JAVA_OPTS or JADX_OPTS):

bash
export JAVA_OPTS="-Xmx4096m"
jadx app.apk -d output

(jadx has no -Xmx argument of its own; the heap size must be passed to the JVM, not to jadx.)

Problem: Decompilation is very slow

Solution: Skip resources or use more threads:

bash
jadx --no-res -j 8 app.apk -d output

Problem: Some methods show "Can't load method"

Solution: Use --show-bad-code to see partial decompilation:

bash
jadx --show-bad-code app.apk -d output

Problem: GUI won't open APK

Solution: Use CLI first to check for errors:

bash
jadx app.apk -d test-output
# If successful, try GUI again

Advanced Features

Export as Gradle Project

bash
jadx --export-gradle app.apk -d app-project
cd app-project
./gradlew build

Creates a buildable Android Studio project.

Generate Deobfuscation Map

bash
jadx --deobf --deobf-use-sourcename app.apk -d output
# Check output/mapping.txt for name mappings

Custom Decompilation Options

bash
# All options combined
jadx \
  --deobf \
  --deobf-use-sourcename \
  --show-bad-code \
  --no-imports \
  --no-inline-anonymous \
  --no-replace-consts \
  app.apk -d output

Integration with IoTHackBot Tools

Jadx fits into the IoTHackBot workflow:

APK → API Discovery:
- Decompile IoT app with jadx
- Extract API endpoints
- Test endpoints with network tools
APK → Credential Extraction:
- Find hardcoded credentials
- Test against IoT devices
- Use with onvifscan, telnetshell
APK → Protocol Analysis:
- Understand device communication protocol
- Capture traffic with iotnet
- Replay/modify with custom scripts
APK → Device Enumeration:
- Find device discovery mechanisms
- Use wsdiscovery for ONVIF devices
- Use nmap for network scanning

Quick Reference

bash
# Basic decompilation
jadx <apk> -d <output-dir>

# With deobfuscation (recommended)
jadx --deobf <apk> -d <output-dir>

# Fast (no resources)
jadx --no-res <apk> -d <output-dir>

# Multi-threaded
jadx -j <threads> <apk> -d <output-dir>

# Show problematic code
jadx --show-bad-code <apk> -d <output-dir>

# Export as Gradle project
jadx --export-gradle <apk> -d <output-dir>

# GUI mode
jadx-gui <apk>

# Fallback mode
jadx --fallback <apk> -d <output-dir>

Security Analysis Checklist

Use this checklist when analyzing APKs with jadx:

Important Notes

Jadx produces Java source, which is approximate (not original)
Some optimizations/obfuscations may produce uncompilable code
Decompiled code may differ slightly from original source
Always cross-check findings with runtime analysis
Jadx works best with apps compiled with standard tools
Heavily obfuscated/protected apps may have limited decompilation
Some anti-tampering mechanisms detect decompilation

Security and Ethics

IMPORTANT: Only decompile APKs you own or have permission to analyze.

Respect intellectual property and licensing
Follow responsible disclosure for vulnerabilities
Don't distribute decompiled source code
Be aware of terms of service and EULAs
Use for authorized security testing and research only
Some jurisdictions have laws against reverse engineering

Success Criteria

A successful jadx analysis includes:

APK successfully decompiled to readable Java code
Deobfuscation applied (if app was obfuscated)
All source code searchable and readable
Security-relevant findings documented
API endpoints and URLs extracted
Crypto and authentication logic understood
Integration points with other systems identified
Findings verified with runtime testing when possible

Publisher	BrownFineSecurity
Repository	`iothackbot`
Skill name	`jadx`
Stars	858
Forks	134
Bundled files	Instructions only
License	MIT
Links	Skill source Repository

Overview

Installation

Install in TypingMind

Install in another agent

Use it in TypingMind

Works with any AI model

Skill instructions

Jadx - Android APK Decompiler

Tool Overview

Prerequisites

GUI vs CLI

Instructions

1. Basic APK Decompilation (Most Common)

2. Understanding Output Structure

3. Decompilation Options

A. Performance Options

B. Deobfuscation Options

C. Output Control

4. Common Analysis Tasks

A. Searching for Sensitive Information

B. Finding Security Vulnerabilities

C. Understanding App Logic

D. Analyzing Specific Classes

5. GUI Mode (Interactive Analysis)

6. Integration with Other Tools

Combine Jadx with Apktool

Common Workflows

Workflow 1: Security Assessment

Workflow 2: IoT App Analysis

Workflow 3: Quick Credential Check

Workflow 4: API Endpoint Discovery

Workflow 5: Batch Processing Multiple APKs

Best Practices

1. Always Use Deobfuscation for Production Apps

2. Use Multi-threading for Large Apps

3. Skip Resources for Code-Only Analysis

4. Search Systematically

5. Use GUI for Deep Analysis

6. Combine with Runtime Analysis

Troubleshooting

Problem: Decompilation fails with errors

Problem: Code is unreadable (obfuscated)

Problem: Out of memory error

Problem: Decompilation is very slow

Problem: Some methods show "Can't load method"

Problem: GUI won't open APK

Advanced Features

Export as Gradle Project

Generate Deobfuscation Map

Custom Decompilation Options

Integration with IoTHackBot Tools

Quick Reference

Security Analysis Checklist

Important Notes

Security and Ethics

Success Criteria

Frequently asked questions

Related AI Skills

Set up your own AI workspace now