AppUnpack v0.2.1

AppUnpack v0.2.1

This Android-first launch update fixes a compatibility issue found while checking production apps and adds reproducible split/device validation. iOS support remains IPA metadata inspection.

Fixed

Native library listing and selected extraction now accept APK resources whose names differ only by case, such as res/2F.xml and res/2f.xml. Production minified APKs exposed the false rejection. Split preparation also accepts these names inside opaque APK snapshots. Exact duplicate entries and unsafe whole-archive extraction collisions remain rejected.

Checked

• 35 Node tests and 24 Python tests passed.
• Official Jellyfin 2.7.3 production AAB payloads were converted with verified Google bundletool into base, x86_64 and xxhdpi splits. The actual CLI recovered code/resources, preserved native hashes and passed an install/pull/hash/analysis emulator round trip. These are locally generated/signed release-derived APKs, not Google Play-delivered APKs.
• Actual Android Frida listing/attachment passed on an isolated Android 16/API 36 x86_64 emulator using matching server/core 17.24.3. The bounded observation captured Linux/x64 identity, Java availability and ART/libc modules.
• Official minified NetGuard 2.337 and Mullvad 2026.12 APKs produced useful partial Java/resource exports. Ghidra recovered 305 internal functions from NetGuard's stripped ARM64 library with no reported function failures. Mullvad's larger native library returned a partial result: 4,998 decompiled functions, two timeouts and the 5,000-function export cap reached.
• Added opt-in regressions for real split payloads and Android Frida, and a separate real JADX integration workflow on Ubuntu.

See the full verification record for versions, hashes, commands, error counts and remaining gaps.

Install

Extract appunpack-v0.2.1.zip into a new folder, or update a clean source checkout, then:

npm ci
node bin/appunpack.mjs install-tools
node bin/appunpack.mjs doctor
node bin/appunpack.mjs /path/to/Example.apk

Basic export requires Node.js 24.11+, npm and a Java 17+ JDK with compiler modules. Optional Python, Apktool, Ghidra, ADB and Frida need the separate extended setup. Source ZIP/tgz downloads exclude runtimes, external tools, targets and captures; SHA256SUMS.txt covers the archives. No npm registry package is published.

Production Java exports remain partial. Physical devices, ARM64 Frida/Gadget, Google Play delivery, production dynamic feature modules and iOS executable recovery remain unverified. Recovery does not guarantee original/buildable source or include backend code.

Real APK demo

Watch the 24-second AppUnpack demo

Real NetGuard 2.337 APK analysis: manifest, permissions, decoded resources and reconstructed Java. Edited for pacing; recovery is partial. Feature cards summarize code navigation, CLI/MCP and evidence reports. The MP4 is a separate demo asset; the archive checksums above cover the source packages.

Music: “Brain Dance” by Kevin MacLeod (incompetech.com), CC BY 4.0. Edited excerpt, loudness adjusted, fades added.

AppUnpack v0.2.0

AppUnpack v0.2.0

AppUnpack now analyzes compatible base/split APK sets and adds optional smali, native-library and device workflows. A single APK still starts the local JADX source/resource export.

Install or update

Download appunpack-v0.2.0.zip and extract it into a new directory, or update a clean clone of samalyxx/appunpack. In the project directory:

npm ci
node bin/appunpack.mjs install-tools
node bin/appunpack.mjs doctor
node bin/appunpack.mjs /path/to/Example.apk

Requirements for basic APK export: Node.js 24.11 or newer, npm and a Java 17 or newer JDK with compiler modules. Python 3.10 or newer is needed for split preparation and APK native-library extraction. Apktool, Ghidra, Android Platform Tools and Frida require separate installation and configuration; see extended Android setup. Ghidra must use a JDK supported by its installed version.

The ZIP contains project source. It excludes runtimes, external analysis tools, installed dependencies, target apps and captured data. The release also includes samalyxx-appunpack-0.2.0.tgz and SHA256SUMS.txt. No AppUnpack package is published to the npm registry.

Added

• splits: analyze a compatible APK directory or unambiguous .apks/.xapk collection together. Save per-part hashes, validate package/version/dependency identities, and retain each part's decoded resources. Variant-bearing bundletool archives require device-specific extraction first.
• decode: use Apktool to save smali and decoded resources with logs and a hashed report.
• native-libs / native: select an APK library or supply an ELF .so, then use Ghidra to save pseudocode, function metadata, logs and a project.
• devices, packages, pull, logcat: select an ADB device, copy its base/split APKs, and capture bounded logs.
• frida-ps / trace: select a Frida device and running PID, then capture a supplied script for a bounded duration.
• Shared subprocess deadlines, output limits and process-tree cleanup. Existing evidence directories remain protected from overwrite.

These additions are CLI workflows. The upstream JADX MCP server's tools are unchanged. iOS support remains static IPA metadata inspection.

Verification

35 Node tests, 22 Python tests, five real JADX integration workflows and two real Apktool/Ghidra integration workflows passed on Windows. Apktool recovered 340 smali files from a public fixture; Ghidra recovered both functions from a known-source ARM64 fixture. A read-only Android emulator check pulled a public APK, verified its hash, captured logs and analyzed the pulled package. A separate Frida host check attached to a benign test process. See the verification record for exact artifacts and limitations.

Genuine Play Store split sets, Android Frida attachment, physical-device transfers and complex production native libraries remain unverified. Recovered code can be partial or inaccurate; this release does not reconstruct backend code, guarantee a buildable original project, create an installable merged APK or validate signatures.

AppUnpack is MIT licensed. External tools retain their own terms in third-party notices.

AppUnpack v0.1.0

AppUnpack v0.1.0

The first AppUnpack release turns a local Android APK into decompiled Java, decoded resources, a manifest and an evidence report. Inspect individual classes and methods from the CLI or connect an AI coding agent through MCP.

Install

Download appunpack-v0.1.0.zip and extract it, or clone samalyxx/appunpack. In the extracted project directory:

npm ci
node bin/appunpack.mjs install-tools
node bin/appunpack.mjs doctor
node bin/appunpack.mjs /path/to/Example.apk

On Windows you can also run:

.\appunpack.ps1 'C:\Apps\Example.apk'

Requirements: Node.js 24.11 or newer, npm and a Java 17 or newer JDK with compiler modules. Python 3.10 or newer is optional for IPA metadata inspection. The ZIP contains project source, not Node.js, Java, Python, the engine JAR, installed dependencies or APKs. install-tools downloads the pinned engine and verifies its SHA-256.

The release also provides an npm package archive, samalyxx-appunpack-0.1.0.tgz, and SHA256SUMS.txt for the downloadable artifacts. The ZIP is the recommended source installation. This is a GitHub release; no AppUnpack package is published to the npm registry.

Included

• A single APK path starts local source/resource export and creates a new analysis directory beside the input.
• CLI commands inspect class summaries, source, methods, references and string resources.
• Reports retain the input identity, engine responses, export counts, warnings and diagnostic log.
• A local stdio MCP server supports coding-agent investigations.
• An optional Python workflow inventories IPA archive and bundle metadata.
• Illustrated documentation and the AppUnpack website explain installation, outputs and limitations.

Verification and limits

The verification record covers 18 Node unit tests, 9 synthetic IPA/parser tests and 3 real Android integration workflows. Three public APK fixtures were exported and inspected; each reported a partial result. One recovered algorithm matched its original implementation and an independent check for six inputs. Unit/parser CI runs on Windows and Ubuntu; it does not run target apps. See the full verification record.

Decompilation does not recover backend code or guarantee an exact, complete or buildable original project. Obfuscation, native code, missing split modules and engine errors can leave gaps. iOS support is metadata inspection only. The workflow does not rebuild/sign apps, validate signatures, decrypt executables or perform runtime analysis.

AppUnpack is MIT licensed. Its direct tools and dependencies retain their own terms in third-party notices.