# APKLab

> VS Code extension that turns the editor into an Android reverse-engineering workbench around Apktool, Jadx, smali-lsp and uber-apk-signer. It decodes an APK into resources and Smali, decompiles it to Java, gives Smali go-to-definition, references and diagnostics through a language server, and rebuilds, signs and installs the modified app. It can also generate Frida hooks for Smali methods, add a Frida gadget, prepare an app for HTTPS traffic inspection with apk-mitm and produce a Quark-Engine malware-analysis report.

- Type: Tool
- Targets: App
- Category: Android tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/APKLab/APKLab>
- Primary source: <https://github.com/APKLab/APKLab/blob/6ae69b1ba03d65cb78388f7e2fa6a3b8f0081c74/README.md>
- Catalog page: <https://awesomerea.org/resources/apklab/>
- Record JSON: <https://awesomerea.org/resources/apklab/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/apklab/index.md)

## Requirements & limits

- The latest tag, v2.0.0, dated 2026-04-06 in the changelog, added smali-lsp, Frida hook generation and gadget injection and Apktool 3.0+ compatibility; the reviewed master commit of 2026-07-16 is five commits ahead of it. The extension is published on the VS Code Marketplace and Open VSX, and package.json requires VS Code 1.91+. The README lists Linux, macOS and WSL2, and CI also builds and tests it on Windows.
- JDK 17+ is required. On first use the extension downloads the tools named in the project’s update configuration into a .apklab folder in the user’s home directory, at review Apktool 3.0.2, smali-lsp 1.5.0, uber-apk-signer 1.3.0 and Jadx 1.5.6, unless the user sets their paths. adb is optional for installing to a device, and Quark-Engine 21.01.6+ is optional for malware reports. Users supply the APKs.
- CI lints and packages the extension and runs its test suite on Ubuntu, macOS and Windows against a sample open-source APK from the separate testdata repository. Jadx output can be incomplete, and rebuilt APKs are re-signed with uber-apk-signer, using the configured keystore when one is set.
- AGPL-3.0; Apktool, Jadx, smali-lsp, uber-apk-signer, apk-mitm, Frida and Quark-Engine keep their own licenses. HTTPS-inspection patching and gadget injection modify the app under analysis, and the tool grants no rights to analyze, patch or redistribute third-party apps.

## Primary sources

1. <https://github.com/APKLab/APKLab/blob/6ae69b1ba03d65cb78388f7e2fa6a3b8f0081c74/README.md>
2. <https://github.com/APKLab/APKLab/blob/6ae69b1ba03d65cb78388f7e2fa6a3b8f0081c74/CHANGELOG.md>
3. <https://github.com/APKLab/APKLab/blob/6ae69b1ba03d65cb78388f7e2fa6a3b8f0081c74/package.json>
4. <https://github.com/APKLab/APKLab/blob/6ae69b1ba03d65cb78388f7e2fa6a3b8f0081c74/src/data/constants.ts>
5. <https://github.com/APKLab/APKLab/blob/6ae69b1ba03d65cb78388f7e2fa6a3b8f0081c74/.github/workflows/apklab.yml>
6. <https://github.com/APKLab/APKLab/blob/6ae69b1ba03d65cb78388f7e2fa6a3b8f0081c74/LICENSE>
7. <https://github.com/APKLab/website/blob/f8afc6deac69b4ef77f741f891e4d836bf3720f9/static/apklab_update_config.json>

## More in Apps

- [Fernflower](https://awesomerea.org/resources/fernflower/index.md) · Tool
- [Bytecode Viewer](https://awesomerea.org/resources/bytecode-viewer/index.md) · Tool
- [Logic-Lens](https://awesomerea.org/resources/logic-lens/index.md) · Tool
- [Android Security Toolkit](https://awesomerea.org/resources/android-security-toolkit/index.md) · Tool
- [ilspy-cli: targeted .NET decompilation for agents](https://awesomerea.org/resources/akiselev-ilspy-cli/index.md) · Tool
- [React-Decode](https://awesomerea.org/resources/react-decode/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.