Exploring APKs

Downloading the APK

First we need to pick a package that we're interested in. For this demonstration I'll choose LDS Tools because, well, I want to know what HTTP APIs it uses.

1. I google "LDS Tools Google Play" which takes me to https://play.google.com/store/apps/details?id=org.lds.ldstools&hl=en
2. I google "Download APK" which takes me to https://apps.evozi.com/apk-downloader
3. I paste in the previous link and I get the download page https://apps.evozi.com/apk-downloader/?id=org.lds.ldstools
4. I download org.lds.tools.apk

Online Decompile

5. I search for "Decompile APK"
6. I upload the file to http://www.decompileandroid.com/
7. Go into the Download directory pushd ~/Download
8. Make a directory to work from mkdir ./org.lds.tools.decompiled
9. mv ./source.zip ./org.lds.tools.decompiled.zip
10. Go into it pushd ./org.lds.tools.decompiled
11. unzip ../org.lds.tools.decompiled

Manual Decompile

5. Go into the Download directory pushd ~/Download
6. Copy the file as a zip rsync -av org.lds.tools.apk org.lds.tools.apk.zip
7. Make a directory to work from mkdir ./org.lds.tools
8. Go into it pushd ./org.lds.tools
9. Unzip it unzip ../org.lds.tools.apk.zip

TODO dex decompile

Finding interesting things

In a well-constructed package there's likely to be some file that contains some base urls and uses them as templates later on.

I'm proud to say that LDS Tools (aka org.lds.tools) is such a package:

grep -R 'https://' ./
# yields src/org/lds/ldstools/prefs/PrefsConfig.java as a suspect
# further inspection shows 'photoBaseUrl' is the search term to try for
grep -R photoBaseURL ./

• http://tech.lds.org/mobile/ldstools/
• http://tech.lds.org/dl/ios/

Buy me a coffee

(you can learn about the bigger picture I'm working towards on my patreon page )