Android APK Analysis with REA: Code, Resources, Device Pulls and Flutter

REA, a third-party open-source tool, wraps four Android backends behind one CLI and MCP server: JADX for code, Apktool for resources, adb for pulling installed packages, and a built-in parser for Flutter builds. Each returns structured Evidence bound to the APK’s SHA-256 instead of a folder of decompiler output. This page is the map; each area has its own walkthrough.

We ran the commands below on macOS with REA 6.7.0 from npm, Temurin JDK 17.0.18, jadx-headless-mcp 0.7.1, Apktool 2.12.1 and adb 37.0.1, plus an API 36 emulator. Targets were Aegis Authenticator v3.4.3 (GPL-3.0, SHA-256 fa091c91…b528) and the BSD-3-Clause Flutter Gallery 2.9.2 release APK.

What you need

REA installs none of the backends:

• REA 6.7.0 (install and connect your agent)
• a full JDK 17+ and the jadx-headless-mcp 0.7.1 -all.jar, for the code tools
• Apktool 2.7.0 or newer, for resources
• platform-tools adb and an emulator or a phone you own, for device pulls

The Android provider is verified on macOS and Linux; on Windows, WSL is the safer route.

Code: JADX

inspect-android-package, search-android-classes, inspect-android-class, inspect-android-method and trace-android-references cover the manifest, class search, overloads, single-method decompilation and static callers. The full setup and a worked Aegis example (3,077 classes, tracing how the six-digit code is computed and who calls it) are in JADX MCP server for Claude Code and Codex.

Resources: Apktool

export REA_APKTOOL_COMMAND=/absolute/path/apktool   # optional; otherwise PATH
rea inspect-apktool-client
rea decode-android-resources /absolute/path/aegis-v3.4.3.apk --locales de --locales pt-BR

REA runs Apktool with --no-src and returns apktool.yml metadata, the decoded manifest and string tables as data. The gotcha worth knowing: check the returned locales list before choosing one. In Aegis, values-de holds only 86 AndroidX strings (“Nach oben”, “Fertig”); the app’s own German text is in values-de-rDE, and --locale de-DE returned 472 entries. The --locales run above returned three tables: default 615, de 86, pt-BR 557. Flags, .aab behaviour and asset extraction are covered in unpacking APK and AAB files; a side-by-side with JADX and JEB is in JADX vs JEB vs Apktool.

Device pulls: ADB

Only connect devices you own or are authorized to examine.

rea list-adb-devices
rea resolve-adb-packages emulator-5554 aegis
rea pull-adb-package emulator-5554 com.beemdevelopment.aegis --output-directory /tmp/acq

pull-adb-package collects the complete split set from pm path and digests every file. On our emulator the pulled base.apk had the same SHA-256 as the GitHub download. The package-named subdirectory inside --output-directory must not already exist; if it does, the top-level error is a generic unreadable_output and the real cause is in details.reason. inspect-adb-package returns version_code as a decimal string ("82"), and for an app installed over adb installer_package_name was the string "null", not a JSON null. Install, start, stop and uninstall are never run implicitly; uninstall-adb-package removes the package and its data for user 0, so keep that group on an emulator. Logcat, bugreports and reproducing crashes are in adb logcat and bugreport crash debugging.

Flutter builds

rea identify-flutter-build /absolute/path/flutter-gallery.apk
rea inspect-dart-aot /absolute/path/flutter-gallery.apk

These parse libflutter.so and libapp.so directly, without running anything. On the 117.8 MB Flutter Gallery APK they returned snapshot hash 65817c30a78bb44c3dc3771876b6010a for arm64-v8a, armeabi-v7a and x86_64 in about a second. REA does no hash-to-Dart-SDK lookup; you map it with an external dataset such as reFlutter’s. The package: URI list is capped at 500 (Flutter Gallery had at least 756). The full walkthrough, including an obfuscated build, is in Flutter APK reverse engineering.

If you only have an .aab

The JADX tools refuse a bundle with “is zip; provide one standalone APK”. decode-android-resources does not refuse it: on our test bundle it exited 0 with every metadata field null and coverage: "complete", so an empty result there is not an answer. Use the APK the project publishes, or install the app on a test device and pull the installed split set.