<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Android Static Analysis

## apktool
```bash
apktool d target.apk -o output/          # Decode APK
apktool d target.apk -o output/ -f       # Force overwrite
apktool b output/ -o rebuilt.apk         # Rebuild APK
apktool if framework.apk                 # Install framework
```

## jadx
```bash
jadx -d output/ target.apk              # Decompile to Java
jadx -d output/ target.apk --deobf      # With deobfuscation
jadx -d output/ target.apk --show-bad-code  # Include failed methods
jadx-gui target.apk                      # GUI mode
```

## androguard
```bash
androguard analyze target.apk            # Interactive analysis
androguard decompile -i target.apk -o out/
androguard sign -i target.apk            # Show signing info
```

## dex2jar
```bash
d2j-dex2jar target.apk -o target.jar    # Convert DEX to JAR
d2j-jar2dex target.jar -o classes.dex    # Convert JAR to DEX
```

## MobSF API
```bash
# Upload
curl -F 'file=@target.apk' http://localhost:8000/api/v1/upload \
  -H "Authorization: API_KEY"

# Scan
curl -X POST http://localhost:8000/api/v1/scan \
  -d "scan_type=apk&file_name=target.apk&hash=HASH" \
  -H "Authorization: API_KEY"

# Report (JSON)
curl -X POST http://localhost:8000/api/v1/report_json \
  -d "hash=HASH" -H "Authorization: API_KEY"

# Report (PDF)
curl -X POST http://localhost:8000/api/v1/download_pdf \
  -d "hash=HASH" -H "Authorization: API_KEY" -o report.pdf
```

## Key Grep Patterns
| Pattern | Target |
|---------|--------|
| `api[_-]key` | Generic API keys |
| `AKIA[0-9A-Z]{16}` | AWS access keys |
| `AIza[0-9A-Za-z_-]{35}` | Google API keys |
| `MODE_WORLD_READABLE` | Insecure file permissions |
| `setJavaScriptEnabled` | WebView JS enabled |
| `rawQuery\|execSQL` | SQL injection vectors |
