Ever needed to integrate with an app that has no public API? Or test your own app and understand what it's actually sending over the wire? Here's how I approach it — from a static decompile all the way to working API calls.
What you'll need
jadx — static decompilation
apktool — repackaging / resource inspection
Frida — dynamic instrumentation
mitmproxy or Burp Suite — traffic interception
A rooted Android device (recommended, not always required)
Step 1: Static analysis with jadx
Start by decompiling the APK:
jadx -d output/ app.apk
Most Android apps use Retrofit or OkHttp. Grep the decompiled source for the telltale annotations:
grep -rE "@GET|@POST|@PUT" output/ | head -50
This often surfaces endpoint paths, base URLs, and even parameter names in minutes. But here's the catch: modern apps encrypt or obfuscate the interesting parts, so static analysis alone will leave you with dead ends.
Step 2: Intercept traffic with mitmproxy
Point the device at your proxy and watch the real requests. You'll usually hit SSL pinning immediately — the app rejects your MITM certificate.
Step 3: Bypass SSL pinning with Frida
This is where dynamic analysis wins. Frida injects into the running process and patches the certificate validation at runtime. A short script hooks the trust managers and lets your proxy see the plaintext traffic.
Static tools can't do this — the pinning logic only exists at runtime.
Step 4: Reverse custom encryption
Many apps sign their requests or encrypt the payload. The trick is to hook the encryption function with Frida, dump its input and output, and reconstruct the algorithm. Once you understand the signature generation, you can reproduce it in Python or any language you like.
Step 5: Extract and document
The output is a clean list of endpoints, their request/response schemas, and a reproducible script that makes working API calls. That's the difference between "here's a decompiled APK" and "here's something you can actually build on."
A quick legal note
Only do this on apps you own, or where you have explicit authorization. Reverse engineering third-party apps for unauthorized access is illegal in most jurisdictions.
If you need this done professionally — private API extraction, custom encryption or protocol reverse engineering — I do this as a service: www.fiverr.com/s/jyv78wa
