Skip to main content

Want to Practice These Techniques?

Try Hackviser's interactive cyber security upskilling platform - Learn by doing!

Start Practicing Now

JADX

What is the purpose of JADX?​

JADX is an open-source Dex-to-Java decompiler used to produce Java-like source code and decoded Android resources from Android application packages and related bytecode formats. It includes both command-line and GUI tools, but the command-line workflow is useful for repeatable mobile security analysis.

JADX is useful because it can decompile APK, DEX, AAR, AAB, JAR, CLASS, ZIP, XAPK, APKM, ARSC, and smali inputs into readable source and resource output. It is commonly used for Android application review, malware triage, CTF analysis, dependency inspection, and mobile reverse engineering.

Note: Decompiled output is not guaranteed to be perfect. Obfuscation, compiler transformations, Kotlin metadata, packed code, native libraries, and anti-analysis techniques can reduce accuracy. Treat JADX output as an analysis aid, not as authoritative original source code.

Here are the primary uses of JADX:

  • Android APK Decompilation: JADX converts Dalvik bytecode from APK and DEX files into Java-like source for review.

  • Resource Decoding: The tool decodes AndroidManifest.xml, resource tables, strings, layouts, and other Android resource files.

  • Static Mobile Security Review: Analysts use JADX output to search for hardcoded secrets, insecure APIs, exported components, network configuration, debug flags, WebView risks, and authentication logic.

  • Obfuscated Code Triage: JADX includes deobfuscation and renaming options that make heavily renamed code easier to navigate.

  • Focused Class Analysis: The tool can decompile a single class, skip resources, skip source code, or separate source and resource output directories.

  • Automation-Friendly Output: JADX can run in scripts, produce Java or JSON output, export Gradle projects, and use quiet or error-only logging for CI-style workflows.

  • Plugin Management: JADX includes a plugin command for listing, installing, updating, disabling, and removing plugins.

Core Features​

  • APK, DEX, JAR, and AAR decompilation
  • Java-like source generation and smali support
  • Android resources and manifest inspection
  • CLI and GUI workflows
  • Deobfuscation, rename, and search helpers
  • Export, Gradle-style project, and output directory options
  • Useful static analysis workflow support

Data sources​

  • APK, DEX, JAR, AAR, and class files
  • AndroidManifest.xml and resource files
  • Java-like decompiled source output
  • Smali and bytecode metadata
  • Assets, native libraries, and strings
  • JADX project and export directories

Common JADX Commands​

1. Install JADX with Homebrew​

  • This command installs JADX on macOS using Homebrew.
brew install jadx

2. Install JADX on Arch Linux​

  • This command installs JADX from Arch repositories.
sudo pacman -S jadx

3. Check JADX Version​

  • This command prints the installed JADX version.
jadx --version

4. Show Help​

  • This command displays JADX command-line options.
jadx --help

5. Decompile an APK​

  • This command decompiles an APK into the default output directory.
jadx app.apk

6. Decompile to a Specific Output Directory​

  • This command writes decompiled output to out.
jadx -d out app.apk

7. Decompile a DEX File​

  • This command decompiles a raw DEX file.
jadx -d out classes.dex

8. Decompile a JAR File​

  • This command decompiles Java bytecode from a JAR file.
jadx -d out library.jar

9. Decompile an Android App Bundle​

  • This command decompiles an Android App Bundle.
jadx -d out app.aab

10. Decode Resources Only​

  • This command decodes resources without decompiling source code.
jadx --no-src -d resources-only app.apk

11. Decompile Source Only​

  • This command decompiles source code without decoding resources.
jadx --no-res -d source-only app.apk

12. Separate Source and Resource Output​

  • This command writes source and resources into separate directories.
jadx --output-dir-src out/src --output-dir-res out/res app.apk

13. Decompile a Single Class​

  • This command decompiles only one class by full class name.
jadx --single-class com.example.app.MainActivity -d out app.apk

14. Write a Single Class to a File​

  • This command writes one decompiled class to a selected file.
jadx --single-class com.example.app.MainActivity --single-class-output MainActivity.java app.apk

15. Use More Threads​

  • This command controls the number of processing threads.
jadx --threads-count 8 -d out app.apk

16. Export as a Gradle Project​

  • This command exports decompiled output as a Gradle project.
jadx --export-gradle -d gradle-out app.apk

17. Export with a Specific Gradle Template​

  • This command uses the Android app Gradle export type.
jadx --export-gradle --export-gradle-type android-app -d gradle-out app.apk

18. Enable Deobfuscation​

  • This command activates JADX deobfuscation.
jadx --deobf -d out app.apk

19. Tune Deobfuscation Name Lengths​

  • This command renames very short or very long identifiers.
jadx --deobf --deobf-min 3 --deobf-max 64 -d out app.apk

20. Disable Identifier Renaming​

  • This command disables automatic rename fixes.
jadx --rename-flags none -d out app.apk

21. Rename Only Invalid Identifiers​

  • This command only fixes invalid Java identifiers.
jadx --rename-flags valid -d out app.apk

22. Use a Mapping File​

  • This command loads a supported mapping file or directory.
jadx --mappings-path mappings.txt -d out app.apk

23. Set Mapping Mode​

  • This command reads a mapping file without auto-saving changes.
jadx --mappings-path mappings.txt --mappings-mode read -d out app.apk

24. Use Fallback Decompilation Mode​

  • This command uses fallback output when normal decompilation is unreliable.
jadx --decompilation-mode fallback -d fallback-out app.apk

25. Use Simple Decompilation Mode​

  • This command uses simplified instruction output.
jadx --decompilation-mode simple -d simple-out app.apk

26. Show Bad Code​

  • This command includes inconsistent or incorrectly decompiled code in output.
jadx --show-bad-code -d out app.apk

27. Disable Imports​

  • This command writes fully qualified package names instead of imports.
jadx --no-imports -d out app.apk

28. Disable Debug Info Processing​

  • This command disables debug information parsing and processing.
jadx --no-debug-info -d out app.apk

29. Add Debug Line Comments​

  • This command adds comments with debug line numbers when available.
jadx --add-debug-lines -d out app.apk

30. Disable XML Pretty Printing​

  • This command keeps decoded XML from being prettified.
jadx --no-xml-pretty-print -d out app.apk

31. Escape Unicode Strings​

  • This command escapes non-Latin characters in strings.
jadx --escape-unicode -d out app.apk

32. Generate JSON Output​

  • This command writes decompiled output in JSON format.
jadx --output-format json -d json-out app.apk

33. Generate Control Flow Graphs​

  • This command saves method control flow graphs as DOT files.
jadx --cfg -d cfg-out app.apk

34. Generate Raw Control Flow Graphs​

  • This command saves raw method control flow graphs.
jadx --raw-cfg -d raw-cfg-out app.apk

35. Set Error-Only Logging​

  • This command reduces logs to errors.
jadx --log-level error -d out app.apk

36. Run Quietly​

  • This command turns off normal output.
jadx --quiet -d out app.apk

37. Run Verbosely​

  • This command enables verbose debug-style output.
jadx --verbose -d out app.apk

38. Disable a Plugin​

  • This command disables selected JADX plugins by ID.
jadx --disable-plugins kotlin-metadata -d out app.apk

39. Save a Config File​

  • This command saves current options to a config file and exits.
jadx --save-config jadx-config.json

40. Load a Config File​

  • This command loads options from a config file.
jadx --config jadx-config.json -d out app.apk

41. Print JADX Files and Directories​

  • This command prints config, cache, and temp paths used by JADX.
jadx --print-files

42. List Plugins​

  • This command lists installed plugins.
jadx plugins --list

43. List Available Plugins​

  • This command lists available marketplace plugins.
jadx plugins --available

44. Install a Plugin​

  • This command installs a plugin by location ID.
jadx plugins --install <location_id>

45. Disable Zip Security Checks for a Lab File​

  • This command disables zip security checks through an environment variable for controlled troubleshooting.
JADX_DISABLE_ZIP_SECURITY=true jadx -d out app.apk

Output Examples​

CommandDescriptionExample Output
jadx --versionShows the installed version.1.5.x
jadx -d out app.apkDecompiles an APK into an output directory.INFO - loading ...
INFO - done
jadx --no-src -d res app.apkDecodes resources only.res/values/strings.xml
AndroidManifest.xml
jadx --single-class com.example.MainActivity app.apkDecompiles one class.public class MainActivity extends Activity { ... }
jadx --deobf -d out app.apkEnables deobfuscation.INFO - deobfuscation map saved
jadx --output-format json -d json-out app.apkWrites JSON output.json-out/code/...
jadx plugins --listLists installed plugins.Installed plugins:
kotlin-metadata