Mobile › Module 3 › Lesson 1
APK Structure
APK structure names AndroidManifest.xml, classes.dex, resources.arsc, lib/, assets/ — map anatomy on YOUR $MOB_LAB sample before decompilation.
Visual · t27_apk_structure
APK anatomy literacy. $MOB_LAB only. Original Cyberlium.
Opening
An APK is a zip with rules — literacy names what static tools read, not how to repackage stranger apps.
APK contents: AndroidManifest.xml (binary XML), classes.dex (Dalvik bytecode), resources.arsc (compiled resources), res/ layouts and drawables, lib/ native.so per ABI, assets/ raw files, META-INF/ signing blocks. App Bundle (.aab) splits delivery — students often analyze built debug APK from THEIR project. Cyberlium maps APK anatomy on YOUR $MOB_LAB debug or course APK — unzip listing only on authorized targets — never dissect production bank APKs you do not own. Next: jadx Literacy.
1. Core APK entries (named)
AndroidManifest.xml: permissions, components, version. classes.dex: Java/Kotlin compiled to dex — multiple dex in multidex apps. resources.arsc: string IDs and configuration. lib/arm64-v8a/: native code paths for JNI and third-party SDKs.
On $MOB_LAB, list seven entries from unzip -l on YOUR sample APK — lab package only.
Command guide
Try these commands — Core APK entries (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
APK format — https://developer.android.com/studio/command-line/aapt2 (package structure literacy) OWASP MASTG static — https://mas.owasp.org/MASTG/0x05c-Testing-Static-Analysis/ JADX — https://github.com/skylot/jadx (decompiler literacy — YOUR APK only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
mkdir -p "$MOB_LAB/apk/demo-build"
cat > "$MOB_LAB/apk/demo-build/AndroidManifest.xml" <<'EOF'
<?xml version="1.0" encoding="utf-8"?>
<manifest package="com.cyberlium.lab.demo" xmlns:android="http://schemas.android.com/apk/res/android">
<application android:label="CyberliumLabDemo" />
</manifest>
EOFCommand — copy this
python3 - <<'PY'
import os, zipfile
lab = os.environ.get('MOB_LAB', os.path.expanduser('~/cyberlium-lab/t27-mob'))
apk = os.path.join(lab, 'apk', 'demo.apk')
stub = os.path.join(lab, 'apk', 'demo-build', 'AndroidManifest.xml')
with zipfile.ZipFile(apk, 'w', zipfile.ZIP_DEFLATED) as z: z.write(stub, 'AndroidManifest.xml')
print(f'Created YOUR lab demo.apk: {apk}')
PYCommand — copy this
unzip -l "$MOB_LAB/apk/demo.apk"
Primary tools to practice this lesson: unzip, python3. Reference sites: APK format (https://developer.android.com/studio/command-line/aapt2); OWASP MASTG static (https://mas.owasp.org/MASTG/0x05c-Testing-Static-Analysis/); JADX (https://github.com/skylot/jadx). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Signing and integrity
META-INF/ and APK Signing Scheme v2/v3 protect tamper detection — Play Protect and enterprise MDM rely on signatures. Repackaging lab APKs you built is learning; repackaging stranger production apps is out of scope and often illegal.
Defenders verify publisher signature and hash before trust decisions.
3. Static literacy boundary
Forbidden: downloading competitor APKs for unauthorized teardown. Allowed: APK anatomy card — seven entries, one sentence each, $MOB_LAB package name.
Ship: APK anatomy card for YOUR lab sample. Next: jadx Literacy.
4. What you ship: APK anatomy card for $MOB_LAB
Seven entries with one-line roles. $MOB_LAB package named. NO unauthorized APKs. chmod 600.
5. What you record before the next lesson
Date. APK anatomy card. $MOB_LAB named. File t27-m03-l01-apk-structure.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Pull bank APK from mirror site for 'structure practice.' Skip signing note.
Right
Write APK anatomy card for YOUR $MOB_LAB sample APK. Next: jadx Literacy.
Mission: list APK entries on YOUR lab sample
1) Name role of AndroidManifest.xml and classes.dex. 2) Note lib/ ABI folder purpose. 3) Cite $MOB_LAB package name. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Debug APK from YOUR Android Studio project is the safest static target.
Knowledge Check
APPLY: classes.dex primarily contains:
Multiple choice
Knowledge Check
APPLY: True or False: APK signing helps detect tampering.
True or False
Knowledge Check
APPLY: APK structure literacy uses:
Multiple choice