Mobile › Module 3 › Lesson 2
jadx Literacy
jadx names a decompiler GUI/CLI for dex → Java-like source — tool literacy on YOUR $MOB_LAB APK; not a license to pirate or attack unauthorized apps.
Visual · t27_jadx_literacy
jadx literacy. $MOB_LAB only. Original Cyberlium.
Opening
jadx helps you read what YOU built or what courseware authors intended — still bounded by scope and copyright.
jadx-gui and jadx-cli open APK/AAB/dex and show decompiled Java-ish source, smali toggle, resource tree, and cross-references. Useful for understanding control flow, hardcoded strings in lab apps, and manifest merges. Decompiled output is approximate — obfuscation breaks readability on purpose. Cyberlium treats jadx as tool literacy on YOUR $MOB_LAB targets — DVIA, self-built debug APK, MSTG sample — never 'jadx every app on the Play Store.' Next: Manifest/Secrets.
1. jadx workflow (named, lab APK only)
Typical flow: open APK → wait for decompile → browse package tree → search strings → jump to cross-refs → export for notes (lab only). Prefer YOUR debug build with symbols over obfuscated production malware samples from the internet.
On $MOB_LAB, sketch five jadx steps for one course vulnerable APK — no unauthorized targets.
Command guide
Try these commands — jadx workflow (named, lab APK only)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
JADX releases — https://github.com/skylot/jadx/releases (install literacy) JADX repo — https://github.com/skylot/jadx (static analysis tool context) OWASP MASTG static — https://mas.owasp.org/MASTG/0x05c-Testing-Static-Analysis/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
command -v jadx >/dev/null && jadx --version || echo 'jadx not installed — curl GitHub releases for literacy'
curl -sS https://api.github.com/repos/skylot/jadx/releases/latest | head -20
grep -E 'NEVER|YOUR lab' "$MOB_LAB/notes/no-stranger-phones.txt"Primary tools to practice this lesson: curl, grep. Reference sites: JADX releases (https://github.com/skylot/jadx/releases); JADX repo (https://github.com/skylot/jadx); OWASP MASTG static (https://mas.owasp.org/MASTG/0x05c-Testing-Static-Analysis/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What jadx is not
Not permission to bypass licenses or redistribute decompiled commercial code. Not guaranteed accurate against heavy obfuscation. Not a substitute for dynamic testing or authorized scope.
Defenders use similar tools internally under contract — students stay on lab APKs.
3. Tool literacy boundary
Forbidden: decompiling stranger banking APKs, publishing decompiled source, or using jadx output to craft pinning bypass recipes for production. Allowed: jadx flow card — five steps, lab package name, read-only notes.
Ship: jadx flow card tied to $MOB_LAB APK. Next: Manifest/Secrets.
4. What you ship: jadx flow card for $MOB_LAB
Five-step flow, lab package name, scope note. $MOB_LAB named. NO unauthorized APKs. chmod 600.
5. What you record before the next lesson
Date. jadx flow card. $MOB_LAB named. File t27-m03-l02-jadx-literacy.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Decompile trending game APK for clout. Publish decompiled bank source.
Right
Write jadx flow card for YOUR $MOB_LAB sample APK. Next: Manifest/Secrets.
Mission: map jadx steps on YOUR lab APK
1) List five workflow steps. 2) Name lab package only. 3) Note obfuscation limit in one line. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Search strings before diving smali — faster on DVIA-class apps.
Knowledge Check
APPLY: jadx literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: jadx output can be inaccurate under heavy obfuscation.
True or False
Knowledge Check
APPLY: Before jadx on an APK you should:
Multiple choice