Getting android app from device for reversing - what if there are multiple apks?

Question

For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the device and adb pull it off the device.

For example, on stackoverflow, the answer by yojimbo with 1500+ upvotes, gives the following 3 steps:

1. Determine the package name of the app, e.g. "com.example.someapp". Using adb shell pm list packages.
2. Get the full path name of the APK file for the desired package. Using adb shell pm path com.example.someapp
3. Using the full path name from Step 2, pull the APK file from the Android device to the development box. Using adb pull /data/app/com.example.someapp-2.apk path/to/desired/destination

Sounds simple enough, and it has been so far on many apps. Then, today, I came across an app where step 2 returned not 1 but 3 apk files:

adb shell pm path the.app.package
package:/data/app/the.app.package-che0LFSLF9su1gFiz9cVbw==/base.apk
package:/data/app/the.app.package-che0LFSLF9su1gFiz9cVbw==/split_config.arm64_v8a.apk
package:/data/app/the.app.package-che0LFSLF9su1gFiz9cVbw==/split_config.xxxhdpi.apk

where I have replaced the actual package name with the.app.package. I'm guessing that there are parts of the code that are specific for arm64_v8a and/or xxxhdpi displays, and these are separated out into the split_config apk files? How would one begin in analyzing such apps where there's not just a base.apk but some of these additional apk files as well?

Answer 1

You asked how you should begin; the first step is likely to determine what is in each APK and if it is relevant to your goals. Simply extract them all and poke around a bit.

Like Robert's comment says, Android App Bundles are a common format, and serve to modularize the app by shipping only the components needed for a particular device. So in this case, it appears the 3 APKs likely contain the base application, native libraries for ARMv8, and corresponding assets/resources for a HDPI device.

I think if you looked at each APK, you may quickly realize which pieces are or are not relevant to you, depending what you are particularly interested in.