2

For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the device and adb pull it off the device.

For example, on stackoverflow, the answer by yojimbo with 1500+ upvotes, gives the following 3 steps:

  1. Determine the package name of the app, e.g. "com.example.someapp". Using adb shell pm list packages.
  2. Get the full path name of the APK file for the desired package. Using adb shell pm path com.example.someapp
  3. Using the full path name from Step 2, pull the APK file from the Android device to the development box. Using adb pull /data/app/com.example.someapp-2.apk path/to/desired/destination

Sounds simple enough, and it has been so far on many apps. Then, today, I came across an app where step 2 returned not 1 but 3 apk files:

adb shell pm path the.app.package
package:/data/app/the.app.package-che0LFSLF9su1gFiz9cVbw==/base.apk
package:/data/app/the.app.package-che0LFSLF9su1gFiz9cVbw==/split_config.arm64_v8a.apk
package:/data/app/the.app.package-che0LFSLF9su1gFiz9cVbw==/split_config.xxxhdpi.apk

where I have replaced the actual package name with the.app.package. I'm guessing that there are parts of the code that are specific for arm64_v8a and/or xxxhdpi displays, and these are separated out into the split_config apk files? How would one begin in analyzing such apps where there's not just a base.apk but some of these additional apk files as well?

  • 3
    Split apk bundles are very common for large apps (see also Android App bundles). In the end you need all APK files to to get the full app. Some apk files usually don't contain code like the hdpi apk file. See also APK download portals like ApkPure.com, they provide split apps as "APKX" (ZIP of APK files) files like for example Google Maps: apkpure.com/maps-navigate-explore/com.google.android.apps.maps – Robert Jul 9 '20 at 8:21
1

You asked how you should begin; the first step is likely to determine what is in each APK and if it is relevant to your goals. Simply extract them all and poke around a bit.

Like Robert's comment says, Android App Bundles are a common format, and serve to modularize the app by shipping only the components needed for a particular device. So in this case, it appears the 3 APKs likely contain the base application, native libraries for ARMv8, and corresponding assets/resources for a HDPI device.

I think if you looked at each APK, you may quickly realize which pieces are or are not relevant to you, depending what you are particularly interested in.

  • Thanks for your answer. Is there a one-to-one correlation between having split apks and building/packaging the app as an android app bundle? – auspicious99 Jul 17 '20 at 15:02
  • If I get what you are asking, then I think the answer is that they are the same thing. – multithr3at3d Jul 17 '20 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.