Github: https://github.com/marcoantap/RevAPK
Email: marcoantap@gmail.com
Reddit: u/cronocr
Made in Costa Rica
RevAPK (Reverse Engineer APKs) is a Python CLI managed by Pixi. It searches Google Play, downloads free applications without silently re-signing them, preserves the downloaded artifacts, decodes resources and Smali with Apktool, and emits readable Java with JADX.
| Project | Link |
|---|---|
| GPlay APK Downloader | https://github.com/alltechdev/gplay-apk-downloader |
| Apktool | https://github.com/iBotPeaches/Apktool |
| Smali2Java | https://github.com/only52607/smali2java |
Install Pixi, then from PowerShell:
pixi run bootstrapBootstrap downloads pinned Apktool and JADX releases and a pinned snapshot of
alltechdev/gplay-apk-downloader. Java and Python themselves come from Pixi.
The upstream downloader does not ship a public token dispenser. Supply an operator-controlled Aurora-compatible dispenser:
$env:DISPENSER_URL = "https://your-dispenser.example"
pixi run revapk authDo not point automated clients at infrastructure reserved for Aurora Store users.
pixi run revapk search "signal" --limit 10
pixi run revapk download org.thoughtcrime.securesms
pixi run revapk fetch org.thoughtcrime.securesms
pixi run revapk decompile C:\path\to\application.apkFor a local APK, the default analysis location is beside the APK:
C:\path\to\application\. Pass --output C:\another\case to use an
explicit case directory instead.
Each analysis case contains:
output/<package>/
├── original/ untouched downloaded APK/split archive
├── decoded/ Apktool resources, manifest, and smali/smali_classes*
├── java/ JADX Java source and decoded resources
└── manifest.json SHA-256 provenance and output map
Use --force to replace only the derived decoded/ and java/ directories.
The preserved original is never modified by either decompiler.
Environment overrides are available for controlled/offline installations:
REVAPK_GPLAY_SCRIPT, REVAPK_APKTOOL_JAR, REVAPK_JADX, and REVAPK_HOME.
pixi run testgplay-apk-downloader: Google Play search, anonymous authentication, device profiles, and base/config-split download.Apktool: near-original resource decoding and editable Smali project layout.only52607/smali2java: confirms JADX as the Smali-to-Java decompilation engine; RevAPK applies it to the whole APK rather than one editor-selected file.
Use this only for applications you own or are authorized to inspect. Google Play
authentication and delivery can change, paid applications are not supported, and
obfuscation or malformed bytecode can prevent perfect Java reconstruction.
Java output is a decompiler's approximation; decoded/smali* is the authoritative
editable code representation. JADX can return a non-zero exit code when only some
classes fail; RevAPK retains the successful Java output, marks it partial in
manifest.json, and reports how many .java files were generated.
Modern Play apps often have a base APK plus configuration splits. RevAPK retains those originals. It deliberately does not merge/re-sign them in the analysis pipeline because that would destroy the original signature state.