# from this repo (Rust toolchain required for the optional extras)
# Python 3.14+ needs the PyO3 forward-compat flag (bindings use PyO3 0.23, max 3.13)
export PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
pip install -e .
pip install -e '.[full]'

pip install androguard
pip install 'androguard[full]'

python -m examples.application_summary
python -m examples.disassemble      # androguard[disasm]
python -m examples.decompile       # androguard[decompile]
python -m examples.arm             # androguard[arm]
python -m examples.patch_decode    # androguard[patch]
python -m examples.run_all

claude /agent androguard-analyst
claude /analyze-apk path/to/app.apk
claude /decompile-apk path/to/app.apk com.example.app

pip install -e '.[mcp,decompile]'   # add [disasm] for disassembly tools
androguard-mcp                     # or: python -m androguard.mcp

{
  "mcpServers": {
    "androguard": {
      "command": "androguard-mcp",
      "env": {
        "ANDROGUARD_MCP_ROOTS": "/path/to/androguard"
      }
    }
  }
}

# Summary: package, main activity, dex count, classes, methods
androguard -i my.apk

# List classes or methods
androguard -i my.apk --list-classes
androguard -i my.apk --list-methods

# Disassemble methods matching regex (requires androguard[disasm])
androguard -i my.apk --disasm --class 'TestActivity' --method 'onCreate'
androguard -i my.apk --disasm --class 'Ltests/androguard/.*' --method '<init>'
androguard -i my.apk --disasm --method 'onCreate' --limit 10
androguard -i my.apk --disasm --class TestActivity --method onCreate --cfg

# Decompile to Java (requires androguard[decompile])
androguard -i my.apk --decompile-method 'tests.androguard.TestActivity#onCreate'
androguard -i my.apk --decompile --class TestActivity --method onCreate
androguard -i my.apk --decompile -o out.java
androguard -i my.apk -d decompiled/ --only-package tests.androguard
androguard -i my.apk --getclass tests.androguard.TestActivity
androguard -i my.apk --findrefs string --findrefs-value password
androguard -i my.apk --scan-vulns
androguard -i my.apk --emulate 'tests.androguard.TestActivity#onCreate'

# Decode project tree (requires androguard[patch])
androguard -i my.apk --decode-project

from androguard import Application

app = Application("my.apk")

print(app.summary())
# {'app_name': '...', 'main_activity': '...', 'package': 'com.example',
#  'dex_files': ['classes.dex', ...], 'classes': 1234, 'strings': 5678,
#  'methods': 8900, 'signed': True}

for name in app.class_names[:10]:
    print(name)

for method in app.methods:
    if method.get_code():
        print(method.class_name, method.name, method.get_code().insns_size)

import io
from apkparser import APK, OPTION_AXML, OPTION_SIGNATURE, OPTION_PERMISSION

with open("my.apk", "rb") as f:
    apk = APK(
        io.BytesIO(f.read()),
        {
            OPTION_AXML: True,
            OPTION_SIGNATURE: True,
            OPTION_PERMISSION: True,
        },
    )

print(apk.get_app_name())
print(apk.get_main_activity())
print(apk.axml.package if apk.axml else "")  # from decoded manifest
print(list(apk.get_dex_names()))  # classes.dex, classes2.dex, ...

manifest_xml = apk.get_android_manifest()
raw_manifest = apk.get_file("AndroidManifest.xml")

from androguard.core.apk import APK, OPTION_AXML

from dexparser import DEX, DEXHelper, DEX_from_source

# From APK bytes (via apkparser)
raw = apk.get_file("classes.dex")
dh = DEXHelper.from_string(raw)

# From a .dex file on disk
d = DEX.from_path("classes.dex")
dh = DEXHelper.from_rawdex(d)

# Path, bytes, or stream
dh = DEXHelper.from_rawdex(DEX_from_source("classes.dex"))

for cls in dh.get_classes():
    print("CLASS", cls.name, "extends", cls.sname)

for method in dh.get_methods():
    print("METHOD", method.class_name, method.name, method.proto)
    code = method.get_code()
    if code:
        insns = code["insns"].value   # raw Dalvik bytecode (bytes)
        print("  insns:", code.insns_size, "bytes:", len(insns))

for field in dh.get_fields():
    print("FIELD", field.class_name, field.name, field.type_field)

for s in dh.get_strings():
    if "password" in s.lower():
        print(s)

d = DEX(bytes_data)
print(d["header"])  # file_size, class_defs_size, string_ids_size, ...

from androguard.misc import AnalyzeAPK, AnalyzeDex

apk_obj, dex_helpers, app = AnalyzeAPK("my.apk")
dh = AnalyzeDex("classes.dex")       # path or bytes

from androguard.core.bytecode import (
    disassemble,
    disassemble_method_code,
    basic_blocks,
    cfg_edges,
    patch_branch,
    encode_instruction,
    encode_nop,
)

# Raw bytecode
for ins in disassemble(b"\x00\x00\x0e\x00"):
    print(f"{ins['offset']:08x}  {ins['mnemonic']} {ins['operands']}")

# CFG / basic blocks
print(basic_blocks(b"\x00\x00\x28\x00\x0e\x00"))  # nop; goto +0; return-void
print(cfg_edges(b"\x00\x00\x28\x00\x0e\x00"))

# Encode / patch
print(encode_instruction("const/4", "v0, 1").hex())
print(encode_nop().hex())
mutated = patch_branch(b"\x28\x01\x0e\x00", 0, 2)

# From a parsed method
code = method.get_code()
if code:
    for ins in disassemble_method_code(code):
        print(ins["disasm"])

for method in app.methods:
    code = method.get_code()
    if not code:
        continue
    for line in app.iter_disassembly(method):
        print(line)
    print(app.method_basic_blocks(method))
    print(app.method_cfg_edges(method))

from androguard.core.decompiler import (
    parse_dex,
    decompile_method,
    getclass,
    findrefs,
    scan_vulns,
    method_cfg,
    emulate_method,
    descriptor_to_java,
)

raw = apk.get_file("classes.dex")
dex = parse_dex(raw)

# Entire DEX as one Java source string
print(dex.decompile()[:2000])

# One method (Java class names)
java = dex.decompile_method("tests.androguard.TestActivity", "onCreate")

# Package layout on disk
dex.decompile_to_dir("out/")

# ASC helpers (APK or DEX bytes)
print(getclass(apk_bytes, "tests.androguard.TestActivity")[:500])
print(findrefs(apk_bytes, "string", "password")[:5])
print(scan_vulns(raw)[:3])
rows, nodes, edges = method_cfg(raw, "tests.androguard.TestActivity", "onCreate")
print(emulate_method(raw, "tests.androguard.TestActivity", "onCreate"))

# Dalvik descriptor → Java name
print(descriptor_to_java("Ltests/androguard/TestActivity;"))
# tests.androguard.TestActivity

# CLASS#METHOD selector (Java names, same as dex-decompiler CLI)
print(app.decompile_method_selector("tests.androguard.TestActivity#onCreate"))

# Regex on Dalvik descriptors / method names
for method, source in app.iter_decompiled_methods(
    class_pattern=r"TestActivity",
    method_pattern=r"onCreate",
):
    print(method.class_name, "→", len(source), "chars")

# All DEX files from the APK → decompiled/ classes/ classes2/ …
app.decompile_apk_to_dir("decompiled/", only_package="tests.androguard")

# ASC + analysis
print(app.getclass("tests.androguard.TestActivity")[:500])
print(app.findrefs("type", "Landroid/app/Activity;"))
print(app.scan_vulns()[:3])
print(app.emulate("tests.androguard.TestActivity", "onCreate"))

from androguard.core import arm

print(arm.decode_one(0xD503201F))  # nop
for ins in arm.disassemble(bytes.fromhex("1f2003d5c0035fd6")):
    print(ins["text"])

out = arm.decompile(bytes.fromhex("1f2003d5c0035fd6"), name="foo")
print(out["source"])

from androguard.core import patch

project = patch.decode(apk_bytes, no_res=True)
# edit project["files"]["project/AndroidManifest.xml"] etc.
rebuilt = patch.build(project["files"], project_root=project["project_root"])

# or one-shot
rebuilt = patch.roundtrip(apk_bytes, sign=True)
# via Application
project = app.decode_project(only_manifest=True)
rebuilt = app.rebuild(sign=True, no_res=True)

from androguard.misc import AnalyzeAPK

apk_obj, dex_list, app = AnalyzeAPK("my.apk")
print(app.summary())

 http://www.apache.org/licenses/LICENSE-2.0