.APK

Introduction

An .apk file is an Android app ready to install: its compiled code, its resources and a manifest describing it, signed by the developer. Apps are now usually uploaded to Google Play as Android App Bundles (.aab), from which the store builds APKs for each device, but the installed app is still an APK, and APKs remain the way to install apps from outside a store.

Software

• Android, which installs them
• Android Studio, with the APK Analyzer (Windows, macOS, Linux)
• apksigner, which signs and verifies them (Windows, macOS, Linux)
• Apktool, which decodes resources and the manifest (Windows, macOS, Linux)
• jadx, which decompiles the code to Java (Windows, macOS, Linux)
• 7-Zip, which opens the ZIP inside (Windows)

Structure

An APK is a ZIP archive with a fixed set of entries:

• AndroidManifest.xml: the app’s name, components and permissions, in Android’s binary XML format.
• classes.dex, and classes2.dex and so on: the app’s code as Dalvik bytecode, which the Android Runtime runs.
• resources.arsc: the compiled table of strings and other resources.
• res/ and assets/: layouts, images and other files.
• lib/: native libraries, in a folder per processor type, such as lib/arm64-v8a/.
• META-INF/: the older, JAR-style signature, when present.

Newer signature schemes (version 2 and later) put an APK Signing Block between the last file entry and the ZIP’s central directory. It signs the whole file, so changing any byte breaks the signature.