any Android app on your phone is now an open book for Claude Code the stack: Claude Code → REA (MCP) → headless JADX apk → map → trace → spec → build step 1 → npx rea-agents setup step 2 → full JDK 17+ and the pinned JADX 0.7.1 jar. this is where most setups die step 3 → map the manifest, entry points and DEX before reading any method step 4 → investigate_feature walks UI → handler → the one method that does the work step 5 → SPEC.md from behavior only, build your version in a fresh session the big mistake: reading class names. R8 turns them into a.b.c. anchor on strings, resource ids, framework calls the limit: logic hidden in native .so files or packers won't come back as clean Java. and it's static only, no running or patching save this before you pick your first APK
any Android app on your phone is now an open book for Claude Code the stack: Cla
X post describing a Claude Code → REA (MCP) → headless JADX workflow for mapping an Android APK, tracing a feature, writing SPEC.md from observed behaviour and rebuilding the app, with setup steps and caveats about R8 obfuscation and native libraries.
About this case
any Android app on your phone is now an open book for Claude Code
the stack: Claude Code → REA (MCP) → headless JADX
apk → map → trace → spec → build
step 1 → npx rea-agents setup step 2 → full JDK 17+ and the pinned JADX 0.7.1 jar. this is where most setups die step 3 → map the manifest, entry points and DEX before reading any method step 4 → investigate_feature walks UI → handler → the one method that does the work step 5 → SPEC.md from behavior only, build your version in a fresh session
the big mistake: reading class names. R8 turns them into a.b.c. anchor on strings, resource ids, framework calls
the limit: logic hidden in native .so files or packers won't come back as clean Java. and it's static only, no running or patching
save this before you pick your first APK
Setup
See the original source for installation instructions.
Original text / README
any Android app on your phone is now an open book for Claude Code
the stack: Claude Code → REA (MCP) → headless JADX
apk → map → trace → spec → build
step 1 → npx rea-agents setup step 2 → full JDK 17+ and the pinned JADX 0.7.1 jar. this is where most setups die step 3 → map the manifest, entry points and DEX before reading any method step 4 → investigate_feature walks UI → handler → the one method that does the work step 5 → SPEC.md from behavior only, build your version in a fresh session
the big mistake: reading class names. R8 turns them into a.b.c. anchor on strings, resource ids, framework calls
the limit: logic hidden in native .so files or packers won't come back as clean Java. and it's static only, no running or patching
save this before you pick your first APK
Similar projects
Developer describes using REA (a reverse-engineering skill for AI agents) to inspect TCL's BrowseHere APK, finding Firebase analytics, TCL ads and pre-ticked data-sharing settings, then having Claude build Sofa TV Browser — an open-source, GPL-3.0 Android TV browser with remote-friendly UX, tracker blocking, no analytics and no backend. Hosted on GitHub, distributed as an APK.
I had AI reverse-engineer TCL's BrowseHere and build a private, open-source alternative: Sofa TV Browser
Traces a page-facing API in Notion's packaged JavaScript through its IPC wrappers to the system clipboard and shows how an HTML marker links rich block data to a copy.
✳︎ How Notion copies text and HTML
└─ Make every conversation easier
How Notion copies text and HTML
An agent analysed only the shipped Windows binary of an open-source puzzle game, wrote its findings, froze them, rebuilt the game as a web page and was graded against the real source (52 of 54 claims correct).
