Record the artifact and purpose
Write down the package version, origin and extraction goal. A request to inspect a bundled license needs a different workflow from recovering an entire resource tree. Use your own build or an APK you are authorized to analyze, especially when it contains customer data, proprietary assets or configuration.
apkanalyzer apk summary app.apk
apkanalyzer files list app.apk
These commands provide an inventory without launching the app. Command reference.
Extract narrowly when possible
For a known text entry, apkanalyzer files cat can print its contents:
apkanalyzer files cat --file /assets/example.txt app.apk
Replace the example path with an entry actually listed in your package. Do not use this text-oriented inspection pattern to judge whether a binary file is corrupt. A binary manifest, resource table or DEX file needs a format-aware parser.
If using an archive program, select a fresh destination folder rather than your source repository. Check for unexpected absolute paths, parent-directory traversal and enormous uncompressed totals before a bulk extraction. Avoid automatically opening or executing the extracted contents.
Know which files need another tool
| Extracted item | Next step |
|---|---|
| Plain JSON or license text | Read it as data; redact sensitive values before sharing |
| Binary AndroidManifest.xml | Decode with an Android-aware tool |
resources.arsc |
Inspect with a resource-table-aware analyzer |
classes.dex |
Analyze or decompile as DEX |
Native .so library |
Use architecture-aware native tooling |
A .json extension is not a guarantee that the file contains safe public information. Configuration can include endpoint names, identifiers or accidentally embedded credentials.
Compare extraction results carefully
For a release regression, compare the same paths from two known builds. Record additions, removals and changed sizes. Do not infer that an asset is unused merely because a text search cannot find its filename; it may be loaded dynamically, referenced by resource ID or accessed through native code.
The Android security guidance provides context for reviewing what should and should not be packaged with an application.
Preserve reproducibility
Keep the extraction command, tool version and a list of selected entries with your analysis. Delete temporary copies according to your project's retention rules. Never distribute a modified APK as the original signed release.
APKLint's decompiler can assist package inspection. Its result is an analysis artifact, not evidence that extracted files are licensed for reuse or that all application data was present in the APK.
Extract a specific license without losing its identity
Suppose a release review needs the license text bundled at assets/licenses/example-library.txt. First confirm the exact path in the archive listing, then extract or print that entry without modifying the APK. Save it with the APK hash and its internal path. If a second release changes the notice, compare those two selected entries rather than flattening both full archives into the same folder and guessing which copy is current.
Preserve the file's bytes when recording a hash. A text editor may normalize line endings or rewrite encoding when you save it, producing a different digest even if the visible paragraphs appear identical. Keep the raw extracted file as evidence and use a separate viewing copy if conversion is necessary. A notice's presence also does not establish that every redistribution obligation has been met; follow the applicable license and the project's dependency records.
Define where each archive member may be written
For a bulk extractor, resolve every output path beneath a dedicated destination before writing it. Reject an absolute path, a parent-directory escape or a link that would write outside that destination. Apply entry-count and expanded-size limits according to your analysis environment. Android's ZIP path traversal guidance describes the underlying path-validation issue.
Do not use the existing source checkout as an extraction destination. Even a normal package can contain filenames that collide with local analysis notes, while a case-insensitive filesystem can merge names that were distinct in the archive. Record collisions explicitly instead of silently overwriting the earlier entry. A complete inventory should retain the original member name and the outcome of its extraction.
Afterward, open only the selected data with a suitable viewer. An extracted script is still data for this task, not an instruction to run it. Keep a clear distinction between successfully copying an entry, successfully parsing its format and establishing what role it plays in the app. Each observation supports a different conclusion.
Sources and further reading
Reference review: 29 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
