Preserve the artifact and objective
Record the source, SHA-256 hash, package, version and signing fingerprint. Keep the original unchanged. Use a working copy in an isolated directory and write down the tool versions used.
Question: did release B include the expected network configuration?
Inputs: release A and release B, with hashes
Method: manifest/resource inspection and code cross-reference
Finding: exact file or class location
Limitations: decompiler warnings and missing splits
This structure keeps an observation separate from an assumption about the original project.
Inspect structure before reconstructing code
Use APK Analyzer or its CLI to examine the package inventory. Then use a maintained decompiler such as JADX where Java-like output helps answer the question. Treat reconstructed code as an interpretation of bytecode, not a guaranteed copy of the original source.
If JADX reports failures, preserve those warnings. A missing or simplified method in the output does not prove the code was absent from the application.
Compare like with like
Compare the same build type, ABI and delivery format. A universal debug APK and a device-specific release split set differ for reasons unrelated to a code change. Normalize the comparison before attributing every size or file difference to a regression.
For a suspected dependency change, corroborate package observations with your resolved Gradle graph and release records when available.
Keep the work inside authorized boundaries
Inspect only applications and systems you own or have permission to assess. Embedded URLs do not grant permission to probe third-party services. Avoid modifying license checks, redistributing proprietary content or using production credentials in experiments.
Connect findings to a fix
A useful result names the artifact, evidence location and engineering action. APKLint's decompiler and inspection tools can accelerate preliminary review, but an APK cannot reliably restore your full Android Studio project, signing keys, repository history or original build configuration. Use source control and build archives for recovery whenever possible.
Compare the network policy in two retained releases
Take an owned release A and release B with known package identities and hashes. Ask whether B removed a development network exception. Inspect the manifest's configuration reference and the corresponding packaged resource in each artifact. Keep both the reference and decoded rule, because a resource with the expected name is irrelevant if the application no longer points to it.
The APK Analyzer CLI offers package and resource inspection. Record the exact tool version and any decoding warnings. When the app uses split delivery, include the pieces relevant to the installed configuration rather than comparing an incomplete base package with a complete universal APK.
Keep the static conclusion narrower than runtime behavior
If B's packaged policy no longer contains the exception, you have evidence of a configuration change. You have not yet proved that every network client honors that policy. Identify the clients used by the affected feature and exercise the expected allowed and prohibited connections in an authorized test environment.
Use reconstructed code only where it helps locate the client or reference. The JADX documentation describes its bytecode-to-source capabilities and incomplete cases. Corroborate a confusing reconstruction with your source and build records when available instead of rewriting production logic solely from a decompiler's presentation.
Keep unrelated artifact differences out of the causal explanation. Optimization, resource shrinking, ABI selection and signing can change many bytes. A complete binary diff is useful for inventory, but the network-policy question needs a focused comparison of the relevant configuration and observed requests.
If the exception unexpectedly remains, trace its source through the build's resource and variant configuration. Repair the maintained source and rebuild the intended variant. Do not replace the official release with an edited lab package merely because the decoded XML was easy to change.
Finish the notebook with the original question, supporting file locations, runtime result and limitation. Another developer should be able to repeat the comparison using the same retained artifacts without guessing which file called final was actually inspected.
Sources and further reading
- JADX: Official project documentation
- Android Developers: apkanalyzer command-line reference
- OWASP: Mobile Application Security Testing Guide
Reference review: 29 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
