Miscellaneous#

Bulk decompilation and Export#

Bulk decompilation and export to *.java files on disk can be done in the UI client via the menu command File, Export, DEX Fast Decompilation.

You may also provide a regular expression filter if you'd like to restrict decompilation to a package and its sub-packages, e.g. com\.xyz\..* will decompile all classes in com.xyz and its sub-packages.

Refer to this note for generic details on exporting output.

Callgraph fragment#

The callgraph fragment is not specific to Android (most code analysis can ask to generate one). It is an experimental feature designed to represent trimmed callgraphs of the most important routines and most important invocations between those routines.

The fragment is located in the lower right-hand corner of a standard workspace. The callgraph is not generated by default:

Empty callgraph

Click on the fragment to generate it. The navigation shortcuts are similar to those used in the CFG fragment ('\' to center, '[' and ']' or zoom in and out, etc.). Click a node to set the focus on the associated routine and their connections. Double-click a node to jump to that routine in the disassembly listing.

A generated callgraph

Displaying synthetic items#

How to always display synthetic fields and methods in decompiled views? In the vast majority of the cases, synthetic accessors used by inner classes need not be displayed as they are re-optimized into direct, seamless outer class field access or method invocation.

However, if you wish to display them: In a decompiled view, right-click, "Rendering Options" and tick the boxes "Generate synthetic fields" and "Generate synthetic methods". You may also change this setting once and for all in the Engines option (Edit, Options, Engines).

Example: forcing rendering of Synthetic Fields

Third-party Frameworks#

When analyzing applications using resources located in other frameworks that the Android Framework (e.g. the Samsung framework), follow those steps:

  • Retrieve the custom framework archive using adb pull. It is normally stored somewhere in the device's /system/framework/ folder. Let's call it framework.zip.
  • Run aapt2 dump framework.zip and retrieve the first line, which will be something like Package name=xxxxxxx id=N. Note the id, N.
  • Navigate to the folder listed in your .parsers.apk.FrameworksDirectory engines property. Typically, it will be the HOME_FOLDER/.jeb-android-frameworks folder
  • Copy framework.zip into this folder, and rename it to N.zip
  • JEB should now be able to pick up that framework and use its resources when needed

Note

1.zip in the FrameworksDirectory folder is the Android framework itself, which has id 1.