Request sample reportGet a quote
Get a quote Request sample report

Free open-source tool

getAPK, an APK extractor for Android

Pull an installed app off your own Android phone in one command. getAPK finds every APK the app is made of, checks each one, and gives you a single file that's ready to analyse. No root needed.

Runs on your own computer. Nothing is sent to us.

Recommended

Install with pipx

One command installs getAPK from PyPI. It has no Python dependencies; it only needs adb, from Android's platform-tools.

pipx install getapk

Source code

Get the tool from GitHub

The full source, the README and the MIT licence. Clone it and install it with pipx from the folder.

git clone https://github.com/RansomWhisker/getAPK.git
cd getAPK
pipx install .
Get getAPK on GitHub

What you need

  • Your computer: macOS, Linux or Windows, Python 3.9 or newer, and Android platform-tools (adb) on your PATH.
  • Your phone: Developer options turned on, with USB debugging. Connect it and accept the authorisation prompt. No root needed.

Only use getAPK on apps and devices you own or are authorised to analyse.

Quick start

Find the app's package name with getapk --list, then pull it. A single-APK app is saved as <package>-<version>.apk; a split app as <package>-<version>.apks, with every part inside.

$ getapk --list -m example
  1. com.example.app        2.4.1          com.android.vending

$ getapk com.example.app -o apps
[+] com.example.app 2.4.1 -> apps/com.example.app-2.4.1.apks  (4 splits, 41.7 MB)
    sha256 3f9c…a71e

Example output with a placeholder app.

Handy options

--list
List user-installed apps with versions and installer
--list -m bank
Only apps whose package name contains this text
com.example.app
Pull one app (or several: list more package names)
--all
Pull every user-installed app
--include-system
Include preinstalled apps with --list or --all
-s SERIAL
Pick a device when several are connected
-o DIR
Where to save the files (the current folder by default)
--format apks
Always write an APKS bundle (auto by default)
--adb PATH
Use a specific adb executable

How to use the result

What to do with the APK

  1. Scan it with AppSleuth. appsleuth scan com.example.app-2.4.1.apks reads the whole bundle and checks the manifest, network security configuration, exported components, secrets and hardening.
  2. Read the summary. appsleuth info shows signing, permissions, exported components, libraries and what the app is built with on one screen.
  3. Look for secrets. Keys and internal URLs shipped in an app can be read by anyone who has the APK. Our note on mobile apps storing secrets locally explains what to look for.
  4. Test the API behind it. The app is usually just the front end. Most serious findings are in the server it talks to.

Background

Why not just adb pull?

Most Play Store apps are installed as split APKs: base.apk, plus one file each for the CPU architecture, the language and the screen density. Pulling only base.apk gives you something that won't install and is missing native code and resources. getAPK pulls every part and bundles them, base first, into one APKS file that AppSleuth and bundletool-style tools understand.

Built to be safe on your computer

  • Nothing leaves your machine except the adb connection to your phone. No telemetry.
  • The phone is treated as untrusted. Package names, device serials and every path the device reports are checked before use, nothing goes through a shell on your computer, and output file names are cleaned so a hostile device can't write outside your output folder.
  • Every file is checked. Each pulled file must be a real APK (a zip with an AndroidManifest.xml), and files are moved into place only when complete.

Responsible use

getAPK is for apps and devices you own or are authorised to analyse. Apps may be copyrighted; extraction is for your own security analysis, not for sharing or redistributing apps.

FAQ

getAPK questions

Is getAPK free?

Yes. getAPK is free and open source under the MIT licence. Install it with pipx install getapk, or get the source from GitHub. It has no Python dependencies.

Does it need a rooted phone?

No. getAPK uses adb, so you only need USB debugging turned on in Developer options and to accept the authorisation prompt on the phone.

Why not just use adb pull?

Most Play Store apps are installed as split APKs: base.apk plus one file per CPU architecture, language and screen density. Pulling only base.apk gives you something that won't install and is missing native code and resources. getAPK pulls every part and bundles them into one APKS file.

What do I do with the APKS file?

Analyse it. AppSleuth reads APKS files directly (appsleuth scan com.example.app-1.2.3.apks), and bundletool-style tools understand the format too.

Does it send anything to Rudranetra?

No. getAPK runs on your own computer and has no telemetry. It talks only to your phone, through adb.

Which apps can I use it on?

Only apps and devices you own or are authorised to analyse. Apps may be copyrighted; extraction is for your own security analysis.

Related