APK Files

What is a .APK file?

.APK files commonly consist of Android Packages or installable application packages used in Android devices which include phones, tablets, televisions, watches, emulators, and app stores. Developed by Google in collaboration with the Open Handset Alliance, the Android Package format was first commercialized together with Android since 2008. The Android APK contains the MIME type application/vnd.android.package-archive and the code of the software compiled as well as resources and libraries required by Android's installer/runtime. It is common for users to see APKs when sideloading applications, running applications under the test in the Android Studio as well as in CI, installation on BlueStacks and Android Emulator images, storing installed apps and looking inside malicious samples. Common names for APK files are app-release.apk, base.apk, and split_config.arm64_v8a.apk.

Apart from the previously described APK, another APK format exists, known as the Alpine Linux Package - used in Alpine Linux and apk package management. In most cases, both formats differ because of different magic (starting bytes), thus in the majority of times, one can find that Android APK consists of starting bytes 50 4B 03 04 that are used in zip archives; on the contrary, Alpine uses gzip starting bytes of files which start with 1F 8B bytes. Usually the name of Alpine file consists of the name, version number, a release and architecture. Related Android distribution formats have different suffixes such as .aab (Android app bundles), .apks (sets), .apkm and .xapk.

How to open a .APK file

Technical details

Signature scheme of APK consists from legacy JAR signing v1 scheme data in META-INF folder (namely MANIFEST.MF, CERT.SF and/or CERT.RSA/CERT.DSA). Modern APKs additionally have v2, v3, v3.1 or even v4 of APK Signature Scheme. Compared to v1 that does the signature of separate JAR-entries, v2/v3 and following cover entire ZIP file with better security. Android build tools place signatures of schemes 2 and above before ZIP-central-directory section.

APK files are compressed individually for every file. DEX files, XML data and other content could be Deflate-compressed, but for media files, or native libraries, files are left in uncompressed format. Special program called zipalign checks and corrects the layout of APK files by ensuring that start-of-section for uncompressed resources are aligned on 4-byte boundaries which makes possible efficient memory-mapping on Android platform. No APK format version number exist - contemporary APK combines ZIP format with Android metadata and signature schemes. APK size can reach values of megabytes or even hundreds of MB; Google Play often distributes applications built from .aab into APK-splitted form of APK or even APK-splitted versions of the APK generated by the same. The registered MIME type for APK is application/vnd.android.package-archive although some applications will show APK-files as application/zip.

On another hand, APK-file of Alpine Linux distributions is not related to Android APK. It is just gzip-compressed tar archives starting with 1F 8B magic-bytes at byte 0.

How to convert .APK files

For APKs built in Android, renaming app.apk to app.zip or running 7-Zip to execute "7z x app.apk -oapp_apk" simply discloses the zip structure of the file. No decoding happens for compiled resources resources.arsc or classes.dex. In case of needing source code, jadx can convert classes.dex with jadx -d app_java app.apk, yet, the operation produces source code decompilation without the associated comments and other information like original names for local variables, etc.

Speaking about patches, normally apktool d app.apk -o app_decoded is more useful as this allows decoding resources and producing smali files needed for rebuilding. After necessary changes in them, one must perform rebuilding by running apktool b app_decoded -o rebuilt-unsigned.apk; afterwards Android SDK requires use of the Build Tools and running the commands: zipalign -p -f 4 rebuilt-unsigned.apk aligned.apk and then apksigner sign --ks keystore.jks --out signed.apk aligned.apk. Android refuses installing any APKs which are unsigned, misaligned and contain inconsistent signatures.

Unfortunately there is no reliable one-step APK to AAB transformation of the completed third-party apps. bundletool works from the original Gradle project. While icon images are usually extracted using ZIP archive methods, asset density-related files should be processed by resource decoding process instead. Alpine .apk is unique in terms: tar -xzf package.apk can decompress its gzip-compressed tar format, yet plain files lose the trusted status by package manager until repackaging and re-signing.

Common problems and fixes

The "App not installed" error message of Android is a general message regarding installer's failure. The main reasons for this include having the certificate of installed app different from the one with which the APK has been made, versionCode lesser than one of installed build, targetSdkVersion/OS compatibility issue on phone, etc. Using adb install, we can have more specific details regarding error code of installer, check the packages' and versionCodes' compatibility and if possible, uninstall the old package.

The message "There was a problem parsing the package" normally suggests that there is corruption in file transfer through download process, through USB transfer or browser downloading process, APK is built using later Android version, or this file is simply not of Android app type APK file at all! One may redownload it, validate its correct length and that APK begins with ZIP "magic byte sequence" 50 4B 03 04 and doesn't begin with some other sequence!

Message "INSTALL_FAILED_NO_MATCHING_ABIS": This happens because of lack of native libraries in APK for given CPU ABI in our case - we can try using APK for proper ABI or use appropriate emulator system image in this situation.

The reason for INSTALL_FAILED_UPDATE_INCOMPATIBLE message is use of different keys for APK and already installed app - uninstalling of old app removes this problem, but will also remove your previously installed app (including its data), unless one backs it up.

For split APK apps, we must also install corresponding splits; installing split APK by itself fails (in this case install all split APK including base.apk in the command line or use regular store/bundle installer).

If archive utility displays an APK but cannot extract the contents due to a truncated central directory, simply redownload that file checking the length or even SHA-256 of the file.

.apk files created for the Alpine Linux system are just standard gzipped tars and have 'magic bytes' 1F 8B; thus android APK tools do not recognize such file and fail on attempt to parse and install an apk file. In the same manner, apk-tools installed on Alpine do not recognize Android APK file format. Main install problems here are missing/uninstalled package dependencies, unknown or untrusted package key signatures or different keys from the repository; updating keys and/or repositories fixes it usually.

Security considerations

An Android APK consists of executable application packages. An APK may make Android permission requests, import native code from lib/<abi>/, launch background processes, use networking, and more. Get APKs solely from trustworthy locations, as sideloaded packages will be excluded from some of the app-store reviews, as they could pretend to act like legitimate software, imitating their iconography or labels and even package name. In case it matters, apksigner verify --print-certs followed by comparing certificate's fingerprints can be utilized to see if this particular app is a trusted release.

APK information may provide you the package name, version, list of requested permissions, min SDK version, signature certificate, analytic SDK usage, ABIs in use, or developer contact point. Scanning APK file may disclose proprietary pieces of software, API keys, URLs used, and more; utilize private analysis software for sensitive applications. Run decompilers and emulators for potentially unsafe APKs only in a separate virtual machine.

Alpine .apk may come equipped with scripts written by the software packager, which will execute during installation or update process of your software. Both Android APK format and Alpine apk lack the Office style macro support but both are capable of delivering code and can abuse the parsing routines of the installer and other library software.

History and versions

Android 1.0 has been commercially released in the year 2008, using APK as the installable application package used in Google and Open Handset Alliance mobile devices following Zip/JAR and DEX byte code conventions. Though there have been modifications on .dex byte codes format, resource compilation using aapt/aapt2 utility and ART runtime, the same installation archive (APK) kept its ZIP magic number 50 4B 03 04 through different Android versions.

There have only been changes and updates on signing mechanisms of the format through APK Signature Scheme V2 in Android 7.0 (2016) to protect all the APK files outside JAR signing in META-INF directory of the files. APK signature schemes V3 was introduced to Android 9 (2018) to enable rotation of keys. Also introduced in Android 11 was V4 Signature Schemes in incremental install for Android applications to reside in an additional signature file than APK file format.

Although Android 1.0 is documented on Android platform documents rather than ISO open format documents, there is the use and documentation APK installation on other open projects that use their APK files format in Android App Bundle format released for deployment in Google Play since 2018. Also, though Google uses APK for their Android installation formats, there is Alpine Linux APK Tools and their APK files from the mid-2000s.

Related formats

The definition of AAB describes an Android App Bundle file format used by Google Play to create device-specific APKs. Nonetheless, most Android devices cannot install .AAB directly. The term APKS describes the APK set that has been created using the bundletool, whereby the APK set involves one or more selected split APKs targeted at a certain device. The XAPK and APKM formats are not native archive formats. Instead, these involve a third-party APK archive combined with split APKs and expansion packs for an APK. Such formats are needed by corresponding installation programs since these are not part of native packages used on Android installations. The .dex files involve Android executable codes or compiled bytecode used in decompilation processes. However, .dex on its own would lack resource, packaging, and installation metadata. .jar was used in APK signature but is not part of Android installation process. The .ipa stands for Apple's iOS package that cannot run on Android. In relation to APK Alpine files, .apk is the Alpine package format while deb or RPM involves Debian or Red Hat-based Linux.