Cracking the Split-APK Code

My Name is Bineeg, and this time I want to discuss an Android application pentest hurdle I have faced.

If you’ve been doing Android pentesting for a while, you know the landscape has shifted. The days of the monolithic “Fat APK” are largely behind us. Since 2021, Google has mandated Android App Bundles (AAB) for new apps, meaning almost every modern engagement now involves Split APKs.

While this technology is no longer “new,” it remains a major hurdle for researchers. If you try to patch these using old-school single-APK logic, you’ll likely find yourself buried in signature mismatch errors and resource crashes. After plenty of trial and error — and a lot of time spent in the “debugging state” — I finally landed on an approach that worked for me.

Strategy 1: The “Base-Only” Method

The biggest mistake people make is trying to decompile and rebuild the entire set of splits. It’s a mess and almost always leads to resource-linking errors.

Get bineeg’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Instead, use the Base-Only Rule. Think of the base.apk as the "brain" (logic and instructions) and the split APKs (like config.en or config.arm64) as the "limbs." Unless you need to change a specific image or string tucked inside a split, only decompile the brain. This avoids 90% of the common apktool build errors.

Step 1: Extraction

Pull every APK associated with the package at once using this one-liner:

adb shell pm path com.your.packagename | sed 's/^package://g' | xargs -L1 adb pull

Step 2: Selective Decompile & Patch

Decompile just the base:

apktool d base.apk -o decoded_base

Open decoded_base, head into the smali files, and apply your patches (e.g., flipping an emulator check).

Step 3: Rebuilding

Turn your patched folder back into an APK:

apktool b decoded_base -o patched_base.apk

Step 4: Unified Signing

Android requires every APK in a split set to be signed with the exact same certificate.
1. Move patched_base.apk into a folder with the original, untouched splits. 2. Use uber-apk-signer to unify them:

java -jar uber-apk-signer.jar --apks <path to apks> --allowResign

The --allowResign flag is key: It strips the developer’s original signature from the untouched splits and replaces it with yours. Now they are all "one family" again.

Step 5: Clean Installation

adb uninstall com.your.packagename
adb install-multiple $(ls | grep -e "aligned-deb.*apk$" | xargs)

Useful References & Alternatives

If the methods above don’t fit your specific case, these community resources and tools are excellent alternatives that might do the trick:

• AntiSplit-M : Lightweight utility for managing multi-part archives. It automates the handling of split files, supports packing and reassembly, and includes basic integrity checks to ensure parts reconstruct correctly.
• SplitPacker (GitHub): This tool from TheArmKing is designed to automate the merging and packing of split files. It didn’t work in my environment during this test, but it may work for you — worth a try.
• Massive Mobile Security Framework: Explore this writeup & framework to see how it can automate your entire decompilation and patching pipeline.
• SAP (Split APKs Packer): The go-to for Windows & Linux users who want to merge splits into a single, manageable APK.

Next time you’re facing a Split-APK app, don’t overthink it. Patch the brain, re-sign the limbs, and you’re good to go.

There are always good methodologies and tools and if you find any, please share it in the comments.