Hardcoded strings

You can find few hardcoded strings inside strings.xml located in resources/resources.arsc/res/values/strings.xml

Usually lookout for api keys, secrets, etc

Variables and strings

Sometimes you'll see after decomiling, the variable names in jadx would be like: private string example = 0x1234

If you wanna know what the variable hold/used in which file/function., you can use aapt2.

Example

let's say the app is built via chaquo (tldr -> can run python in apk).

The mainactivity isn't making sense to you,.

py.getModule("runpy").callAttr("run_module", getString(R.string.main_module), ...);

You might see this and wonder how should I get value/function name/main module name of R.string.main_module.

you can either find it in strings.xml file in values (resource.arsc) or with aapt2.

Strings.xml ->

<string name="main_module">braincalc</string>

aapt2 ->

# public static int main_module = 0x7f0f0048;
╰─$ aapt2 dump resources app-debug1.apk | grep '0x7f0f0048' -C 6
resource 0x7f0f0048 string/main_module
  () "BrainCalc"

Last updated