APK File Structure - Inside Android Application Packages

Understanding APK file structure is essential for Android developers, security researchers, and advanced users. This guide breaks down every component inside an APK package.

What is an APK File?

An APK (Android Package Kit) is essentially a ZIP archive with a specific structure. You can extract APK contents using any ZIP tool like 7-Zip or WinRAR to examine the internal structure.

Main APK Components

1. AndroidManifest.xml

The most important file in any APK. It defines:

• App package name (unique identifier)
• App version code and version name
• Minimum and target Android SDK versions
• Required permissions (camera, location, storage, etc.)
• App components (activities, services, broadcast receivers)
• Hardware and software feature requirements
• Application theme and icon

Note: The manifest is in binary XML format inside the APK. Use tools like apktool or Android Studio to view it in readable format.

2. classes.dex

Contains the compiled application code in Dalvik Executable format:

• All Java/Kotlin code compiled to DEX bytecode
• Optimized for Android runtime (ART/Dalvik)
• Multiple DEX files possible (classes2.dex, classes3.dex) for large apps
• Contains app logic, algorithms, and business rules

3. resources.arsc

Resource table containing:

• Compiled resource metadata
• String resources and translations
• Resource IDs and mappings
• Configuration-specific resources

Folder Structure

/res/ (Resources)

Contains all app resources organized by type:

res/drawable/

• App images, icons, graphics
• Multiple density folders: drawable-mdpi, drawable-hdpi, drawable-xhdpi, drawable-xxhdpi, drawable-xxxhdpi
• Vector drawables (XML-based scalable graphics)
• 9-patch images (.9.png) for scalable UI elements

res/layout/

• UI layout definitions in XML
• Different layouts for screen sizes and orientations
• layout-land/ for landscape orientation
• layout-sw600dp/ for tablets

res/values/

• strings.xml - All app text strings
• colors.xml - Color definitions
• styles.xml - UI themes and styles
• dimens.xml - Dimension values (margins, padding)
• arrays.xml - String and integer arrays

res/mipmap/

• App launcher icons at different densities
• Separate from drawable resources
• Optimized for launcher display

res/raw/

• Raw resource files
• Audio, video, data files
• Not processed or compressed

/assets/

Uncompressed asset files:

• Game assets (textures, models, levels)
• Fonts and typefaces
• Configuration files
• Web content (HTML, CSS, JavaScript)
• Database files
• Accessed programmatically via AssetManager

/lib/

Native libraries (compiled C/C++ code):

• Organized by CPU architecture
• lib/armeabi-v7a/ - 32-bit ARM devices
• lib/arm64-v8a/ - 64-bit ARM devices (modern phones)
• lib/x86/ - 32-bit x86 (emulators, some tablets)
• lib/x86_64/ - 64-bit x86
• .so files (Shared Objects) - equivalent to Windows DLL files

/META-INF/

Package metadata and signatures:

• MANIFEST.MF - List of all files with SHA digests
• CERT.SF - Signature of MANIFEST.MF
• CERT.RSA/DSA/EC - Public key certificate and signature
• Used to verify APK hasn't been tampered with
• Critical for Android's security model

Additional Common Files

kotlin/

Kotlin-specific metadata (if app uses Kotlin)

okhttp3/, retrofit2/

Third-party library resources

firebase/

Firebase configuration files

proguard/

Code obfuscation mappings (in debug builds)

Viewing APK Structure

Method 1: Extract with Archive Tool

1. Rename .apk to .zip
2. Extract with 7-Zip, WinRAR, or any ZIP tool
3. Browse folders and files
4. Note: AndroidManifest.xml will be in binary format

Method 2: Android Studio

1. Open Android Studio
2. File → Profile or Debug APK
3. Select APK file
4. View decompiled code and resources

Method 3: apktool

1. Download apktool
2. Run: apktool d app.apk
3. Extracts and decompiles all resources
4. AndroidManifest.xml in readable format

APK Size Breakdown

Typical size distribution in a standard app:

• DEX code: 20-30% (classes.dex)
• Resources: 30-40% (images, layouts)
• Native libraries: 20-30% (lib/ folder)
• Assets: 10-20% (game data, fonts)
• Other: <5% (manifest, signatures)

Security Implications

What Can Be Extracted

• All images and resources (easily accessible)
• App structure and logic (can be reverse engineered)
• String resources (including API keys if hardcoded - security risk)
• Native libraries (harder to reverse than DEX)

What's Protected

• Code can be obfuscated with ProGuard/R8
• String encryption can protect sensitive data
• Native code provides some protection
• App signing prevents tampering

Optimizing APK Structure

Reduce APK Size

• Enable code shrinking (ProGuard/R8)
• Remove unused resources
• Compress images (WebP format)
• Use vector drawables instead of PNGs
• Enable resource shrinking
• Use Android App Bundle (AAB) for Play Store