# Xenolith APK Editor

> Edit an APK in the browser, or with the native command `xenolith-apk-editor` on Linux,
> Windows and macOS. The tool does not need a Java runtime. A file opened in
> the browser stays on that computer.

This file is the map for an agent. The pages below are the same document in
three languages. `/app` is the editor application, not a document: do not
cite it as a page, and do not expect it to be indexed.

Public contacts:
- Technology and development: Roman Katuntsev <sbkarr@xenolith.studio>
- Product, partnerships, research: Anastasia Mukanina <anastasiia.m@xenolith.studio>
License: MIT.
Engine: https://engine.xenolith.studio/

## Pages

- English: https://apkeditor.xenolith.studio/
- Russian: https://apkeditor.xenolith.studio/ru/
- Chinese: https://apkeditor.xenolith.studio/zh/
- Command reference: https://apkeditor.xenolith.studio/cli/
- Command reference, Russian: https://apkeditor.xenolith.studio/ru/cli/
- Command reference, Chinese: https://apkeditor.xenolith.studio/zh/cli/

## Two ways to run it

The browser editor and the command-line tool are one C++ program.

- Browser: https://apkeditor.xenolith.studio/app — WebAssembly in the page.
  The APK is not uploaded. The project is stored in this browser (OPFS, with
  IndexedDB as the fallback). The signing key is in IndexedDB. There is no
  account.
- Command line: `xenolith-apk-editor` on Linux, Windows and macOS. It does not install a
  JRE. The builds kept green are macOS on Apple silicon
  (`aarch64-apple-macosx`), Linux x86_64 (`x86_64-unknown-linux-gnu`) and
  Windows x86_64 (`x86_64-pc-windows-msvc`). Do not claim ARM Linux, ARM
  Windows, or a universal binary.

A command-line installer is not published on this website yet. Do not invent
a download URL.

## Commands

These are the real flags. `xenolith-apk-editor b` without `--base` fails: the build
rebuilds from the original APK.

```
xenolith-apk-editor d app.apk -o app
xenolith-apk-editor b app --base app.apk -o unsigned.apk
xenolith-apk-editor sign unsigned.apk -o signed.apk --key key.pem --cert cert.pem
xenolith-apk-editor keygen --key key.pem --cert cert.pem
```

Signing is ECDSA P-256, APK Signature Scheme v2 and v3.

The product name on every page is "APK Editor", including the Russian and
Chinese pages. Do not translate it.

The browser is the wide editor. The command line is the short path. Do not
describe them as the same set of screens.

## What the browser editor does

These are the screens in the editor. Say them in product language. Do not
turn them into a limitation list on the page.

- Projects: drop an APK, come back to it later. Edits survive a closed tab.
- Files: the decoded tree. Text edits (including smali and `res/values`
  XML), a byte editor for everything else, image preview.
- Search: find across the project and replace in files the build will keep.
- Resources: the table, grouped the way the app groups it. Replace images
  (PNG or WebP out).
- Titles: the application name, per locale. A non-translatable string stays
  locked.
- Manifest form: package name, label, versionName, versionCode, debuggable,
  and the launcher icon (resampled per density).
- Permissions: add or remove from the Android framework catalog.
- Code: smali is the source you edit. Java on screen is a read-only
  decompiled view. Both appear only after a decode that asked for them.
- Signer: v1/v2/v3 presence and certificate facts. Generate a key or import
  one, sign, download.

## What the command line does

`xenolith-apk-editor` unpacks, rebuilds and signs. It also lists resources, shows
signatures, replaces one image entry, patches the manifest, installs a
framework table and optimizes. It does not open the project, search, titles,
permissions or file screens. Those are the browser.

## Do not claim these

- A command-line installer, a package repository, or a GitHub download on
  this site. None of those URLs exist here.
- Installing an APK onto a phone, or driving adb, from this site.
- Deleting a resource entry. The build refuses it.
- Replacing a nine-patch `.9.png`. The build refuses it.
- JPEG encode. The editor does not offer it. The WebAssembly build falls
  back to PNG.
- "Any APK works in Safari." Safari uses the smaller wasm32 build, and a
  large APK can run out of memory. Chrome uses wasm64.
- A Java editor. Java is a view. The source you edit is smali.
- The Android NDK, or the playground Android toolchain, shipping on this host.

## Browsers

Chrome runs the full editor (wasm64) and can open a large APK. Safari and
other engines that reject that module fall back to wasm32. Say that when
someone asks about a phone browser or Safari.