APK: Was ist das, Dateistruktur und Funktionsprinzip

Was ist APK und wofür wird es verwendet

APK (Android Package Kit) is an archive format used to package Android applications for distribution. Technically, APK is a ZIP archive with a specific structure containing all the components necessary for the application to run on a device.

Geschichte des Formats

The APK format appeared with the first version of Android in 2008. It was based on the JAR (Java Archive) standard, which in turn is based on ZIP. This inheritance ensured compatibility with existing archive tools — any archiver can open APK as a regular ZIP.

Anwendungsbereiche

Google Play is the primary channel for distributing APK, but the format is also used in other scenarios: direct installation via browser (sideloading), enterprise app stores, testing on developer devices, and installation in emulators. According to Statista, about 15% of Android app installations in 2025 occur outside Google Play.

APK-Dateistruktur von innen

The internal structure of APK is strictly regulated: every application must contain specific files and directories. Violating the structure leads to installation errors.

AndroidManifest.xml

The manifest is the central configuration file of the application. In binary compiled form (not readable XML), it contains the package name, version, list of activities, services, permissions, and SDK requirements. Without a manifest, the system does not know how to launch the application.

DEX files

Source code in Java or Kotlin is compiled into DEX (Dalvik Executable) files. The main file is called classes.dex. If the bytecode exceeds the 64K method limit, classes2.dex, classes3.dex, and so on are created — the multidex mechanism.

Native libraries

The lib/ directory contains compiled C/C++ libraries for different architectures: armeabi-v7a, arm64-v8a, x86, x86_64. Each library has the .so (Shared Object) extension. Modern applications typically ship only arm64-v8a.

APK-Build-Prozess mit Gradle

Building an APK is a multi-stage process automated by the Gradle build system and Android Gradle Plugin. Each stage transforms source files into components of the final archive.

Build-Phasen

Source code is compiled into Java bytecode (.class), then converted to DEX using the d8 tool (previously dx). Resources are compiled into binary format via AAPT2. All components are packed into a ZIP archive and signed with a digital signature.

// build.gradle.kts — grundlegende APK-Build-Konfiguration
android {
    defaultConfig {
        applicationId = "com.example.app"
        minSdk = 24
        targetSdk = 34
        versionCode = 1
        versionName = "1.0.0"
    }
    buildTypes {
        release {
            isMinifyEnabled = true
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt")
            )
        }
    }
}

ProGuard und Größenreduzierung

ProGuard or R8 obfuscates code, removes unused classes and methods, reducing APK size. Without obfuscation, APK contains full class names, which simplifies decompilation. R8 also performs bytecode optimization at the DEX level.

APK-Signierung: Schemata v1, v2, v3 und v4

A digital signature is a mandatory element of APK. Android does not install unsigned packages. The signature guarantees that the application has not been modified after publication and determines who owns the package.

Entwicklung der Signierschemata

v1 (JAR signing) is the original scheme based on signing each file in the archive. Vulnerability: files can be removed from META-INF without detection. v2 (APK Signature Scheme v2) appeared in Android 7.0 — the entire archive is signed as a whole, preventing modification. v3 supports key rotation, and v4 supports incremental installation.

Google Play requires v2 or higher for all new applications since August 2021. It is recommended to sign APK with all three schemes for maximum compatibility with different Android versions.

Signierprozess mit Gradle

In build.gradle, the keystore, password, and alias are specified. The private key is stored in an encrypted store. For publishing to Google Play, App Signing is used — Google stores the private key, and the developer uploads a signed APK.

Installieren von APK auf einem Android-Gerät

Installation of APK is performed through the system package manager PackageManager. The process includes signature verification, manifest parsing, file copying, and DEX optimization via dex2oat.

Installation via ADB

The ADB (Android Debug Bridge) tool allows installing APK directly from a developer’s computer. The command `adb install app.apk` copies the file to the device and starts installation. The -r flag reinstalls the application while preserving data, and the -d flag allows installing a version with a lower versionCode.

Installationssicherheit

Starting from Android 8.0, the system requires confirmation for installation from unknown sources for each application separately. Android 14 tightened control: installing APK through third-party stores is only possible after explicit permission in settings. Google Play Protect scans every APK during installation for malicious code.

APK-Erweiterungsdateien (OBB)

For applications larger than 150 MB, Google Play supports Expansion Files — additional OBB packages of up to 2 GB each. OBB files are not included in the APK but are downloaded separately after installation. The format supports two types: main (base resources) and patch (updates).

// APK-Version über PackageManager prüfen
val pm = packageManager
val info = pm.getPackageInfo(
    "com.example.app",
    PackageManager.GET_ACTIVITIES
)
Log.d("APK", "Version: ${info.versionName}")

dex2oat-Optimierung

On devices with ART (Android Runtime), after installation, DEX compilation into native code is launched via dex2oat. The process can take several seconds and increases the size of the installed application, but speeds up its launch.

APK vs AAB: Welches Format wählen

AAB (Android App Bundle) is a format that Google promotes as an alternative to APK for publishing on Google Play. The difference is fundamental: AAB is not installed directly but serves as a container from which Google Play generates optimized APKs.

Google Play has required AAB since August 2021 for new applications. However, APK remains the main format for distribution outside Google Play — through websites, enterprise stores, and testing.

Häufige APK-Probleme und ihre Lösungen

Developers regularly encounter issues when building and installing APK. Most of them are related to version incompatibility, signing, or archive structure.

INSTALL_FAILED_UPDATE_INCOMPATIBLE

This error occurs when trying to install an APK with the same package name but a different signature. Android does not allow reinstalling an application with a changed certificate. The solution is to uninstall the old version before installation.

Method limit exceeded (65K)

If the project exceeds the 65536 method limit, the build fails with a dex error. The solution is to enable multidex in build.gradle or optimize dependencies by removing unused libraries.

APK too large

Google Play limits APK size to 150 MB. For larger applications, APK-Erweiterungsdateien (OBB) are used. It is recommended to reduce size through R8, WebP images, and Android App Bundle. Each extra megabyte negatively affects installation conversion: according to Google, every 10 MB reduces conversion by 1%.

APK decompilation and security

APK can be decompiled using tools like JADX, APKTool, or Bytecode Viewer. JADX restores original Java code from DEX, making applications without obfuscation fully readable. For code protection, ProGuard/R8 is used, which renames classes, methods, and fields into short unreadable names, and also removes debug information.

APK analysis tools

To analyze APK contents, Android Studio Profiler, apkanalyzer (CLI tool from Android SDK), and third-party utilities are used. apkanalyzer shows the size of each APK component: DEX, resources, native libraries, and signature. Analysis helps identify which dependencies take up the most space and make decisions about replacing or removing them.