What standard Linux tools enable manual static analysis of an Android APK, and what do you look for?

Decompile with apktool, extract the DEX files, then grep the code for embedded tracker/ad URLs.

Workflow:

1. Set up tools — sudo apt install dexdump aapt apktool
2. Decompile — apktool d app.apk creates a decompiled directory tree
3. Extract DEX — unzip app.apk classes*.dex pulls out the Dalvik Executable files for class analysis
4. Find all URLs in the code:

   grep -RhoE "https?://[a-zA-Z0-9./?=_-]*" . | sed 's|https\?://||' | cut -d/ -f1 | sort -u
   

This surfaces every domain the app talks to — including ad and tracking endpoints — letting you spot embedded trackers by their network destinations.

Reminder: this is legal for Android APKs but not for DRM-protected iOS apps (reverse-engineering those violates the DMCA). Source: Yale Privacy Lab, "Tracking Mobile Trackers."