Help in mobile application penetration testing

I really dont understand , i need to decode an apk then add execute the "Objection" tool that uses frida tools to implement an Gaget for tracking in the runtime , but the problem is , Where to download an apk ? I mean the app i want to download 99% of the time is in .xapk formate which is bad. Because i need it in a pure .apk format but i cant find any site that does that , also i cant do it in the .xapk even when decoding and execrating and implementing the gadget in the com.base.apk file , because frida ill directly sign the base apk with a signature , but the other ones ? Like the config_arm64x8.apk ? , so i really need help because i started learning mobile application penetration testing and there is an app that uses an internal server side api to verify the requests , so i need to intercept it , also , i cant use burp with the app because the app has security mechanism , when i tried to add the lib_frida.so into the /libs/something , then making it run automatiqly in the MainActivity smali file , it didnt work at all , even when i used logcat in adb to track the logs , the app opens up then crashes so fast , and nothing happens afterthat .

>>27043 What in the holy skid is this post

Bro just help instade of roasting me , i was a web app penetration tester and a bug hunter and i was able to chain exploits like from a info disclosure to a server side parameter polution , or chaining another to critical bugs like ssrf and owning five figures , but i never dealed with a mobile application and RE so i need help to figure out . Also i am not a skid

>>27043 hmm have you tried using gentoo ?

>>27043 im the op of the post in picrel add me on discord cause we are working on something similar and we can help eachother.

>>27049 discord: gorillagor

>>27047 Maybe you should use your five figures salary to buy courses on RE and mobile applications development instead of asking "Where to download an apk" on an imageboard :)

Nah bro the five figures it was a long time ago bro and i am not buying a Motherfucker expensive course for this like eMAPT or SANS556 i am not that rich i barely pay my bills

>>27052 Ok frère, I found something frère but you have to read a little bit frère, I hope it works frère. https://github.com/sensepost/objection/issues/347

>>27043 Hey man you should figure how to emulate it on a Linux machine and proxy all traffic of the app thru something like zap or burp , which is easier if you are using a white box approach, after using static code analyser and other initial analysis

Thank u so much it worked ! , i liked the idea of using an emulator , i used android studio with magsik to root it , then i added the frida gadget manually ,thanks for help , better than some ppl