Package: ak-apkid
APKiDAPKiD gives you information about how an APK was made. It identifies
many compilers, packers, obfuscators, and other weird stuff. It’sPEiDfor Android.Screen Shot 2019-05-07 at 10 55 00 AMFor more information on what this tool can be used for, check out:Android Compiler
FingerprintingDetecting Pirated and Malicious Android Apps with
APKiDAPKiD: PEiD for Android
AppsInstallingInstallation is unfortunately a bit involved until apull
requestis merged in a
dependency. Here’s how you do it:gitclone--recursive-b"v3.10.0"https://github.com/VirusTotal/yara-python.git/tmp/yara-pythoncd/tmp/yara-python/yaracurlhttps://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/1073.patch|gitamcd..pythonsetup.pybuild--enable-dexpythonsetup.pyinstallWithout this patch to Yara, the dexlib1 detection rule will fail as will
any rule relying on string sizes.If this patch wasn’t needed, here’s how you’d install. First, installyara-pythonwith--enable-dexto compile Yara’s DEX module:# Don't use this method, for now.
#pip install --upgrade wheel
#pip wheel --wheel-dir=/tmp/yara-python --build-option="build" --build-option="--enable-dex" git+https://github.com/VirusTotal/yara-python.git@v3.10.0
#pip install --no-index --find-links=/tmp/yara-python yara-pythonFinally, install APKiD:pipinstallapkidDockerYou can also run APKiD withDocker! Of course, this
requires that you have git and Docker installed.Here’s how to use Docker:gitclonehttps://github.com/rednaga/APKiDcdAPKiD/dockerbuild.-trednaga:apkiddocker/apkid.sh~/reverse/targets/android/example/example.apk[+]APKiD2.1.0::fromRedNaga::rednaga.io[*]example.apk!classes.dex|->compiler:dxUsageusage: apkid [-h] [-v] [-t TIMEOUT] [-r] [--scan-depth SCAN_DEPTH]
             [--entry-max-scan-size ENTRY_MAX_SCAN_SIZE] [--typing {magic,filename,none}] [-j]
             [-o DIR]
             [FILE [FILE ...]]

APKiD - Android Application Identifier v2.1.0

positional arguments:
  FILE                                       apk, dex, or directory

optional arguments:
  -h, --help                                 show this help message and exit
  -v, --verbose                              log debug messages

scanning:
  -t TIMEOUT, --timeout TIMEOUT              Yara scan timeout (in seconds)
  -r, --recursive                            recurse into subdirectories
  --scan-depth SCAN_DEPTH                    how deep to go when scanning nested zips
  --entry-max-scan-size ENTRY_MAX_SCAN_SIZE  max zip entry size to scan in bytes, 0 = no limit
  --typing {magic,filename,none}             method to decide which files to scan

output:
  -j, --json                                 output scan results in JSON format
  -o DIR, --output-dir DIR                   write individual results here (implies --json)Submitting New Packers / Compilers / ObfuscatorsIf you come across an APK or DEX which APKiD does not recognize, please
open a GitHub issue and tell us:what you think it is – obfuscated, packed, etc.the file hash (either MD5, SHA1, SHA256)We are open to any type of concept you might have for “something
interesting” to detect, so do not limit yourself solely to packers,
compilers or obfuscators. If there is an interesting anti-disassembler,
anti-vm, anti-* trick, please make an issue.Pull requests are welcome. If you’re submitting a new rule, be sure to
include a file hash of the APK / DEX so we can check the rule.LicenseThis tool is available under a dual license: a commercial one suitable
for closed source projects and a GPL license that can be used in open
source software.Depending on your needs, you must choose one of them and follow its
policies. A detail of the policies and agreements for each license type
are available in theLICENSE.COMMERCIALandLICENSE.GPLfiles.HackingIf you want to install the latest version in order to make changes,
develop your own rules, and so on, simply clone this repository, compile
the rules, and install the package in editable mode:gitclonehttps://github.com/rednaga/APKiDcdAPKiD./prep-release.pypipinstall-e.[dev,test]If the above doesn’t work, due to permission errors dependent on your
local machine and where Python has been installed, try specifying the--userflag. This is likely needed if you’re not using a virtual
environment:pipinstall-e.[dev,test]--userIf you update any of the rules, be sure to runprep-release.pyto
recompile them.For MaintainersThis section is for package maintainers.To update the PyPI package:./prep-release.pyreadmerm-fdist/*pythonsetup.pysdistbdist_wheeltwineupload--repository-urlhttps://upload.pypi.org/legacy/dist/*Update the generatedREADME.rstuntil Pandoc learns how to translate
Markdown with images that are links into reStructuredText:..image::https://travis-ci.org/rednaga/APKiD.svg?branch=master:target:https://travis-ci.org/rednaga/APKiD..image::https://img.shields.io/pypi/v/apkid.svg:target:https://pypi.python.org/pypi/apkid..image::https://img.shields.io/pypi/pyversions/apkid.svg:target:https://pypi.python.org/pypi/apkid..image::https://img.shields.io/pypi/format/apkid.svg:target:https://pypi.python.org/pypi/apkid..image::https://img.shields.io/pypi/l/apkid.svg:target:https://pypi.python.org/pypi/apkidFor more information seePackaging
Projects.