逆向破解>> APKiD>> 返回
项目作者： rednaga

项目描述 ：
Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
高级语言： YARA
项目地址: git://github.com/rednaga/APKiD.git
创建时间： 2016-06-23T18:00:21Z
项目社区：https://github.com/rednaga/APKiD
开源协议：Other
下载


APKiD

Build Status
PyPI
PyPI - Python Version
PyPI - Format
PyPI - License

APKiD gives you information about how an APK was made. It identifies many compilers, packers, obfuscators, and other weird stuff. It’s PEiD for Android.

Screen Shot 2019-05-07 at 10 55 00 AM

For more information on what this tool can be used for, check out:

Installing

  1. pip install apkid

Docker

You can also run APKiD with Docker! Of course, this requires that you have git and Docker installed.

Here’s how to use Docker:

  1. git clone https://github.com/rednaga/APKiD
  2. cd APKiD/
  3. docker build . -t rednaga:apkid
  4. docker/apkid.sh ~/reverse/targets/android/example/example.apk
  5. [+] APKiD 2.1.0 :: from RedNaga :: rednaga.io
  6. [*] example.apk!classes.dex
  7.  |-> compiler : dx

Usage

  1. usage: apkid [-h] [-v] [-t TIMEOUT] [-r] [--scan-depth SCAN_DEPTH]
  2.              [--entry-max-scan-size ENTRY_MAX_SCAN_SIZE] [--typing {magic,filename,none}] [-j]
  3.              [-o DIR]
  4.              [FILE [FILE ...]]
  6. APKiD - Android Application Identifier v2.1.2
  8. positional arguments:
  9.   FILE                                       apk, dex, or directory
  11. optional arguments:
  12.   -h, --help                                 show this help message and exit
  13.   -v, --verbose                              log debug messages
  15. scanning:
  16.   -t TIMEOUT, --timeout TIMEOUT              Yara scan timeout (in seconds)
  17.   -r, --recursive                            recurse into subdirectories
  18.   --scan-depth SCAN_DEPTH                    how deep to go when scanning nested zips
  19.   --entry-max-scan-size ENTRY_MAX_SCAN_SIZE  max zip entry size to scan in bytes, 0 = no limit
  20.   --typing {magic,filename,none}             method to decide which files to scan
  22. output:
  23.   -j, --json                                 output scan results in JSON format
  24.   -o DIR, --output-dir DIR                   write individual results here (implies --json)

Submitting New Packers / Compilers / Obfuscators

If you come across an APK or DEX which APKiD does not recognize, please open a GitHub issue and tell us:

  • what you think it is — obfuscated, packed, etc.
  • the file hash (either MD5, SHA1, SHA256)

We are open to any type of concept you might have for “something interesting” to detect, so do not limit yourself solely to packers, compilers or obfuscators. If there is an interesting anti-disassembler, anti-vm, anti-* trick, please make an issue.

Pull requests are welcome. If you’re submitting a new rule, be sure to include a file hash of the APK / DEX so we can check the rule.

License

This tool is available under a dual license: a commercial one suitable for closed source projects and a GPL license that can be used in open source software.

Depending on your needs, you must choose one of them and follow its policies. A detail of the policies and agreements for each license type are available in the LICENSE.COMMERCIAL and LICENSE.GPL files.

Hacking

If you want to install the latest version in order to make changes, develop your own rules, and so on, simply clone this repository, compile the rules, and install the package in editable mode:

  1. git clone https://github.com/rednaga/APKiD
  2. cd APKiD
  3. python prep-release.py
  4. pip install -e .[dev,test]

If the above doesn’t work, due to permission errors dependent on your local machine and where Python has been installed, try specifying the --user flag. This is likely needed if you’re not using a virtual environment:

  1. pip install -e .[dev,test] --user

If you update any of the rules, be sure to run prep-release.py to recompile them.

If you are using Windows, install Yara 3.11.0 and yara-python-dex before compiling

  1. pip install yara-python==3.11.0
  2. pip install wheel
  3. pip wheel --wheel-dir=yara-python-dex git+https://github.com/MobSF/yara-python-dex.git
  4. pip install --no-index --find-links=yara-python-dex yara-python-dex

For Package Maintainers

When releasing a new version, make sure the version has been updated in apkid/init.py.

As for running tests, check out .travis.yml to see how the dev and test environments are setup and tests are run.

Update the compiled rules, the readme, build the package and upload to PyPI:

  1. ./prep-release.py readme
  2. rm -f dist/*
  3. python setup.py sdist bdist_wheel
  4. twine upload --repository-url https://upload.pypi.org/legacy/ dist/*

For more information see Packaging Projects.