Android Application Analysis - Androguard
Androguard is mainly a tool written in python to play with :
ºDex/Odex (Dalvik virtual machine) (.dex) (disassemble, decompilation),
ºAPK (Android application) (.apk),
ºAndroid’s binary xml (.xml),
ºAndroid Resources (.arsc).
Android Application Analysis
Features:
ºMap and manipulate DEX/ODEX/APK/AXML/ARSC format into full Python objects,
ºDiassemble/Decompilation/Modification of DEX/ODEX/APK format,
ºDecompilation with the first native (directly from dalvik bytecodes to java source codes) dalvik decompiler (DAD),
ºAccess to the static analysis of the code (basic blocks, instructions, permissions (with database from http://www.android-permissions.org/) …) and create your own static analysis tool,
ºAnalysis a bunch of android apps,
ºAnalysis with ipython/Sublime Text Editor,
ºDiffing of android applications,
ºMeasure the efficiency of obfuscators (proguard, …),
ºDetermine if your application has been pirated (plagiarism/similarities/rip-off indicator),
ºCheck if an android application is present in a database (malwares, goodwares ?),
ºOpen source database of android malware (this opensource database is done on my free time, of course my free time is limited, so if you want to help, you are welcome !),
ºDetection of ad/open source librairies (WIP),
ºRisk indicator of malicious application,
ºReverse engineering of applications (goodwares, malwares),
ºTransform Android’s binary xml (like AndroidManifest.xml) into classic xml,
ºVisualize your application with gephi (gexf format), or with cytoscape (xgmml format), or ºPNG/DOT output,
ºIntegration with external decompilers (JAD+dex2jar/DED/…)
