40 lines
1.1 KiB
Markdown
40 lines
1.1 KiB
Markdown
# API Reference: Analyzing Android DEX Malware
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` treats an APK as a ZIP and inventories its DEX files, native libraries,
|
|
assets, and manifest presence, flagging multidex and likely encrypted payload assets. It does
|
|
not decompile or execute — use jadx/apktool for decompilation.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | zipfile, file IO |
|
|
|
|
## External tools
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| jadx | Decompile DEX bytecode to Java |
|
|
| apktool | Decode resources and binary AndroidManifest.xml |
|
|
| Android emulator | Dynamic analysis of dynamic/native payloads |
|
|
|
|
## Core functions
|
|
|
|
### `inspect(path)`
|
|
Returns the DEX list, native libraries, assets, manifest presence, multidex flag, and triage
|
|
notes.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py inspect sample.apk
|
|
```
|
|
|
|
## Sources
|
|
|
|
- Android DEX bytecode format — https://source.android.com/docs/core/runtime/dex-format
|
|
- APK packaging (ZIP container, AndroidManifest.xml) — Android documentation
|
|
- jadx DEX-to-Java decompiler — https://github.com/skylot/jadx
|