65 lines
2.1 KiB
Python
65 lines
2.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Inspect an APK (ZIP) and inventory its DEX, native libraries, and assets.
|
|
|
|
Lists the components relevant to triage — DEX files, native ``.so`` libraries, the manifest,
|
|
and notable assets — without decompiling or executing anything. Use jadx/apktool for the
|
|
actual decompilation step.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import sys
|
|
import zipfile
|
|
from pathlib import Path
|
|
|
|
|
|
def inspect(path: str) -> dict:
|
|
if not zipfile.is_zipfile(path):
|
|
return {"error": "not a ZIP/APK"}
|
|
dex, native, assets, other = [], [], [], []
|
|
with zipfile.ZipFile(path) as zf:
|
|
for name in zf.namelist():
|
|
if name.endswith(".dex"):
|
|
dex.append(name)
|
|
elif name.startswith("lib/") and name.endswith(".so"):
|
|
native.append(name)
|
|
elif name.startswith("assets/"):
|
|
assets.append(name)
|
|
elif name == "AndroidManifest.xml":
|
|
other.append(name)
|
|
return {
|
|
"dex": sorted(dex),
|
|
"native_libs": sorted(native),
|
|
"assets": sorted(assets),
|
|
"has_manifest": "AndroidManifest.xml" in other,
|
|
"multidex": len(dex) > 1,
|
|
"notes": _notes(dex, native, assets),
|
|
}
|
|
|
|
|
|
def _notes(dex, native, assets) -> list[str]:
|
|
notes = []
|
|
if len(dex) > 1:
|
|
notes.append("multidex: analyze all classesN.dex")
|
|
if native:
|
|
notes.append("native libraries present: analyze .so separately")
|
|
enc = [a for a in assets if a.endswith((".enc", ".dat", ".bin"))]
|
|
if enc:
|
|
notes.append(f"possible encrypted payload assets: {enc}")
|
|
return notes
|
|
|
|
|
|
def main(argv: list[str] | None = None) -> int:
|
|
parser = argparse.ArgumentParser(description="Inspect an APK")
|
|
sub = parser.add_subparsers(dest="cmd", required=True)
|
|
p = sub.add_parser("inspect")
|
|
p.add_argument("file")
|
|
args = parser.parse_args(argv)
|
|
print(json.dumps(inspect(args.file), indent=2))
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|