So far we've seen how you can use APK tool to obtain smali code. 1
Also how to use a tool like byte code viewer or directly use a Java Decompiler to be able to obtain 2
the almost Java code. 3
The thing is that as an analyst at least initially you are usually looking for the same things like 4
OK what permission does this application have. 5
What are the services that are listed in the application to answer these questions. 6
You could either do what we showed in the previous part or you could develop your own scripts on top 7
of the outputs of tools like Apktool. Androguard is a popular example of a tool that uses scripts 8
against these outputs to produce its results. 9
So we showed how to install Androguard earlier. To use Androguard just type Androguard, see the 10
options here. 11
OK. 12
So when you run Androguard analyze flipcortex.apk. 13
We are now in a situation where Androguard was run against flipcortex.APK and we can run a bunch 14
of commands on this APK. So to run commands on the APK you do a dot so say for example you want to 15
get the requested permissions. 16
This will show what permission this APK is using. 17
There are other things that could be of interest. 18
So for example you want to see what are the services of apk. a dot get underscore services. 19
Same thing for receivers a dot get underscore receivers and so on more than the actual tool. 20
Here we are saying that as an analyst once you get used to your process it would make sense to develop 21
scripts on top of outputs to automate the process Androguard is nothing more than a collection of 22
python scripts. 23
On top of the APK outputs so for example if you want scripts to find all the permissions being used 24
you run apktool against it. 25
Do some string analysis on the XML and find all the permissions inside, which is essentially what Androguard 26
is doing over here.