APKiD

Why we included this project

Anyone who triages Android APKs for a living knows the problem this solves: you get handed an APK and want to know, before sinking hours into it, what you are actually dealing with. APKiD answers with a static scan of the DEX classes and other packaged files, using YARA rules to fingerprint the compiler, packer, obfuscator, or mobile RASP SDK behind the build. That is a fast way to tell a straightforwardly compiled app from one that has been hardened, repackaged, or otherwise altered, and it runs from the command line or Docker against a single file, one DEX, or a whole directory. It is quick enough to serve as a first-pass check in an automated pipeline, which is where it earns its keep.