APK analyzer for Linux

Question

This might look pretty close to this question, but my requirements are a little different. Given an .apk file (Android app e.g. downloaded from a third party source like F-Droid), this analyzer

• should list what libraries are used by it
• should list whether the app uses some ad modules
• pointing out potential dangerous components (keyword: malware) would be great
• must run on Linux (not necessarily native: PHP, Python or Java would be fine, too – but something requiring e.g. Wine is not an option).
• must not require the entire Android SDK (or a similar huge framework) being installed (requiring parts of it, like the aapt binary, is fine)
• consulting online resources is acceptable in certain limits (but e.g. no "calling home for statistics"), but offline-operation is preferred

In-depth code-analysis, decompilation, byte-code analysis etc. are not needed – just listing libraries and modules is fine (if it additionally can give an URL for more details, that counts as a bonus). A GUI is not required (but doesn't hurt) – however, a command-line interface is a must.

Results should be structured for automatical post-processing (preferably JSON or XML). My dream-case would be something I simply unpack to a directory, then call from there like ./apkanalyzer com.foobar – and it spits some JSON/XML to STDOUT.

I'm aware such a tool might not be able to detect each and every library/ad-module there is (especially as there might be new ones every day) – but the more it knows the better. If it reports "unknown libraries/modules" as such and gives the possibility to make them known (e.g. via a config file), that'd be a bonus.

The program must be free (as in "free beer"), should preferably also be free (as in "free speech"), and should be free (as in "hazzle-free setup" ;).

Answer 1

LibRadar seems to match my requirements:

• list libraries: Yes. And categorizes them even.
• list ad modules: Yes, amongst the libraries, using their own category.
• pointing out potential dangerous components: either I had none (yet), or it doesn't explicitly mark them. However, it usually gives a URL for background.
• must run on Linux: It does. Written in Python, it can be used cross-platform.
• must not require the entire Android SDK: obviously not, as for me it worked out-of-the-box (downloaded from its Git repo). Seems to ship required components along (e.g. apktool)
• Results should be structured for automatical post-processing: Spits out JSON to STDOUT, so yes.

It might not recognize the latest stuff, but it seems to show even libraries unknown to itself. Using those libraries' IDs, one can search for details on them, and "overlay" that information – which I find quite useful. A big plus is it even lists the permissions a library is adding to the set. A simplified example (converted to my own array structure to make it easier to see):

[3] => Array
    (
        [name] => Parse.com
        [pkgname] => com/parse/
        [type] => Mobile Analytics
        [perms] => Array
            (
                [0] => android.permission.ACCESS_NETWORK_STATE
                [1] => android.permission.WAKE_LOCK
                [2] => android.permission.INTERNET
            )

        [url] => https://parse.com/docs/cn/android/guide
    )

So LibRadar will be what I will use for now. Fits my requirements quite fine, and even adds some bonus on top listing the permissions used by the given framework.

Answer 2

Another fitting candidate would be εxodus standalone:

• lists libraries: only privacy offenders aka ATS (Ads and Tracking Services) aka Trackers – but those are in my case the most releavant
• list ad modules: yes.
• pointing out potential dangerous components: only to ATS.
• must run on Linux: yes. As LibRadar, this is written in Python.
• must not require the entire Android SDK: no, it just needs dexdump, which can easily be installed using sudo apt-get install dexdump.
• Results should be structured for automatical post-processing: Yes, it offers JSON output.

This is part of the Exodus Privacy project, using the same engine as their web scanner, so it's kept up-to-date. If the goal is just to catch those trackers, this is a good candidate. Example output and install instructions can be found behind the first (bold) link of this answer. Like LibRadar, it is free and open source, so matching that requirement as well.