classify_apk_protection
Scans APK and DEX files for obfuscation, packers, and SSL pinning patterns using a signature catalog, returning categorized matches with evidence offsets.
Instructions
Walk the APK + every classes*.dex for known protection patterns.
Uses the vendored data/apkid-signatures.json catalog.
Returns a list of {category, evidence, evidence_offset, evidence_file} records with category-only labels
("apk_packager", "dex_obfuscator", "ssl_pinning",
etc.). The category names describe observable patterns;
no specific commercial product is named.
Args: path: path to the APK max_per_category: per-category match cap (default 50)
Returns::
{
"path": "...",
"matches": [{"category": "...", "evidence": "...",
"evidence_offset": N, "evidence_file": "...",
"match_pattern": "...", "id": "..."}, ...],
"by_category": {"dex-obfuscator": 12, "ssl_pinning": 2, ...},
"truncated": {"per_category": bool}
}The signature table is matched against:
classes.dexstring table (DEX class names + method signatures + string literals);every
lib/*.sofor the native-section + string-literal categories;the manifest's
application/meta-dataelements.
The implementation lives in
servers/re-apktool/src/re_apktool/classify.py.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| max_per_category | No |