androguard / androguard

Reverse engineering and pentesting for Android applications

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

False Positive Identification of Custom Methods as Android API Calls in APK Analysis

mervecigdem opened this issue · comments

Hello, I'm extracting Android API calls and custom method calls from APKs using Androguard. I'm using the small code snippet below for this purpose:

custom_method_set = set()
android_api_set = set()

for method in dx.get_methods():
m = method.get_method()
class_name = m.get_class_name()
method_name = m.get_name()
api_call = f"'{class_name}->{method_name}'"
if method.is_android_api():
android_api_set.add(api_call)
else:
custom_method_set.add(api_call)

So far, I've analyzed 2000 APKs, and in only one of them, some custom methods are accidentally added to the Android API set. I'm sharing the relevant APK as an attachment. (Since I couldn't attach the APK to GitHub, I changed the file extension to zip.) Below, I list some of the custom methods that are incorrectly present in the Android API set:

'Landroid/a/a/a/a;->a'
'Landroid/a/a/a/a;->b'
'Landroid/a/a/a/a;->c'
'Landroid/a/a/a/a;->d'
'Landroid/a/a/a/a;->e'
'Landroid/a/b/j;->clone'
'Landroid/a/b/j;->ordinal'
'Landroid/a/b/k;->clone'
'Landroid/a/b/k;->compareTo'
'Landroid/a/b/k;->ordinal'
'Landroid/a/b/r;->getActivity'

What could be the reason for this? Could you also examine the relevant APK?
Androguard version: 3.4.0a1
com.equalizer.volume.music.bass.booster.tool.zip