1

How to find all the Third Party Libraries (TPLs) used in an android app after de-compiling apk using jadx? I have looked at this answer but this is too vague.

I can use tools such as Libradar etc. but these tools require that I provide a database of all the TPL's to find whether the TPL is existing in the app. Any other manual way to find all the TPL's which exist in the Android app as I'm interested only in finding the TPL's in a single app.

Improve this question
3
  • 1
    If the APK obfuscated or not? If not you can simply look at the package names of the classes and search for them in the internet. Additionally the R classes (see Jadx) often contain a library name and sometimes even the version.
    – Robert
    Commented Jun 7 at 10:03
  • @Robert the apk is obfuscated, also how do I know which library is requesting a specific android permission in the case of normal apk.
    – Vamsi
    Commented Jun 7 at 13:23
  • 1
    It doesn't matter which library is requesting a permission. Once you grant it the whole APK has access. Therefore a library could simply wait for the permissions requested by other parts of the app and then access the data without requesting the permission itself. Therefore you should search for API methods that require specific permission rather than code parts that request a permission.
    – Robert
    Commented Jun 7 at 13:51

2 Answers 2

Reset to default
0

You can use AppManager to look for libraries in apk. App link: https://f-droid.org/en/packages/io.github.muntashirakon.AppManager/

Open any apk or installed app on it, and choose "Scanner" to fetch libraries, trackers & other information.

I'll also recommend using APKiD:- https://github.com/rednaga/APKiD

It'll help you to figure out what protection, obfuscation, etc the app uses.

Some protection hide the original dex files/load it only on runtime (Example-Jiagu360 ) in that case, you'll have to dump the dex using frida or through some other way, and after that you can move on to analyze the original dex. Some protections also randomize the file name of .so libraries, and decrypt the original library on runtime. In that case, you'll have to look for a way to remove those protections first, and APKiD will help you in first step of figuring out what exactly you're fighting against.

Improve this answer
1
  • Also, you can decompile using jadx and check for interesting/specific decompiled code on grep.app to find out if it belongs to some open source library.
    – Vansh Santoshi
    Commented Jul 22 at 7:51
0

Use the package manager to query third party APKs by passing third party flag.

This must be done with shell privileges using shizuku APK or adb.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.