Open-source Android analysis
Look inside
Android apps.
Inspect APKs, explore call graphs, and trace potential data flows with one Java library and command-line tool.
Select a method to explore
This entry method calls source() and sink(String) in the test app. Select either method to inspect its connection.
Start with your question.
Choose the view you need.
Keep the results for your next step.
Get to know an APK.
Read package information, SDK versions, requested permissions, and declared components directly from the Android manifest.
- No Android SDK required
- No device or app execution
- Text or JSON output
bin/androspecter metadata \
--apk app.apk \
--format textGo from classes to calls.
Inspect classes, methods, and invocation sites. Focus on the packages you care about, without first building an Android call graph.
- Select one or more packages
- List methods and inspect invocations
- Export structured inspection results
bin/androspecter inspect \
--apk app.apk \
--platforms /path/to/sdk/platforms \
--package com.example.app \
--invocations --format textFollow the connections.
Build Android-aware call graphs, then explore callers, callees, reachability, and shortest paths. Save the graph once and query it offline.
- CHA, RTA, VTA, and SPARK
- JSON, DOT, and standalone HTML
- Searchable, interactive graph reports
bin/androspecter graph \
--apk app.apk \
--platforms /path/to/sdk/platforms \
-o graph.json
bin/androspecter graph \
--input-json graph.json \
--format html -o graph.htmlTrace potential data flows.
Define the sources and sinks relevant to your analysis, then use FlowDroid-backed taint analysis to obtain findings and available propagation paths.
- Explicit source and sink definitions
- Configurable path reconstruction
- Findings, diagnostics, and completion status
bin/androspecter taint \
--apk app.apk \
--platforms /path/to/sdk/platforms \
--sources-sinks sources-sinks.txt \
--paths precise \
-o taint.jsonQuery offline
Find callers, reachable methods, and shortest paths in saved graphs.
Compare graphs
Use the Java API to identify changes between graph snapshots.
Build your own analysis
Compose inspection callbacks, logging probes, and transformations.
A graph you can explore.
A file you can keep.
This report was generated by AndroSpecter from its small repository test APK. Open it to search methods, inspect calls, and explore the graph.
Open example report- Input
- Repository test fixture
- Package
demo.taint- Graph
- CHA · package-filtered
- Export
- 5 methods · 2 calls
Interactive. Works offline. Yours to explore.
The graph shows static call relationships, not proof of runtime behaviour. This small test fixture illustrates the output format.
Use it your way.
Run a command, or make AndroSpecter
part of your Java application.
A small setup.
A flexible toolkit.
You will need Java 17+ and Maven 3.6.3+. For APK code and data-flow analysis, also provide an Android SDK platforms directory.
Build from source. The commands shown here use the current development version, 1.2.0-SNAPSHOT, which is not published to Maven Central.
git clone https://github.com/JordanSamhi/AndroSpecter.git
cd AndroSpecter
mvn -B install
mvn -B -f cli/pom.xml package
bin/androspecter --helpThe CLI is a separate executable JAR. After building, use bin/androspecter from the repository.
<dependency>
<groupId>com.jordansamhi</groupId>
<artifactId>androspecter</artifactId>
<version>1.2.0-SNAPSHOT</version>
</dependency>First clone the repository and run mvn -B install to install this development version locally. Then add the dependency to your application.