5

I have downloaded a few Android applications from Google Play. I have got Smali code through reverse engineering tool apktool .I want to generate call graphs for these applications. I have seen many links on stack overflow and Google, most of the suggested tools are either for c/c++ or if they are for Java, they need source code which I don't have, of course.

Is there any way to generate call graphs automatically? Thanks.

Junaid
  • 1,668
  • 7
  • 30
  • 51
  • Do the licenses for those apps permit reverse engineering? – Simon Dec 06 '12 at 08:52
  • I am just new to Android security and want to develop a tool for testing apps. I am not going to repackage them. And is there any way to check if license allows it or not? And since everybody can download it, how it can be enforced if they don't allow? – Junaid Dec 06 '12 at 09:04
  • "How can it be enforced" is not a test for legality and repackaging is a separate issue. Most licenses expressly prohibit reverse engineering. You could examine open source apps – Simon Dec 06 '12 at 09:21

1 Answers1

1

apkinspector - http://code.google.com/p/apkinspector/

The goal of this project is to aide analysts and reverse engineers to visualize compiled Android packages and their corresponding DEX code. APKInspector provides both analysis functions and graphic features for the users to gain deep insight into the malicious apps:

  • CFG
  • Call Graph
  • Static Instrumentation
  • Permission Analysis
  • Dalvik codes
  • Smali codes
  • Java codes
  • APK Information

I've tried to install apkinspector in my computer (Debian 6.0):

sudo aptitude install libxext-dev
source compile python-qt and python-sip

http://sourceforge.net/projects/pyqt/files/PyQt4/PyQt-4.9.4/

sudo aptitude install python-tk

easy_install ipython
(sudo aptitude install python-pip & sudo pip install ipython)

vi androguard/androlyze.py
change "import IPython.ipapi" to "import IPython.core.ipapi"
change "from IPython import IPShellEmbed" to "import IPython"
change "IPShellEmbed" to "IPython.embed"

But unfortunately it cannot be used!!!

thus I tried to write my own tool using Ruby, which can be found in here

ytliu
  • 569
  • 1
  • 4
  • 12
  • It's nice tool but unfortunately, it is not even installed successfully. Its pages asks to run "./install.sh" file which does not exist. When "StartQT.py" is run, another package file is missing. :( – Junaid Feb 21 '13 at 08:42