master

Author: ismailtsdln

README.md

@@ -0,0 +1,31 @@
+# ApkSentinel
+
+A high-performance APK static analysis tool for secret detection.
+
+## Features
+
+- **APK Decompilation**: Uses `jadx` to decompile APKs.
+- **Secret Scanning**: Regex-based detection of API keys, tokens, and URLs.
+- **Parallel Processing**: Fast analysis using Go's concurrency.
+- **Modular Reporting**: JSON and HTML report outputs.
+- **Extensible**: Add custom patterns via JSON/YAML.
+
+## Installation
+
+```bash
+go install -v github.com/ismailtsdln/ApkSentinel@latest
+```
+
+## Usage
+
+```bash
+# Basic scan
+apk-sentinel -i app.apk -o ./report -f json
+
+# Scan with custom patterns
+apk-sentinel -i app.apk -p my-patterns.json -o ./report
+```
+
+## License
+
+MIT

apk-sentinel

@@ -0,0 +1,119 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/ismailtsdln/ApkSentinel/internal/analyzer"
+	"github.com/ismailtsdln/ApkSentinel/internal/decompiler"
+	"github.com/ismailtsdln/ApkSentinel/internal/report"
+	"github.com/ismailtsdln/ApkSentinel/internal/scanner"
+	"github.com/ismailtsdln/ApkSentinel/internal/utils"
+	"github.com/spf13/cobra"
+)
+
+var (
+	inputPath      string
+	outputDir      string
+	outputFormat   string
+	customPatterns string
+	jadxPath       string
+	verbose        bool
+)
+
+var rootCmd = &cobra.Command{
+	Use:   "apk-sentinel",
+	Short: "ApkSentinel is a high-performance APK static analysis tool",
+	Long: `ApkSentinel is a high-performance APK static analysis tool designed to 
+detect hard-coded secrets, API keys, and sensitive URLs in Android applications.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		utils.PrintBanner()
+
+		if inputPath == "" {
+			utils.Error("Input APK path is required.")
+			cmd.Help()
+			os.Exit(1)
+		}
+
+		// 1. Decompile
+		decomp := decompiler.NewDecompiler(jadxPath, filepath.Join(outputDir, "decompiled"))
+		decompiledDir, err := decomp.Decompile(inputPath)
+		if err != nil {
+			utils.Error("Error during decompilation: %v", err)
+			os.Exit(1)
+		}
+
+		// 2. Scan
+		patternFile := customPatterns
+		if patternFile == "" {
+			// fallback to default patterns
+			patternFile = "internal/patterns/default_patterns.json"
+		}
+
+		s, err := scanner.NewScanner(patternFile)
+		if err != nil {
+			utils.Error("Error initializing scanner: %v", err)
+			os.Exit(1)
+		}
+
+		utils.Info("Scanning decompiled source code...")
+		results, err := s.ScanDirectory(decompiledDir)
+		if err != nil {
+			utils.Error("Error during scan: %v", err)
+			os.Exit(1)
+		}
+
+		// 3. Manifest Analysis
+		manifestPath := filepath.Join(decompiledDir, "resources", "AndroidManifest.xml")
+		// Sometimes jadx puts it in the root depending on version/config
+		if _, err := os.Stat(manifestPath); os.IsNotExist(err) {
+			manifestPath = filepath.Join(decompiledDir, "AndroidManifest.xml")
+		}
+
+		var findings []analyzer.SecurityFinding
+		if _, err := os.Stat(manifestPath); err == nil {
+			utils.Info("Analyzing AndroidManifest.xml...")
+			findings, _ = analyzer.AnalyzeManifest(manifestPath)
+		}
+
+		// 4. Report
+		r := report.Report{
+			APKPath:  inputPath,
+			Results:  results,
+			Findings: findings,
+		}
+
+		if outputFormat == "json" || outputFormat == "both" {
+			if err := report.SaveJSON(r, outputDir); err != nil {
+				utils.Error("Error saving JSON report: %v", err)
+			}
+		}
+
+		if outputFormat == "html" || outputFormat == "both" {
+			if err := report.SaveHTML(r, outputDir); err != nil {
+				utils.Error("Error saving HTML report: %v", err)
+			}
+		}
+	},
+}
+
+func Execute() {
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+}
+
+func init() {
+	rootCmd.PersistentFlags().StringVarP(&inputPath, "input", "i", "", "Input APK path (required)")
+	rootCmd.PersistentFlags().StringVarP(&outputDir, "output", "o", "./report", "Output directory")
+	rootCmd.PersistentFlags().StringVarP(&outputFormat, "format", "f", "json", "Output format (json|html)")
+	rootCmd.PersistentFlags().StringVarP(&customPatterns, "pattern", "p", "", "Custom pattern file (JSON)")
+	rootCmd.PersistentFlags().StringVar(&jadxPath, "jadx-path", "jadx", "Path to jadx executable")
+	rootCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, "Show verbose output")
+}
+
+func main() {
+	Execute()
+}

cmd/apk-sentinel.go

@@ -0,0 +1,16 @@
+module github.com/ismailtsdln/ApkSentinel
+
+go 1.25.5
+
+require (
+	github.com/fatih/color v1.18.0
+	github.com/spf13/cobra v1.10.2
+)
+
+require (
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/spf13/pflag v1.0.9 // indirect
+	golang.org/x/sys v0.25.0 // indirect
+)

go.mod

@@ -0,0 +1,21 @@
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
+golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

go.sum

@@ -0,0 +1,59 @@
+package analyzer
+
+import (
+	"encoding/xml"
+	"fmt"
+	"os"
+)
+
+// Manifest represents a simplified AndroidManifest.xml structure.
+type Manifest struct {
+	XMLName     xml.Name    `xml:"manifest"`
+	Application Application `xml:"application"`
+}
+
+// Application represents the application tag in AndroidManifest.xml.
+type Application struct {
+	Debuggable  string `xml:"http://schemas.android.com/apk/res/android debuggable,attr"`
+	AllowBackup string `xml:"http://schemas.android.com/apk/res/android allowBackup,attr"`
+}
+
+// SecurityFinding represents a security issue found in the manifest or resources.
+type SecurityFinding struct {
+	Type        string
+	Description string
+	Severity    string
+}
+
+// AnalyzeManifest parses AndroidManifest.xml and returns security findings.
+func AnalyzeManifest(manifestPath string) ([]SecurityFinding, error) {
+	data, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read manifest: %w", err)
+	}
+
+	var manifest Manifest
+	if err := xml.Unmarshal(data, &manifest); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal manifest: %w", err)
+	}
+
+	var findings []SecurityFinding
+
+	if manifest.Application.Debuggable == "true" {
+		findings = append(findings, SecurityFinding{
+			Type:        "Manifest",
+			Description: "Application is debuggable",
+			Severity:    "high",
+		})
+	}
+
+	if manifest.Application.AllowBackup != "false" {
+		findings = append(findings, SecurityFinding{
+			Type:        "Manifest",
+			Description: "Application allows backup (allowBackup is not false)",
+			Severity:    "medium",
+		})
+	}
+
+	return findings, nil
+}

internal/analyzer/manifest.go

@@ -0,0 +1,59 @@
+package analyzer
+
+import (
+	"encoding/base64"
+	"regexp"
+)
+
+// ObfuscationResolver provides methods to decode common obfuscation techniques.
+type ObfuscationResolver struct {
+	base64Regex *regexp.Regexp
+}
+
+// NewObfuscationResolver initializes a new ObfuscationResolver.
+func NewObfuscationResolver() *ObfuscationResolver {
+	return &ObfuscationResolver{
+		// Regex to find potential Base64 strings (minimum length 8 to avoid false positives)
+		base64Regex: regexp.MustCompile(`[A-Za-z0-9+/]{8,}=*`),
+	}
+}
+
+// ResolveBase64 looks for Base64 encoded strings in a line and returns the decoded versions.
+func (or *ObfuscationResolver) ResolveBase64(input string) []string {
+	var decodedStrings []string
+	matches := or.base64Regex.FindAllString(input, -1)
+
+	for _, match := range matches {
+		decoded, err := base64.StdEncoding.DecodeString(match)
+		if err == nil {
+			// Only add if it contains printable characters (rough check)
+			if isPrintable(decoded) {
+				decodedStrings = append(decodedStrings, string(decoded))
+			}
+		}
+	}
+	return decodedStrings
+}
+
+// ResolveXOR attempts simple XOR decoding (future improvement: brute force common keys).
+func (or *ObfuscationResolver) ResolveXOR(input string, key byte) string {
+	data := []byte(input)
+	for i := range data {
+		data[i] ^= key
+	}
+	return string(data)
+}
+
+// isPrintable checks if the byte slice contains mostly printable ASCII characters.
+func isPrintable(data []byte) bool {
+	if len(data) == 0 {
+		return false
+	}
+	printable := 0
+	for _, b := range data {
+		if (b >= 32 && b <= 126) || b == '\n' || b == '\r' || b == '\t' {
+			printable++
+		}
+	}
+	return float64(printable)/float64(len(data)) > 0.8
+}

internal/analyzer/obfuscation.go

@@ -0,0 +1,56 @@
+package decompiler
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"github.com/ismailtsdln/ApkSentinel/internal/utils"
+)
+
+// Decompiler handles the APK to Java/Smali conversion logic.
+type Decompiler struct {
+	JadxPath  string
+	OutputDir string
+}
+
+// NewDecompiler returns a new Decompiler instance.
+func NewDecompiler(jadxPath, outputDir string) *Decompiler {
+	return &Decompiler{
+		JadxPath:  jadxPath,
+		OutputDir: outputDir,
+	}
+}
+
+// Decompile executes the jadx command to decompile the given APK path.
+func (d *Decompiler) Decompile(apkPath string) (string, error) {
+	if _, err := os.Stat(apkPath); os.IsNotExist(err) {
+		return "", fmt.Errorf("APK file not found: %s", apkPath)
+	}
+
+	absAPKPath, err := filepath.Abs(apkPath)
+	if err != nil {
+		return "", fmt.Errorf("failed to get absolute path of APK: %w", err)
+	}
+
+	// Create output directory if it doesn't exist
+	if err := os.MkdirAll(d.OutputDir, 0755); err != nil {
+		return "", fmt.Errorf("failed to create output directory: %w", err)
+	}
+
+	utils.Info("Decompiling %s to %s...", apkPath, d.OutputDir)
+
+	// Build the jadx command
+	// -d: output directory
+	cmd := exec.Command(d.JadxPath, "-d", d.OutputDir, absAPKPath)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	if err := cmd.Run(); err != nil {
+		return "", fmt.Errorf("jadx execution failed: %w", err)
+	}
+
+	utils.Success("Decompilation completed successfully.")
+	return d.OutputDir, nil
+}