{
  "added_at": "2026-10-30",
  "additional_evidence_urls": [
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/apkid/main.py",
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/apkid/apkid.py",
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/apkid/rules.py",
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/apkid/rules/apk/trackers.yara",
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/setup.py",
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/apkid/__init__.py",
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/Dockerfile",
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/.travis.yml",
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/tests/test_scanner.py",
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/LICENSE.GPL",
    "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/LICENSE.COMMERCIAL",
    "https://github.com/rednaga/APKiD/releases/tag/v3.1.0",
    "https://pypi.org/project/apkid/3.1.0/"
  ],
  "category": "android",
  "description_en": "PEiD-style identifier for Android packages from RedNaga. It scans APK and DEX files, nested ZIP entries and the native ELF libraries, PE DLLs and resources inside them with YARA rules, using the yara-python-dex DEX module, and reports the compilers, packers, protectors, obfuscators and anti-VM or anti-disassembly tricks it recognizes, per file or as JSON. Optional tracker rules attributed to the Exodus API flag embedded tracking SDKs; APKiD only identifies, and does not unpack or deobfuscate anything.",
  "description_zh": "RedNaga 推出的 Android 安装包识别工具，类似 PEiD。它借助 yara-python-dex 的 DEX 模块，用 YARA 规则扫描 APK、DEX 文件、嵌套的 ZIP 条目及其中的原生 ELF 库、PE 格式 DLL 和资源，报告识别出的编译器、加壳工具、保护工具、混淆工具以及反虚拟机或反反汇编手法，可按文件输出或输出 JSON。可选的追踪器规则注明来自 Exodus API，用于标出内嵌的追踪 SDK；APKiD 只做识别，不会脱壳或反混淆。",
  "entry_url": "https://awesomerea.org/resources/apkid/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/apkid/",
  "evidence_url": "https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/README.md",
  "group": "tools",
  "id": "apkid",
  "json_url": "https://awesomerea.org/resources/apkid/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/apkid/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/apkid/index.md",
  "name": "APKiD",
  "name_zh": "APKiD Android 加壳与混淆识别工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: 3.1.0, tagged and uploaded to PyPI on 2026-04-09; the reviewed master commit of 2026-10-07 adds later rules. pip install apkid pulls in yara-python-dex>=1.0.1. setup.py declares no python_requires and its classifiers name Python 3.6 and 3.7, while Travis CI uses 3.9 and the Dockerfile uses Python 3.11; on Windows the README pins Yara 3.11.0 and a separately built yara-python-dex wheel.",
    "Provide APK, DEX or directory inputs you are entitled to examine. By default the CLI picks entries by file magic, searches nested ZIPs two levels deep, scans entries up to 100 MB and stops each YARA scan after 30 seconds; tracker rules are compiled separately and apply only with --scan-trackers. The README's usage block still shows v2.1.2 and omits --scan-trackers and --include-types.",
    "Detection is signature-based, so unrecognized or modified packers and protectors go unreported; the README asks for unknown samples by file hash to write new rules. Tests compile and lint the rules and scan generated ZIP files; the repository has no sample corpus.",
    "Dual-licensed: GPL-3.0, or a perpetual commercial license that allows distributing APKiD binaries and rules in commercial products but no source redistribution, which is why GitHub reports NOASSERTION."
  ],
  "requirements_zh": [
    "审阅时最新版本为 3.1.0，于 2026-04-09 打标签并上传到 PyPI；所审阅的 master 提交（2026-10-07）还加入了此后的新规则。pip install apkid 会安装 yara-python-dex>=1.0.1。setup.py 未声明 python_requires，分类信息只列出 Python 3.6 和 3.7，而 Travis CI 使用 3.9，Dockerfile 使用 Python 3.11；在 Windows 上，README 要求固定 Yara 3.11.0 并另行构建 yara-python-dex wheel。",
    "输入为分析者有权检查的 APK、DEX 文件或目录。命令行工具默认按文件魔数选择要扫描的条目，嵌套 ZIP 最多深入两层，只扫描不超过 100 MB 的条目，每次 YARA 扫描 30 秒超时；追踪器规则单独编译，仅在使用 --scan-trackers 时启用。README 中的用法说明仍是 v2.1.2 的版本，没有列出 --scan-trackers 和 --include-types。",
    "检测基于特征规则，未收录或经过修改的加壳与保护工具不会被报告；README 请用户提交未知样本的文件哈希，以便编写新规则。测试会编译并检查规则，并扫描临时生成的 ZIP 文件；仓库不含样本集。",
    "采用双重许可：GPL-3.0，或永久商业许可；后者允许在商业产品中分发 APKiD 二进制及规则，但禁止再分发源码，因此 GitHub 显示为 NOASSERTION。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://github.com/rednaga/APKiD",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}