{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/doc/en/overview.md",
    "https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/doc/en/how_to_write_rules.md",
    "https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/doc/en/argument.md",
    "https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/doc/en/result.md",
    "https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/doc/en/startup.md",
    "https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/doc/en/faq.md",
    "https://github.com/bytedance/appshark/tree/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/config/rules",
    "https://github.com/bytedance/appshark/tree/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/config/tools/platforms",
    "https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/build.gradle.kts",
    "https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/src/main/kotlin/net/bytedance/security/app/StaticAnalyzeMain.kt",
    "https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/LICENSE",
    "https://github.com/bytedance/appshark/releases/tag/v0.1.2"
  ],
  "category": "android",
  "description_en": "ByteDance's static taint-analysis engine for Android APKs, designed for very large apps, that scans an app against JSON rules naming entry methods, sources, sinks and sanitizers as Jimple signatures, for vulnerability and privacy-compliance review. It works on Soot's Jimple IR and reuses FlowDroid's manifest and resource parsing, but implements its own field-sensitive pointer and taint analysis. Results go to results.json, which records app, component and permission information, deep links and JavaScript bridge interfaces alongside each source-to-sink path, with an HTML page per finding.",
  "description_zh": "字节跳动开发的 Android APK 静态污点分析引擎，面向超大型应用设计：它依据 JSON 规则扫描应用，规则以 Jimple 签名指定入口方法、源、汇和净化器，用于漏洞与隐私合规审查。它基于 Soot 的 Jimple 中间表示，并复用 FlowDroid 的清单与资源解析模块，但指针分析和污点分析均为自行实现，且区分字段。结果写入 results.json，其中记录应用、组件和权限信息、深层链接及 JavaScript 桥接接口，以及每条从源到汇的路径，每项发现另有一个 HTML 页面。",
  "entry_url": "https://awesomerea.org/resources/appshark/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/appshark/",
  "evidence_url": "https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/README.md",
  "group": "tools",
  "id": "appshark",
  "json_url": "https://awesomerea.org/resources/appshark/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/appshark/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/appshark/index.md",
  "name": "Appshark",
  "name_zh": "Appshark Android 静态污点分析引擎",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Requires JDK 11; the README says it does not work on JDK 8 or JDK 16 because of dependency compatibility. ./gradlew build -x test produces AppShark-0.1.2-all.jar. Latest release at review: v0.1.2, published 2022-09-22 with prebuilt jars; the reviewed main commit, still versioned 0.1.2, is 123 commits ahead of it, including September 2026 commits that add scan resource budgets, a bounded jadx workspace and validation of untrusted rule graphs. The startup guide still links the v0.1.1 jar.",
    "Input is the APK to analyze, named by apkPath in a JSON5 config passed to the jar, with rules taken from config/rules, which holds seven sample rules such as unZipSlip, PendingIntentMutable and ContentProviderPathTraversal. The repository bundles 18 Android SDK platform stub jars, config/tools/platforms/android-14 through android-33/android.jar (API levels 15 and 21 absent, about 18 to 47 MB each), used as the default SDK path, plus five small compiled test classes; the javaSource option runs jadx from config/tools/jadx/bin, which the repository does not include.",
    "Findings are static source-to-sink paths whose coverage depends on the rules and settings: the argument guide says too short a maxPointerAnalyzeTime can cause false positives and negatives, and the FAQ shows a slice-mode entry missing an aliased path. The README's security notice limits the UI and server to local testing. Apache-2.0."
  ],
  "requirements_zh": [
    "需要 JDK 11；README 称由于依赖兼容性问题，它无法在 JDK 8 或 JDK 16 上运行。执行 ./gradlew build -x test 可生成 AppShark-0.1.2-all.jar。审阅时最新版本为 v0.1.2，发布于 2022-09-22，附预构建 jar；所审阅的 main 提交版本号仍为 0.1.2，但比该版本多 123 个提交，其中包括 2026 年 9 月加入扫描资源预算、受限的 jadx 工作区以及对不可信规则图进行校验的提交。入门指南仍链接 v0.1.1 的 jar。",
    "输入为待分析的 APK，由传给 jar 的 JSON5 配置中的 apkPath 指定；规则取自 config/rules，其中有 unZipSlip、PendingIntentMutable、ContentProviderPathTraversal 等七条示例规则。仓库自带 18 个 Android SDK 平台存根 jar，即 config/tools/platforms/android-14 至 android-33/android.jar（缺 API 15 和 21，每个约 18 至 47 MB），作为默认 SDK 路径，另有五个很小的已编译测试类；javaSource 选项会从 config/tools/jadx/bin 调用 jadx，而仓库并未包含 jadx。",
    "发现结果是静态的源到汇路径，覆盖范围取决于规则和设置：参数说明称 maxPointerAnalyzeTime 过短可能导致误报和漏报，FAQ 也举例说明切片模式的入口会漏掉别名路径。README 的安全提示称界面与服务端仅限本地测试使用。采用 Apache-2.0 许可。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://github.com/bytedance/appshark",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}