Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

Quark-Engine

Rule-based engine for analysing suspicious Android apps: it loads an APK's Dalvik bytecode and checks JSON behaviour rules, each naming permissions and a pair of framework API calls, through five confidence stages, from the permission being requested and either API being called up to both calls appearing in order in one method and passing the same register. Weighted rule matches produce a threat score, with summary, detail, JSON, web, call-graph and label reports, and Quark Script exposes the analysis as a Python API that the project presents for finding vulnerabilities. The repository also ships two Claude Code skills, for running an analysis and generating a rule, and an optional LangChain agent that uses the OpenAI API.

Targets
App
Category
Android tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v26.10.1, published on GitHub and PyPI on 2026-10-10 and requiring Python 3.10+. The reviewed master commit of 2026-10-17 differs from it only by an added malware-family report in the documentation.
  • Install from PyPI, or from source with Pipenv, then run freshquark, which git-clones the separate quark-rules repository into a .quark-engine folder in the user's home directory. dextrace is the default core library, with Androguard 4.1.4 pinned, rizin and radare2 backends through optional extras plus the native tools, and a Shuriken backend; call graphs need Graphviz. The Quark Agent needs an OpenAI API key, and the Claude Code skills need Claude Code with Quark installed.
  • Input is one APK per run; the documentation scans directories with a shell loop or the Python API. Reports are static rule matches whose confidence counts the stages a rule passes, so coverage depends on the rule set; setup.py calls Quark an obfuscation-neglect scoring system. Suspicious samples belong in an isolated analysis environment, and the test suite downloads live malware and deliberately vulnerable APKs from a separate sample repository.
  • CI builds rizin 0.7.3 and radare2 5.9.0 and runs pytest with coverage on Python 3.10. The malware-family reports in the documentation are project analyses. GPL-3.0 per LICENSE and the setup.py classifier.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · ev-flow/quark-engine · Revision 7accc95
  2. docs/source/index.rst GitHub · ev-flow/quark-engine · Revision 7accc95
  3. docs/source/install.rst GitHub · ev-flow/quark-engine · Revision 7accc95
  4. docs/source/integration.rst GitHub · ev-flow/quark-engine · Revision 7accc95
  5. quark/core/quark.py GitHub · ev-flow/quark-engine · Revision 7accc95
  6. quark/rules/sendLocation_SMS.json GitHub · ev-flow/quark-engine · Revision 7accc95
  7. quark/freshquark.py GitHub · ev-flow/quark-engine · Revision 7accc95
  8. setup.py GitHub · ev-flow/quark-engine · Revision 7accc95
  9. quark-ai-plugin/README.md GitHub · ev-flow/quark-engine · Revision 7accc95
  10. quark/agent/quarkAgent.py GitHub · ev-flow/quark-engine · Revision 7accc95
  11. .github/workflows/pytest.yml GitHub · ev-flow/quark-engine · Revision 7accc95
  12. LICENSE GitHub · ev-flow/quark-engine · Revision 7accc95
  13. https://github.com/ev-flow/quark-engine/releases/tag/v26.10.1
  14. https://pypi.org/project/quark-engine/26.10.1/

More in Apps

All 174 entries in Apps

↑↓ move↵ open⌘↵ new tab