Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 19, 2026

Utilities

Identify compiler, packer and obfuscator signatures

apkid-identify is an offline APK signature-identification adapter using APKiD.

Agent
Identify build signaturesReview protection indicatorsRecord a comparison baseline

overview

What apkid-identify does

Inspect an owned APK for known compiler, packer and obfuscator signatures. APKiD identifies matching patterns; its results are not a vulnerability scan, malware verdict or guarantee that an app is safe.

A FILE containing native APKiD JSON with a files collection and rules_sha256. The accepted owned fixture matched compiler dexlib 2.x; a resource-only fixture returned an empty files collection. Native exit failure or unreadable JSON fails the adapter. An empty result is not a safety verdict.

The adapter accepts an APK ZIP of at most 20 MiB and 2000 entries, with at most 64 MiB declared expanded data. It requires AndroidManifest.xml and rejects repeated raw paths, absolute paths, parent traversal and symlinks. APKiD is invoked with a 15-second scan timeout, scan depth 1 and 20 MiB entry scan limit; the adapter timeout is 120 seconds. The 4 MiB JSON limit is checked after execution, not a peak-memory guarantee.

Pinned upstream version: 3.1.0. Upstream license: GPL-3.0; first-party adapter licensing is separate. Local native positive and negative fixtures passed. Native and platform fixtures, public Library identity and source/notices delivery were verified.

source github.com/rednaga/APKiD/tree/3db7bb9c57166b63e8855940b75966e62a6cf1ed

use cases

Where apkid-identify fits

Identify build signatures

Inspect known compiler signatures in an APK you own.

Review protection indicators

Retain reported packer or obfuscator patterns as evidence for a separate manual review.

Record a comparison baseline

Keep native signature reports alongside owned builds; a missing match does not prove that protection is absent.

reference

apkid-identify inputs and flags

1 inputs
NameTypeFlagDescription
apkFILE--apkOwned APK ZIP file for static signature identification.

Showing key inputs. apkid-identify exposes 1 inputs in total.

example

Run apkid-identify

apkid-identify · command
python3 /app/run.py --apk ./owned-demo.apk ./output
sample output
{"apkid_version": "3.1.0", "files": [{"filename": "/tmp/android-tool-cmi14wu9/input.apk!classes.dex", "matches": {"compiler": ["dexlib 2.x"]}}], "rules_sha256": "c6c4af304a89d4f9f3d1212a6756e8f572b9a4c95c5f89ab1df6b549ef3fba00"}

guidance

Choosing apkid-identify

Choose APKiD for signature identification. JADX reconstructs Java and Androguard manifest extraction returns XML declarations. Androguard’s apkid metadata command is a different operation from the APKiD project.

faq

apkid-identify questions

apk: Owned APK ZIP file for static signature identification.

A FILE containing native APKiD JSON with a files collection and rules_sha256. The accepted owned fixture matched compiler dexlib 2.x; a resource-only fixture returned an empty files collection. Native exit failure or unreadable JSON fails the adapter. An empty result is not a safety verdict. The registered contract also exposes a FOLDER output; the primary report is the FILE artifact verified in the platform fixture run.

The adapter accepts an APK ZIP of at most 20 MiB and 2000 entries, with at most 64 MiB declared expanded data. It requires AndroidManifest.xml and rejects repeated raw paths, absolute paths, parent traversal and symlinks. APKiD is invoked with a 15-second scan timeout, scan depth 1 and 20 MiB entry scan limit; the adapter timeout is 120 seconds. The 4 MiB JSON limit is checked after execution, not a peak-memory guarantee.

Choose APKiD for signature identification. JADX reconstructs Java and Androguard manifest extraction returns XML declarations. Androguard’s apkid metadata command is a different operation from the APKiD project.

Yes. This Library tool uses the tested image and supplied-file contract. Native fixtures and the private platform fixture-tool-verifier run passed; the image, adapter source and notices are publicly downloadable through the repository directions below.

The public repository overview provides immutable image and ORAS source/notices download commands, the exact bundle SHA256 and pinned upstream source directions. The bundle includes the adapter, Dockerfile, dependency locks where applicable, corresponding source, installed notices and owned fixture harness. Diffuse also includes embedded Java notices and matching Debian OpenJDK source payloads. First-party adapter licensing is separate from upstream licensing. Follow its local-tag alias directions to run the fixture without a GHCR account. Image, source and license notice downloads.

related

More Utilities tools

  1. browser-fetch

    Headless Chromium render: requested URL, final URL, status, and title next to the page.

  2. cewl

    Spider a URL and return a wordlist for password crackers.

  3. csvkit

    SQL on one CSV. The table name is the file stem.

  4. dnsgen

    Wordlist and mined-word subdomain permutation.

  5. duckdb

    In-process SQL on CSV, JSON, and Parquet. No server.

  6. edge-tts

    Microsoft Edge neural speech from text or a script file. No API key.

Run apkid-identify yourself

Complete retained native APKiD JSON from a self-owned APK containing a typed-parameter DEX fixture. The actual compiler signature is dexlib 2.x and the compiled rules hash is nonempty. A resource-only APK returned files: []; an invalid ZIP failed adapter preflight. Temporary filenames vary per run, so raw JSON hashes are recorded per run while fixture signatures and rules identity establish the semantic check. Separate private platform fixture runs and exact public Library readbacks also passed.

Open apkid-identify in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.