CODEWITHSUNDEEP
javaandroidapk
Johnny
Johnny

Reputation: 7321

How can I list all 3rd party jars in an apk?

Given an apk file, is there any way to list all jar references in it? I can't figure out a way to do it with aapt. I guess there's a possible complicated route involving dex to jar conversion but I was wondering if there's something simpler.

Upvotes: 3

Views: 1084

Answers (1)

Kasra Rahjerdi
Kasra Rahjerdi

Reputation: 2503

Since all first-party and third-party code is optimized into one dex file, you're not going to be able to find a list of just the third party jars pretty easily.

You can however, use the tool dexdump which exists in $SDK_DIR/build-tools/{VERSION}/ to view information about the combined dex file inside of the APK.

This will print out a list of all classes in the file:

./dexdump {PATH_TO_APK} | grep "Class descriptor" | cut -d':' -f

The output will look something like:

'Lcom/stackexchange/marvin/ui/inbox/AchievementsListFragment;' 'Lcom/stackexchange/marvin/ui/question/AnswerFragment;' 'Lcom/stackexchange/marvin/ui/site/AllSitesFragment;' 'Lcom/stackexchange/marvin/ui/site/SingleSiteQuestionsFragment;' 'Lcom/stackexchange/marvin/ui/site/SingleSiteTagsFragment;' 'Lcom/stackexchange/marvin/ui/site/SingleSiteUsersFragment;'

...

Since it seems that you care about the packages, not the classes, you can also optimize this a bit by looking at just the unique rough guesses for package identifiers. If we assume every class that has a different first two labels is a different package, then you can trim down the classes to just the packages like so:

./dexdump ~/Downloads/StackExchangeMobile-release.apk | grep "Class descriptor" | cut -d':' -f2 | cut -c4- | cut -d'/' -f1-2 | uniq -u | sort

The above will remove the 'L from the beginning of each line in the previous result, get just the first two folder names (namespace identifiers), then print out all the unique ones it finds.

Using that on the Stack Exchange android application spits out:

android/support

com/actionbarsherlock

com/google

com/koushikdutta

...

which shows what it's using. You can play with the number of folder names to keep since some packages require drilling down more than 2 identifiers to figure out what they use, by modifying the -f1-2 section of the last cut command to be -f1-{NUM}. I didn't since changing it to three in this case spits out a lot of junit packages.

Upvotes: 5

Related Questions