PAGES
← all tools
◆ Malware Analysis

APKiD

v3.2.0 open-source

APKiD identifies how an APK was made, detecting compilers, packers, obfuscators, and other characteristics of Android applications.

source ↗ rss ↗ What is a cyber toolchain? last repo push Oct 21, 2026

Summary

APKiD is an open-source command-line tool that inspects Android APK and DEX files and reports the compiler, packer, obfuscator, or other build tooling used to produce them; its own README describes it as PEiDPEiDA free Windows utility that detects packers, cryptors, and compilers used on PE executables, helping analysts identify obfuscation before reversing a binary. for Android. It installs via pip or runs through a provided Docker wrapper, and it's aimed at malware analysts and reverse engineers who need to quickly triage a sample or identify app-shielding and RASP SDKs before deeper analysis. Its rule set covers a wide range of packers and protectors, from Denuvo mobile protection and Tencent Legu VMP to Zimperium's zShield/zDefend family, and it can detect signature schemes, compression tricks, and Dart or DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. content inside an APK. First committed in 2016, it has 44 contributors and remains active, with 26 commits and 10 releases in the past year adding new detection rules.

APKiD identifies how an APK was made, detecting compilers, packers, obfuscators, and other characteristics of Android applications.

How APKiD helps

Which packer, protector, or obfuscator was used to build this sample?

matches the compiled DEX and APK against its rule set and names the specific tool, from Denuvo mobile protection to Tencent Legu VMP, so triage can start from what actually produced the file

Does this app ship an app-shielding or RASP SDK I need to work around before reversing it?

flags known shielding and RASP families such as the Zimperium zShield/zDefend line and Arxan, so their presence is known before deeper analysis begins

Which compiler actually produced this DEX file?

inspects the DEX content and reports the compiler, distinguishing standard toolchains from ones like R8, using its own compiler map

Is this APK's signature or compression scheme hiding something nonstandard?

checks the signing block for V2+ signature schemes and detects nonstandard compression such as XZ, surfacing tricks a sample might use to evade simpler scanners

Does this file contain Dart, DLL, or other embedded content that isn't plain DEX?

reports file-type detections such as Dart, DLL, and resource files found inside the archive, revealing content a normal APK wouldn't carry

all 9 features, with the evidence for each →

Languages

Not documented

Features

9 capabilities · 5 backed by code, an API document or a real run

Built from APKiD's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • APKiD covers 1 of the 8 investigation and response capabilities we track.

What APKiD offers you

  • Command-line interface2
  • JSON data export2
All capabilities 9 capabilities
YARA rule detection shipped Detects specific malware variants or techniques by matching file contents against custom YARA signatures. 30 releases · 1 other source · first seen Sep 2016

Shared capability: Static malware analysis

release 30 total

  • The dexguard_d YARA rule has been removed; any workflow or downstream tooling that matches on dexguard_d results will no longer receive that output. v3.2.0 · Oct 2026 · source · release history
  • Adds --print-filter RULES option to filter printed matches by rule name: comma-separated names to include (with + or no prefix) or exclude (with - prefix); implies --print-matches. v3.2.0 · Oct 2026 · source · release history
  • Adds -m / --print-matches flag to print matched YARA rules and strings to stdout. v3.2.0 · Oct 2026 · source · release history
  • Removes deprecated dexguard_d YARA rule. v3.2.0 · Oct 2026 · source · release history
  • New detection rule for DexProtect X packer. v3.1.0 · Apr 2026 · source · release history
  • New detection rule for BugsMirror packer. v3.1.0 · Apr 2026 · source · release history

example

  • Print every matched YARA rule and its matched strings while excluding noisy housekeeping rules like is_apk and is_signed. apkid --print-filter=-is_apk,-is_signed target.apk v3.2.0 · Oct 2026 · source
File type detection shipped Identifies specific file types and formats, including Dart-based apps, Windows DLLs, resource files, and APKiD signatures. 9 releases · 3 other sources · first seen Apr 2025

Shared capability: Static malware analysis

release 9 total

docs

  • Identifies compilers, packers, obfuscators, and other traits in Android APK/DEX files, similar to PEiD for Android.

example

  • Identify embedded ad/analytics trackers inside an APK during a mobile app review. apkid -st target.apk v3.2.0 · Oct 2026 · source
  • Scan an APK file via Docker docker/apkid.sh ~/reverse/targets/android/example/example.apk
File scanning verified suggested Scans files for matches, with control over which file types to include, how to select files for scanning, and whether to recurse into subdirectories. 1 release · 7 other sources · first seen May 2019

Suggested capability: Threat indicator matching. This is our guess, not confirmed.

release

  • Adds scan_file_obj API for programmatic scanning of file objects v2.1.1 · Nov 2020 · source · release history

command line

example

  • Scan only dex-based components to speed up analysis of known native-heavy APKs apkid --include-types dex sample.apk v2.1.1 · Nov 2020 · source
  • Scan a file object directly from code instead of passing a path apkid.scan_file_obj(file_object) v2.1.1 · Nov 2020 · source
  • Use filename-based typing for faster scanning when you trust file extensions. apkid test-data --typing filename v2.0.3 · Jun 2019 · source
  • Scan APKiD data with no typing to catch hidden files without extension-based filtering. apkid test-data --typing none v2.0.3 · Jun 2019 · source
CLI output formatting shipped Provides colorized output in the command-line interface for enhanced readability. 2 releases · 1 other source · first seen Jul 2018

Also counts toward: Command-line interface, JSON data export

release

  • Makes OutputFormatter.build_json_output method public for external use v2.0.3 · Jun 2019 · source · release history
  • Adds colorized output to the CLI interface v1.2.1 · Jul 2018 · source · release history

example

  • Combine tracker scanning with JSON output and match printing for CI pipeline ingestion. apkid -st -j -m target.apk v3.2.0 · Oct 2026 · source
Tracker scanning verified suggested Scans APKs for embedded third-party ad and analytics trackers using a database derived from Exodus Privacy. 1 release · 2 other sources · first seen Oct 2026

Suggested capability: Static malware analysis. This is our guess, not confirmed.

release

  • Adds -st / --scan-trackers flag to enable scanning APKs for embedded third-party trackers (generated from the Exodus Privacy tracker database).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ v3.2.0 · Oct 2026 · source · release history

command line

example

  • Identify embedded ad/analytics trackers inside an APK during a mobile app review. apkid -st target.apk v3.2.0 · Oct 2026 · source
Verbose logging verified Outputs debug-level log messages to aid in diagnosing scan behaviour. 1 release · 2 other sources · first seen Mar 2017

Also counts toward: JSON data export

release

  • Adds --output-dir option to write individual JSON reports to a specified directory v1.0.0 · Mar 2017 · source · release history

command line

example

  • Save each APK's analysis as a separate JSON file in a dedicated directory for automated ingestion. apkid --output-dir ./reports /path/to/app.apk v1.0.0 · Mar 2017 · source
Match output filtering verified suggested Prints matched YARA rules and strings to stdout, with optional filtering to include or exclude specific rules by name. 2 other sources · first seen Oct 2026

Suggested capability: Static malware analysis. This is our guess, not confirmed.

command line

  • --print-matches — print matched rules and strings to stdout v3.2.0 · Oct 2026 · command-line history
  • --print-filter — filter printed matches: comma-separated rule names to include ('+' or no prefix) or exclude ('-' prefix). Implies --print-matches. Use '=' when the value starts with '-', e.g. --print-filter=-is_apk,-is_signed_apk v3.2.0 · Oct 2026 · command-line history
Nested archive scanning verified suggested Scans inside compressed archives, with configurable depth for how far into nested zips the tool will go. 1 release · 1 other source · first seen May 2019

Suggested capability: Static malware analysis. This is our guess, not confirmed.

Also counts toward: Command-line interface

release

  • Supports XZ compression method when scanning ZIP/APK files, enabling analysis of APKs using non-standard compression. v3.1.0 · Apr 2026 · source · release history

command line

  • --scan-depth — how deep to go when scanning nested zips v2.0.0 · May 2019 · command-line history
Programmatic scanning interface shipped Allows scanning file objects directly from code without passing a file path. 1 other source · first seen Nov 2020

example

  • Scan a file object directly from code instead of passing a path apkid.scan_file_obj(file_object) v2.1.1 · Nov 2020 · source

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for APKiD, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail APKiD puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Coverage

Missing something? Tell us

What APKiD connects to, runs on and detects, read from its release notes and docs. So far: 3 updated detections, 2 new detections, 1 retired detection.

Show

6 changes, tracked since Oct 21, 2026.

  • Oct 212026

    new Tracker detections (Exodus Privacy)

    With trackers

    Implement trackers by @AbhiTheModder in https://github.com/rednaga/APKiD/pull/455

    v3.2.0 Source ↗

  • Oct 212026

    updated Google Pairip / Play Integrity rules

    Updated and added Google Pairip/Play Integrity Rules by @Myshtea in https://github.com/rednaga/APKiD/pull/496

    v3.2.0 Source ↗

  • Oct 212026

    updated Protectt YARA rule

    Update Protectt YARA rule with new sample and strings by @AbhiTheModder in https://github.com/rednaga/APKiD/pull/501

    v3.2.0 Source ↗

  • Oct 212026

    new Dart >= 3.13 AOT export symbols rule

    enhance: add rule for Dart >= 3.13 AOT export symbols by @hax0r31337 in https://github.com/rednaga/APKiD/pull/502

    v3.2.0 Source ↗

  • Oct 212026

    retired dexguard_d rule removed

    Remove deprecated `dexguard_d` rule by @FrenchYeti in https://github.com/rednaga/APKiD/pull/508

    v3.2.0 Source ↗

  • Oct 212026

    updated Appdome rule improvement

    improve appdome rule by @AbhiTheModder in https://github.com/rednaga/APKiD/pull/494

    v3.2.0 Source ↗

    How we count

    Read from 1 of 9 release notes and docs updates we hold for APKiD. "First seen" is the earliest note that names something; "last" is the latest. Our history may start partway through APKiD's life, so an old integration can show a recent first-seen date.

    Each change counts once: "added 40 checks" is one line, so the numbers measure how often coverage moves, not how big the catalogue is or how well it detects.

    Releases

    Show
    Coverage in all entries

    9 entries

    1. October 20261
    3. April 20261
    5. April 20251
    7. April 20221
    9. November 20201
    11. June 20191
    13. July 20181
    15. March 20171
    17. September 20161
      Show
      Coverage in all entries

      9 entries

      1. v3.2.0 Oct 21, 2026 · issue 116

        Adds -st/--scan-trackers, -m/--print-matches, and --print-filter CLI flags for tracker scanning and match output filtering.

        └──▷ GET THIS VERSION 
        $ git clone --branch v3.2.0 https://github.com/rednaga/APKiD.git
# already have the repo? check out this version:
$ git checkout v3.2.0
        • New detectionAdds -st / --scan-trackers flag to enable scanning APKs for embedded third-party trackers (generated from the Exodus Privacy tracker database).
        • Adds -m / --print-matches flag to print matched YARA rules and strings to stdout.
        • Adds --print-filter RULES option to filter printed matches by rule name: comma-separated names to include (with + or no prefix) or exclude (with - prefix); implies --print-matches.

        3 details in Everything

        └──▷ BREAKING ON UPGRADE
        • !The dexguard_d YARA rule has been removed; any workflow or downstream tooling that matches on dexguard_d results will no longer receive that output.
      2. v3.1.0 Apr 9, 2026 · release notes

        APKiD v3.1.0 adds 12+ new protector/packer detections and XZ compression support in ZIP files.

        └──▷ GET THIS VERSION 
        $ git clone --branch v3.1.0 https://github.com/rednaga/APKiD.git
# already have the repo? check out this version:
$ git checkout v3.1.0
        • New detection rule for ResGuard resource obfuscation tool.
        • New detection rule for BugsMirror packer.
        • New detection rule for StringFog string encryption tool.
        • New detection rule for BShield protector.
        • New detection rules for Manxi Sec protector.
        +10 more show less
        • New detection rule for DexProtect X packer.
        • New detection rule for Denuvo mobile protection.
        • New detection rule for Alibaba Security SDK.
        • New detection rules for Bureau protector.
        • New detection rule for Venustech protector.
        • New detection rule for OPPO Protect SDK.
        • New detection rule for Haiyun protector.
        • Supports XZ compression method when scanning ZIP/APK files, enabling analysis of APKs using non-standard compression.
        • Enhanced DingXiang detection rules to identify more variants.
        • Enhanced Ijiami packer detection to cover more packer variations.

        15 details in Everything

      3. v3.0.0 Apr 24, 2025 · release notes

        APKiD v3.0.0 adds DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls., Dart, and resource file-type detection plus expanded rules across 37 Android packers and protectors.

        └──▷ GET THIS VERSION 
        $ git clone --branch v3.0.0 https://github.com/rednaga/APKiD.git
# already have the repo? check out this version:
$ git checkout v3.0.0
        • Adds DLL, is_dart, and res file-type detection, enabling APKiD to identify Dart-based apps, Windows DLLs, and resource files.
        • Extends APK signature detection in is_signed_apk to cover V2+ signing block signatures.
        • Adds or improves detection rules for 37 packers, protectors, and SDKs including Zimperium zShield/zDefend/z9/zCloud, DexGuard 9.x, DexProtector (new DPLF header), Tencent Legu VMP, QuarksLab Shield (Epona) whitebox crypto, NHNent/NProtect AppGuard, Arxan (DEX), BlackObfuscator, DPT Shell Protector, MT Protector (DEX/RES), FreeRASP (Talsec) Dart, and more.
        • Adds Appdome detection for ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. Aarch64 binaries.
        • Updates R8 compiler map list and enhances R8 compiler detection.
        +1 more show less
        • Updates Dockerfile to Python 3.11 with script argument support.

        6 details in Everything

      4. v2.1.3 Apr 6, 2022 · release notes

        APKiD v2.1.3 adds detection rules for AliPay, ApkEncryptor, DexGuard and more.

        └──▷ GET THIS VERSION 
        $ git clone --branch v2.1.3 https://github.com/rednaga/APKiD.git
# already have the repo? check out this version:
$ git checkout v2.1.3
        • Adds or improves detections for AliPay, ApkEncryptor, APKProtect, AppGuard, CrackProof, DexGuard, DexProtector, Hikari, JsonPacker, Ollvm, Promon Shield, and Tencent Legu.

        1 detail in Everything

      5. v2.1.1 Nov 12, 2020 · release notes

        APKiD v2.1.1 adds --include-types filtering, scan_file_obj API, AppSuit/SafeEngine detections, and Docker optimizations.

        └──▷ GET THIS VERSION 
        $ git clone --branch v2.1.1 https://github.com/rednaga/APKiD.git
# already have the repo? check out this version:
$ git checkout v2.1.1
        └──▷ TRY IT
        Scan only dex-based components to speed up analysis of known native-heavy APKs
        $ apkid --include-types dex sample.apk
        Scan a file object directly from code instead of passing a path
        python 
        apkid.scan_file_obj(file_object)
        • Adds --include-types CLI option to filter which analysis types are included in the scan
        • Adds scan_file_obj API for programmatic scanning of file objects
        • Adds AppSuit detection capability
        • Adds SafeEngine detection capability

        4 details in Everything

      6. v2.0.3 Jun 1, 2019 · release notes

        APKiD v2.0.3 adds --typing control and makes output formatter public

        └──▷ GET THIS VERSION 
        $ git clone --branch v2.0.3 https://github.com/rednaga/APKiD.git
# already have the repo? check out this version:
$ git checkout v2.0.3
        └──▷ TRY IT
        Use filename-based typing for faster scanning when you trust file extensions.
        $ apkid test-data --typing filename
        Scan APKiD data with no typing to catch hidden files without extension-based filtering.
        $ apkid test-data --typing none
        • Makes OutputFormatter.build_json_output method public for external use

        1 detail in Everything

      7. v1.2.1 Jul 14, 2018 · release notes

        APKiD v1.2.1 adds detection for new native/DEX obfuscators and packers plus colorized CLI output.

        └──▷ GET THIS VERSION 
        $ git clone --branch v1.2.1 https://github.com/rednaga/APKiD.git
# already have the repo? check out this version:
$ git checkout v1.2.1
        • Adds colorized output to the CLI interface
        • Adds detection rules for Obfuscator-LLVM (v3.4, v3.5, v3.6.1, v4.0, v6.0)
        • Adds detection rules for Firehash and AVDobfuscator obfuscators
        • Adds detection rules for Promon Shield and UPX native packers
        • Adds detection rules for Bangcle SecShell and AppGuard native packers
        +2 more show less
        • Adds detection rules for Allatori demo, Arxan, and DexProtector DEX obfuscators
        • Adds detection rules for ApkPacker, CryptoShell, ApkGuard, Jiagu, and ChornClickers DEX packers

        7 details in Everything

      8. v1.0.0 Mar 10, 2017 · release notes

        APKiD v1.0.0 adds --output-dir for individual JSON files and new YARA rules for Jack, anti-VM, SecNeo, and DxShield.

        └──▷ GET THIS VERSION 
        $ git clone --branch v1.0.0 https://github.com/rednaga/APKiD.git
# already have the repo? check out this version:
$ git checkout v1.0.0
        └──▷ USE IT
        Save each APK's analysis as a separate JSON file in a dedicated directory for automated ingestion.
        shell 
        apkid --output-dir ./reports /path/to/app.apk
        • Adds --output-dir option to write individual JSON reports to a specified directory
        • Adds detection rules for the Jack compiler
        • Adds detection rules for anti-vm techniques
        • Adds detection rules for SecNeo obfuscation
        • Adds detection rules for DxShield obfuscation

        5 details in Everything

      9. v0.9.4 Sep 26, 2016 · release notes

        APKiD v0.9.4 adds PangXie and DexProtector detection rules

        └──▷ GET THIS VERSION 
        $ git clone --branch v0.9.4 https://github.com/rednaga/APKiD.git
# already have the repo? check out this version:
$ git checkout v0.9.4
        • Added PangXie packer detection rules via updated Yara signatures
        • Added DexProtector obfuscator detection rules via updated Yara signatures

        2 details in Everything

      Project health

      Issue, contributor and maintainer activity in rednaga/APKiD, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

      1. Contributors 4 −2 vs prior 12 months
      2. Maintainers 1 +0 joined · −1 left, last 12 months
      3. Bus factor 1 committers behind half the commits
      4. Community-filed 79% of issues opened, last 12 months
      5. Median time to close 4.8 days first maintainer reply 3.3 days
      6. Open backlog 83 of 293 issues ever filed
      1. Issues opened / month 0 · 0 communitymaintainers
      2. Open backlog 83
      3. Contributors / month 1
      4. Commits / month 2
      5. Stars 2,574
      Issue themes, last 12 months
      • other 100%

      Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

      Add the badge to your README

      Maintain this project? The badge links readers straight to this page, so they can follow every release here.

      Tracked by Cyber Toolchain Choose a badge style and copy the code →
      compare.md

        Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

        my-toolchain — 0 tools

          Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
          browse all tools → score card for your toolchain →
          cyber-toolchain / feedback

          Send us feedback