AwesomeREA.org

Tool

Appshark

ByteDance's static taint-analysis engine for Android APKs, designed for very large apps, that scans an app against JSON rules naming entry methods, sources, sinks and sanitizers as Jimple signatures, for vulnerability and privacy-compliance review. It works on Soot's Jimple IR and reuses FlowDroid's manifest and resource parsing, but implements its own field-sensitive pointer and taint analysis. Results go to results.json, which records app, component and permission information, deep links and JavaScript bridge interfaces alongside each source-to-sink path, with an HTML page per finding.

Targets
App
Category
Android tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Requires JDK 11; the README says it does not work on JDK 8 or JDK 16 because of dependency compatibility. ./gradlew build -x test produces AppShark-0.1.2-all.jar. Latest release at review: v0.1.2, published 2022-09-22 with prebuilt jars; the reviewed main commit, still versioned 0.1.2, is 123 commits ahead of it, including September 2026 commits that add scan resource budgets, a bounded jadx workspace and validation of untrusted rule graphs. The startup guide still links the v0.1.1 jar.
  • Input is the APK to analyze, named by apkPath in a JSON5 config passed to the jar, with rules taken from config/rules, which holds seven sample rules such as unZipSlip, PendingIntentMutable and ContentProviderPathTraversal. The repository bundles 18 Android SDK platform stub jars, config/tools/platforms/android-14 through android-33/android.jar (API levels 15 and 21 absent, about 18 to 47 MB each), used as the default SDK path, plus five small compiled test classes; the javaSource option runs jadx from config/tools/jadx/bin, which the repository does not include.
  • Findings are static source-to-sink paths whose coverage depends on the rules and settings: the argument guide says too short a maxPointerAnalyzeTime can cause false positives and negatives, and the FAQ shows a slice-mode entry missing an aliased path. The README's security notice limits the UI and server to local testing. Apache-2.0. No APK was analyzed.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · bytedance/appshark · Revision 487fa21
  2. doc/en/overview.md GitHub · bytedance/appshark · Revision 487fa21
  3. doc/en/how_to_write_rules.md GitHub · bytedance/appshark · Revision 487fa21
  4. doc/en/argument.md GitHub · bytedance/appshark · Revision 487fa21
  5. doc/en/result.md GitHub · bytedance/appshark · Revision 487fa21
  6. doc/en/startup.md GitHub · bytedance/appshark · Revision 487fa21
  7. doc/en/faq.md GitHub · bytedance/appshark · Revision 487fa21
  8. config/rules GitHub · bytedance/appshark · Revision 487fa21
  9. config/tools/platforms GitHub · bytedance/appshark · Revision 487fa21
  10. build.gradle.kts GitHub · bytedance/appshark · Revision 487fa21
  11. src/main/kotlin/net/bytedance/security/app/StaticAnalyzeMain.kt GitHub · bytedance/appshark · Revision 487fa21
  12. LICENSE GitHub · bytedance/appshark · Revision 487fa21
  13. https://github.com/bytedance/appshark/releases/tag/v0.1.2

More in Apps

All 136 entries in Apps