AwesomeREA.org

Tool

Quark-Engine

Rule-based engine for analysing suspicious Android apps: it loads an APK's Dalvik bytecode and checks JSON behaviour rules, each naming permissions and a pair of framework API calls, through five confidence stages, from the permission being requested and either API being called up to both calls appearing in order in one method and passing the same register. Weighted rule matches produce a threat score, with summary, detail, JSON, web, call-graph and label reports, and Quark Script exposes the analysis as a Python API that the project presents for finding vulnerabilities. The repository also ships two Claude Code skills, for running an analysis and generating a rule, and an optional LangChain agent that uses the OpenAI API.

Requirements & limits

  • Latest release at review: v26.10.1, published on GitHub and PyPI on 2026-10-10 and requiring Python 3.10+. The reviewed master commit of 2026-10-17 differs from it only by an added malware-family report in the documentation.
  • Install from PyPI, or from source with Pipenv, then run freshquark, which git-clones the separate quark-rules repository into a .quark-engine folder in the user's home directory; this review did not examine that rule set. dextrace is the default core library, with Androguard 4.1.4 pinned, rizin and radare2 backends through optional extras plus the native tools, and a Shuriken backend; call graphs need Graphviz. The Quark Agent needs an OpenAI API key, and the Claude Code skills need Claude Code with Quark installed.
  • Input is one APK per run; the documentation scans directories with a shell loop or the Python API. Reports are static rule matches whose confidence counts the stages a rule passes, so coverage depends on the rule set; setup.py calls Quark an obfuscation-neglect scoring system, a resilience this review did not test. Suspicious samples belong in an isolated analysis environment, and the test suite downloads live malware and deliberately vulnerable APKs from a separate sample repository that this record does not link.
  • CI builds rizin 0.7.3 and radare2 5.9.0 and runs pytest with coverage on Python 3.10. The malware-family reports in the documentation are project analyses, not reproduced here. GPL-3.0 per LICENSE and the setup.py classifier. No APKs were analysed for this entry, and the reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Android tools
Relationship
Foundation tool
Targets
App

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · ev-flow/quark-engine · Revision 7accc95
  2. docs/source/index.rst GitHub · ev-flow/quark-engine · Revision 7accc95
  3. docs/source/install.rst GitHub · ev-flow/quark-engine · Revision 7accc95
  4. docs/source/integration.rst GitHub · ev-flow/quark-engine · Revision 7accc95
  5. quark/core/quark.py GitHub · ev-flow/quark-engine · Revision 7accc95
  6. quark/rules/sendLocation_SMS.json GitHub · ev-flow/quark-engine · Revision 7accc95
  7. quark/freshquark.py GitHub · ev-flow/quark-engine · Revision 7accc95
  8. setup.py GitHub · ev-flow/quark-engine · Revision 7accc95
  9. quark-ai-plugin/README.md GitHub · ev-flow/quark-engine · Revision 7accc95
  10. quark/agent/quarkAgent.py GitHub · ev-flow/quark-engine · Revision 7accc95
  11. .github/workflows/pytest.yml GitHub · ev-flow/quark-engine · Revision 7accc95
  12. LICENSE GitHub · ev-flow/quark-engine · Revision 7accc95
  13. https://github.com/ev-flow/quark-engine/releases/tag/v26.10.1
  14. https://pypi.org/project/quark-engine/26.10.1/

More in Apps

All 100 entries in Apps