Tool
XAPKDetector
APK and DEX detector from hors, the author of Detect-It-Easy, that reports the build tools, libraries and protections it identifies in Android packages, using scan engines and signature databases from the Detect-It-Easy family. The Qt GUI also shows AndroidManifest.xml, MANIFEST.MF, DEX and ELF contents, strings, hex, entropy, hashes and the APK signature, and can scan whole directories. A console build runs recursive, deep, heuristic or all-types scans and writes XML, JSON, CSV or TSV results.
Requirements & limits
- Latest release at review: 0.03, published 2022-03-14, with Windows portable zips (including a Windows XP build), macOS packages including a Qt 6 build, a Linux AppImage and Debian and Ubuntu packages; release_version.txt still reads 0.03. The master branch was still receiving submodule updates at review, such as new Detect-It-Easy signatures on 2026-10-19, so the source is ahead of the released binaries.
- Building needs a recursive clone of 55 git submodules from the author's other repositories, including Formats, XDEX, SpecAbstract, the signatures database and Detect-It-Easy, plus Qt. docs/BUILD.md covers Docker, a Debian package build tested on Ubuntu 14.04 to 20.04, autotools and CMake, macOS with Qt 5.15.2, and Windows with Visual Studio 2019 and Qt 5.15.2 or, for Windows XP, Visual Studio 2013 and Qt 5.6.3.
- Input is APK, APKS or DEX files the analyst already has; the changelog adds APKS support in 0.03. Detections are signature and heuristic identifications for analyst confirmation, not proof of how an app was built or protected. The repository itself contains no tests or CI workflows.
- MIT license, copyright 2020-2026 hors; the submodules are separate repositories whose licenses were not reviewed individually. No package was scanned and nothing was built.
About this entry
- Type
- Tool
- Category
- Android tools
- Relationship
- Foundation tool
- Targets
- App
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · horsicq/XAPKDetector · Revision 09ce272
- docs/BUILD.md GitHub · horsicq/XAPKDetector · Revision 09ce272
- docs/RUN.md GitHub · horsicq/XAPKDetector · Revision 09ce272
- changelog.txt GitHub · horsicq/XAPKDetector · Revision 09ce272
- .gitmodules GitHub · horsicq/XAPKDetector · Revision 09ce272
- console_source/main_console.cpp GitHub · horsicq/XAPKDetector · Revision 09ce272
- gui_source/guimainwindow.ui GitHub · horsicq/XAPKDetector · Revision 09ce272
- LICENSE GitHub · horsicq/XAPKDetector · Revision 09ce272
- https://github.com/horsicq/XAPKDetector/releases/tag/0.03
More in Apps
- Aegis: trace a login-code calculation · Case study
- Notion: trace the clipboard bridge · Case study
- PicoPrint: LX-D02 printer investigation · Case study
- ReaCut: video-editor reconstruction · Case study
- CF632BLE: a local client from scale-protocol research · Case study
- zee-rp: reconstructing supported Axure RP 11 document operations · Case study