AndroZooUtils

AndroZooUtils

com.jordansamhi.androspecter.AndroZooUtils downloads an APK by its SHA-256 using a caller-supplied AndroZoo API key. It is optional: local APK analysis does not require an AndroZoo account.

Place the imports at the top of your source file; the rest is a method-body snippet that may throw IOException while creating the download directory. Supply your own key through the environment and a real SHA-256 value:

import com.jordansamhi.androspecter.AndroZooUtils;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.Objects;

String apiKey = Objects.requireNonNull(System.getenv("ANDROZOO_API_KEY"));
String sha256 = Objects.requireNonNull(System.getenv("APK_SHA256"));
Path downloads = Files.createDirectories(Path.of("downloads"));
AndroZooUtils downloader = new AndroZooUtils(apiKey, downloads.toString());
String apkPath = downloader.getApk(sha256);
if (apkPath == null) {
    throw new IllegalStateException("APK download failed; inspect the application logs");
}
System.out.println(apkPath);

getApk expects 64 hexadecimal characters. It returns a local path or null on failure, including invalid input, interruption, HTTP errors, and unusable output locations. It logs failures through the caller's logging setup. The directory must already exist and be writable.

Downloads use finite connection/read timeouts and a temporary file, cleaning up partial downloads on failure. An existing nonempty readable destination is reused; it is not rehashed to verify its contents. The returned APK belongs to the caller. When used by AndroidAppsProcessor, it is deleted after processing, so use a dedicated worker download directory.

new AndroZooUtils(apiKey) uses the JVM temporary directory. It is not a no-argument constructor. See Analysis sessions to analyze the resulting path.