Repository navigation
Home
AndroSpecter is a Java library that wraps Soot and FlowDroid for Android call-graph construction, code inspection, taint analysis, and instrumentation. Embed the library in your application or use the separate command-line tool for metadata, inspection, graphs, and taint analysis.
This wiki describes AndroSpecter 2.0.0, using Java 17 or later, Soot 4.7.1, and FlowDroid 2.15.1. Version 2.0.0 is prepared for release; publication has not completed. Build and install it locally until it is available from Maven Central. See Getting started.
| I want to… | Read |
|---|---|
| Install the library and run a complete example | Getting started |
| Analyze an APK or query a saved graph from the terminal | Command-line tool |
| Open and close an analysis safely | Analysis sessions |
| Read manifest components, permissions, and SDK attributes without Soot | APK metadata |
| Query reachability and shortest paths or inspect selected code | Call graphs and inspection |
| Save, reload, visualize, or compare graphs | Graph export and comparison |
| Configure sources/sinks and export structured findings | Taint analysis |
| Insert logging probes and combine transformations | Instrumentation |
| Control deadlines, cancellation, CLI parsing, and logging | Cancellation and logging |
| Upgrade an existing integration or investigate an error | Migration and troubleshooting |
The repository contains eight runnable examples
with their own Maven project. Start with InspectApk, or use PrintApkInfo for
metadata without an SDK. InspectClasses defers graph construction; ExportGraph
and GraphQueries support saved graphs. AnalyzeTaint, InstrumentInMemory, and
CancelAnalysis demonstrate the other analysis workflows.
Public methods have Javadoc describing parameters, return values, failure behavior, and lifecycle constraints. Generate the reference locally using the command in Getting started.
Existing integrations can continue to use FlowdroidUtils, SootUtils, and the other utility pages listed in the sidebar. Pages for older singleton workflows explain their current behavior and point to the instance APIs. AndroZooUtils, RedisManager, and AndroidAppsProcessor are optional supporting tools; they are not prerequisites for analyzing a local APK.
Maintainers can use the release guide
for Central Publisher Portal setup, local packaging checks, and automatic
publication with mvn clean deploy -P release. Updating this documentation does
not publish the artifact.