How can I reliably locate a list of imports/packages/sdks that were used in an app?

[ddxv]

After decompiling the app, I'm looking / grepping / exploring and have not yet figured out how to reliably determine a list of imported packages.

My original motivation was that I wanted a list of all libraries or SDKs being used by an app. So far I have found a few options:

1. unzipped/apktool.yml: unknownFiles: This list contains many SDKs that were likely compiled with secrets like ad networks and trackers, so this list is pretty useful already.

2. unzipped/apktool.yml: doNotCompress: This also has some of the libraries I would expect to see as well as many of the standard ones.

3. unzipped/smali/* This is much less reliable for me. For simple android apps it seems to work ok. But for Android games, built with other things like Unity there are many random directories in it like a1 a2 u u0 etc

Does anyone have any other recommended ways to programmatically get imported external libraries?

[iBotPeaches]

You could run like MobSF over the application - https://github.com/MobSF/Mobile-Security-Framework-MobSF. It has a bunch of heuristics and pattern matching to look for shared objects, strings, etc.

ApkiD is cool, but I don't think it fits your criteria. Its more so for looking how an application was built, not really the dependencies of it - https://github.com/rednaga/APKiD

[ddxv]

Thanks!