SyscallX-18113/Apkx-Hunter

What it is

APKX-Hunter v2.7.2, a C-based (5,800+ lines) Android static analysis CLI. The catalog summary covers its analysis surface; what it omits is that this is a Linux-only tool (Windows and macOS explicitly unsupported), distributed as a Debian package, with a flag-ordering CLI that the reader needs before running it.

Preconditions / Affected

• Linux only. Minimum 4 GB RAM; recommended 8 GB+, quad-core, SSD.
• External dependencies: JADX, APKTool, Java, unzip. A built-in --install-dependencies flag fetches these automatically.
• Apache 2.0. Maintained solely by the author (Devesh Kachhawaha); external code contributions are not accepted, though bug/security reports are.

What to do

Install and run dependencies:

sudo dpkg -i apkx-hunter_2.7.2-1_amd64.deb
apkxhunter --install-dependencies

Invocation form is apkxhunter <package/folder> [options], and flag order matters — the target comes first, then a scan mode, then optional filters. Examples verbatim from the page:

apkxhunter app.apk --fast
apkxhunter app.apk --deep
apkxhunter app.apk --apktool
apkxhunter Apks --multi-apk
apkxhunter test.apkm --extract-multi-apk
apkxhunter <folder_name> --folder-scan
apkxhunter app.apk --deep --secrets
apkxhunter app.apk --deep --masvs
apkxhunter Apks_folder --deep --multi-apk --secrets
apkxhunter app.apk --deep --decompile
apkxhunter app.apkm --extract

Scan a directory already decompiled by JADX (--folder-scan) or APKTool (--apktool-folder-scan) to skip re-decompilation. Results land in prefixed directories (e.g. Result_Jadx_output_<apk>/) split into secrets_findings.txt, permissions.txt, pattern_findings.txt (JADX) / endpoint_findings.txt (APKTool), files.txt, native_library_files.txt, masvs_findings.txt.

Caveats

• The "ML" is a statistical classifier, not an LLM or deep-learning model — model.bin is trained numerical weights only (no code, loaded as data). It scores secret confidence from token features (entropy, character distribution, length, case/digit/symbol ratios) and runs fully offline. It assists triage, not replaces manual verification.
• The page cites 160+ patterns / 14+ categories in one place and 166 / 15 elsewhere — treat the count as approximate.
• The UnCrackable Level 4 result is the author's own development-time test, not independent validation.
• False-positive reduction, severity tiering (Critical/High/Medium), and per-line evidence are stated as planned for the next release, not current behavior.