{"id":19832045,"url":"https://github.com/ail-project/ail-feeder-apk","last_synced_at":"2025-08-22T14:12:31.579Z","repository":{"id":118130516,"uuid":"530674373","full_name":"ail-project/ail-feeder-apk","owner":"ail-project","description":"This AIL feeder pushes annotated APK to an AIL instance","archived":false,"fork":false,"pushed_at":"2022-10-25T14:19:33.000Z","size":74,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-02-28T21:28:58.184Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ail-project.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-30T13:40:20.000Z","updated_at":"2025-02-21T15:55:26.000Z","dependencies_parsed_at":null,"dependency_job_id":"e5e07001-65bc-40fd-af2a-6ffae1198bbe","html_url":"https://github.com/ail-project/ail-feeder-apk","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ail-project/ail-feeder-apk","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ail-project%2Fail-feeder-apk","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ail-project%2Fail-feeder-apk/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ail-project%2Fail-feeder-apk/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ail-project%2Fail-feeder-apk/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ail-project","download_url":"https://codeload.github.com/ail-project/ail-feeder-apk/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ail-project%2Fail-feeder-apk/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":271650860,"owners_count":24796725,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-22T02:00:08.480Z","response_time":65,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T11:36:09.200Z","updated_at":"2025-08-22T14:12:31.518Z","avatar_url":"https://github.com/ail-project.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ail-feeder-apk\nThis AIL feeder pushes annotated APK to an AIL instance for yara detection.\n\n# Concepts and Workflow\n\nIt goes something like this:\n\n```mermaid\nflowchart TD\n    scraping_play_store --\u003e id1\n    id1--\u003edownloading--\u003e id4\n    id1--\u003eanalysis_baselining\n    id4--\u003eanalysis_baselining --\u003e id3\n    analysis_baselining --\u003e id5\n    id4--\u003eanalysis_hunting --\u003e id2\n    id1--\u003eanalysis_hunting\n    id5--\u003eid6\n    id2--\u003eail-feeder-apk--\u003eid6\n    id1[(scrap)]\n    id2[(hunt)]\n    id3[(baseline)]\n    id5[(images.bloom)]\n    id4[(raccoon)]\n    id6[(AIL)]\n```\n\n1. fill out `etc/ail-feeder-apk.cfg` to define which keywords to search for, what developper certificates are trusted, AIL credentials, raccoon installation, etc.\n2. use `bin/scrap_playstore.py` to scrap the applications on the playstore that correspond to your keywords - the results are placed into the `scrap` lmdb,\n3. use `bin/download_apks.py` to download/update all the .apk files through `raccoon` - the resulting files are placed in `raccoon` home folder,\n4. use `bin/analysis.py baselining` to create the baseline - the resulting bloom filter is `images.bloom` by default, and a `baseline` lmdb,\n5. use `bin/analysis.py hunting` to create the `hunt` lmdb,\n6. use `bin/feeder-apk.py` to push the content of the `hunt` lmdb to the AIL instance.\n7. The AIL instance receive `json` annotation regarding the APK, and run the corresponding `YARA` rules against these files.\n\nfor instance:\n```\nimport \"androguard\"\n\nrule andro_fleur\n{\n    condition:\n        androguard.image(0) == 1\n}\n```\n8. `bin/analysis.py hunting \u003csome.apk\u003e` can be used to add an local apk file to the `hunt` lmdb.\n\n# Requirements\nThis feeder has several requirements for the AIL instances to treat its input correctly:\n\n- an AIL instance using a yara version compiled with `androfleur` support:\n  - [androfleur](https://github.com/gallypette/androguard-yara/tree/androfleur) is a modified version of [androguard-yara](https://github.com/gallypette/androguard-yara) module that supports lookup into DCSO bloom filter files.\n  - an AIL fork with the correct yara version is available here: https://github.com/gallypette/ail-framework/tree/custoyara\n\n- raccoon 4 needs to be installed and configured to use a google account, see https://raccoon.onyxbits.de/documentation/\n\n# Remarks and Future Works\n\n- At the moment the tool produces way too many false positive `androfleur` should return a match count instead of success/failure. This would allow for yara rules to trigger only above a threashold.\n- databases of known files could be queried (or their filters) to filter out false positives.\n- the tool could mine playstore comments and score for threat detection.\n- additional an dex decompilation step can produce intereseting detection means.\n\n# Acknowledgment\n\n![](./img/cef.png)\n\nThe project has been co-funded by CEF-TC-2020-2 - 2020-EU-IA-0260 - JTAN - Joint Threat Analysis Network.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fail-project%2Fail-feeder-apk","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fail-project%2Fail-feeder-apk","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fail-project%2Fail-feeder-apk/lists"}