<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing Mobile Malware

## Android Analysis Tools

| Tool | Command | Description |
|---|---|---|
| apktool | `apktool d sample.apk -o output/` | Decode APK resources and manifest |
| jadx | `jadx -d output/ sample.apk` | Decompile DEX to Java source |
| apksigner | `apksigner verify --print-certs sample.apk` | Verify APK signing certificate |
| aapt2 | `aapt2 dump badging sample.apk` | Dump APK package info |
| androguard | `androguard analyze sample.apk` | Python-based APK analysis |

## Frida Commands

| Command | Description |
|---|---|
| `frida -U -f <package> -l script.js` | Spawn and hook app |
| `frida-trace -U -f <package> -j 'class!method'` | Trace method calls |
| `frida-ps -U` | List processes on USB device |
| `frida-ls-devices` | List connected devices |

## iOS Analysis Tools

| Tool | Command | Description |
|---|---|---|
| otool | `otool -L binary` | List linked libraries |
| class-dump | `class-dump binary` | Dump ObjC class headers |
| codesign | `codesign -d --entitlements :- app.app` | Extract entitlements |
| strings | `strings binary` | Extract embedded strings |

## Agent Script

```bash
# Triage APK — hashes, components, size
node agent.js triage sample.apk

# Extract and categorize permissions
node agent.js permissions sample.apk

# Extract suspicious strings (URLs, IPs, crypto)
node agent.js strings sample.apk

# Check signing certificate
node agent.js signing sample.apk
```
