QARK: Android App Exploit and SCA Tool
summary
A command-line tool called Quick Android Review Kit performs static code analysis plus source-to-sink tracing, runs multiple decompilers to recover Java (reporting 85% recovery of corrupt files), maps manifest-declared entry points, and builds custom exploit APKs on the fly that exercise exported components and webview POCs; it instruments the Android SDK, outputs copy‑paste adb commands, offers headless mode and HTML reports, and automates both detection and proof‑of‑concept exploitation.
AI-written summary · about
chapters (19)
- 0:00Start
- 1:22QARK's Mission
- 3:22Android Issues
- 7:37Motivation
- 10:54What's Under the Hood
- 12:02APK Structure
- 13:29Reversing APKs
- 14:18Acquisition
- 15:21Communication
- 16:41Components
- 18:23Parse Structure
- 19:18Source to Sink
- 19:48QARK Checks
- 21:09Demo Time
- 44:24Unique Features
- 46:09Future Plans
- 46:52Acknowledgements
- 47:32Contact Info
- 47:49Where to get QARK
related talks
44mAuditing Your APKs Like a Black Hat Hacker
28mDevSecOps: Balancing development and security
49mAll Your Code Belongs To Us (Dismantling Android Secrets With CodeInspect)
38mBreak your App before Someone Else Does
47mAttacking Android Applications
29mA day in the life of a mobile reverse engineer
32mApp-etite for Destruction: a look into the cookbook of an attacker
30mA day in the life of a mobile reverse engineer