Check what is actually inside an Android package.
Upload an APK and get the manifest, every library with the version the package records for it, the file inventory, the native libraries and the signing certificate. Nothing is estimated: each line names the file it came from.
Uploading needs an account; a free one is enough.
Uploading more than one file
Play ships app bundles, so an installed app is usually a base APK plus
split_config.* files. Upload them together and they are merged into
one report - that is what the device runs. A base APK on its own under-reports:
the native libraries live in the ABI split.
An XAPK, .apks or .apkm is that set already packed into
one file. Upload it whole. Anything else it carries, such as OBB data, is listed
with its size.
APKs from different apps in one upload are grouped by package name and each gets its own report.
What gets read
- Manifest
- Decoded to readable XML, plus components, intent filters, deep links, permissions and the network security config
- Libraries
- Every package in the DEX, with the version the APK records and the file that records it
- Files
- The archive inventory: size by category, largest entries, duplicated content, alignment
- Native
- Architecture, what each library links against, 16 KB page readiness, embedded versions
- Signing
- Certificate subject, validity, key, fingerprint and which schemes are present
Nothing is executed. What the code does at runtime is outside what a package can be read for.