PulseAPK Core GUI workflow for APK decompilation, Smali rule...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/deemoun/PulseAPK-Core
• Blog Title: PulseAPK Core: GUI workflow for APK decompilation, Smali rule-based analysis, rebuild, and signing
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (new subsection: "Smali static analysis / rule-based hunting" or add under existing "Smali - Decompiling, Modifying, Compiling" with a section on regex+context heuristics for root/emulator/secret detection)

🎯 Content Summary

What this repository is
PulseAPK Core is an open-source, cross-platform GUI built with Avalonia on .NET 8 that orchestrates a typical Android reverse-engineering workflow: APK decompile → static analysis on Smali → rebuild → optional signing. It is a hacking / reverse-engineering tool (not a CVE write-up) whose security value is operational: it helps analysts quickly locate anti-analysis logic (root/emulator detection) and potential sensitive-data issues (e...

🔧 Technical Details

Rule-driven Smali hunting: After decompiling an APK with apktool, scan Smali line-by-line with regex rules that match suspicious API usage/strings (e.g., Runtime.getRuntime().exec("su"), root package names, emulator system properties like ro.kernel.qemu, emulator fingerprints/brands/models). Reduce false positives by adding lightweight context requirements ("within N lines" of checks such as File;->exists, PackageManager;->getPackageInfo, or string comparisons like ->equals/->contains/->startsWith).

Noise suppression by namespace: Mark or suppress matches in common third-party library prefixes (e.g., Landroidx/, Lkotlin/, Lcom/google/, Lokhttp3/) so reports focus on app-owned code paths, which is typically where anti-analysis logic and embedded secrets are actionable.

Hardcoded-secret proximity heuristic: Identif...

🤖 Agent Actions

Summary
Updated src/mobile-pentesting/android-app-pentesting/smali-changes.md with a new “Smali Static Analysis / Rule-Based Hunting” section capturing rule-driven Smali scanning, library filtering, and context-based heuristics, plus added PulseAPK references.

Tests
Not run (documentation-only change).

Next Steps

1. Review the new section for tone/placement; I can adjust or expand with more rule examples if needed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/deemoun/PulseAPK-Core

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (new subsection: "Smali static analysis / rule-based hunting" or add under existing "Smali - Decompiling, Modifying, Compiling" with a section on regex+context heuristics for root/emulator/secret detection)".

Repository Maintenance:

• MD Files Formatting: 954 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0