APKiD — authorized Android packer/protector identification
APKiD (rednaga/APKiD) is an Android Application Identifier for packers, protectors, obfuscators and oddities. Release v3.2.0 (2026-10-21 UTC) was the latest checked on 2026-10-24. Treat hits as labels, not automatic unpack recipes. Analyze only APKs/DEX you are authorized to examine.
Snapshot
| Field | Value |
|---|---|
| License | GPL & Commercial (PyPI wording; read tree LICENSE) |
| Latest checked | v3.2.0 (2026-10-21 UTC) |
| Job | YARA-based packer/protector/compiler identification |
| Stars (order of magnitude) | ~2.6k on GitHub (counts change daily) |
| Peers | DIE, Androguard, jadx |
Allowed framing
- Labeling protectors on your lab APKs before deeper jadx work.
- IR triage notes that record “which packer family was reported.”
- Classroom demos with owned or public research samples under policy.
Scope we will not cover
- No unpacker / crypto-unpack cookbooks.
- No Play Integrity, RASP or DRM bypass recipes.
- No guidance to strip licensing from commercial apps.
Beginner path (authorized only)
- Prefer a disposable lab VM; keep APKs next to case hashes.
- Install from official rednaga/APKiD Releases or the matching PyPI wheel; pin 3.2.0 deliberately.
- Run APKiD on a tiny APK you built, then on ticketed samples.
- Record rule hits beside SHA-256; confirm interesting labels in jadx/Androguard.
- Never treat a packer name as permission to bypass a protector.
- Use APKiD to identify Android packers/protectors on authorized packages.
- Prefer jadx/Androguard for code/structure follow-up.
- Refuse unpacker and bypass cookbooks.
For legal, authorized and educational use only.
FAQ
What is APKiD?
APKiD is often described as “PEiD for Android” — a YARA-driven identifier that reports compilers, packers, protectors, obfuscators and other oddities observed in APK/DEX samples.
Which version is cited?
v3.2.0 (“Halloween” edition) published 2026-10-21 UTC on rednaga/APKiD Releases; PyPI apkid 3.2.0 matches (checked 2026-10-24).
What license applies?
PyPI lists “GPL & Commercial”; GitHub SPDX shows NOASSERTION. Read the LICENSE files in the exact tree or wheel you pin before redistribution.
DIE/Androguard or APKiD?
Prefer Detect It Easy for multi-format file ID. Prefer Androguard for scriptable APK/DEX structure. Prefer APKiD when you want Android-focused packer/protector YARA hits on authorized packages.
Does this teach unpacking or bypassing protectors?
No. Identification and education only — BinBench will not supply unpacker, DRM, Play Integrity or license-check bypass recipes.