Botanist is a program to determine the tools that were used to produce an Android Application Package binary. These include IDE's, packers, compilers, and libraries. The program is split into two parts: creating a set of signatures for a given apk and then integrating that data into the stored collection.

The name Botanist was chosen for several attributes.

1. Brevity
2. Relevance to categorization
3. Homage to growing software

Ideally, these clusters will be graphically displayed and tools can be viewed along with variations that exist in the wild. The main function takes in an APK and says what tools were used, if previously seen. This project assumes data on several instances and the ability to store instances for future reference.

If the user's intent is to store lots of APK's and do analyses via a service, go to the readme in the webservice directory.

Botanist uses:

• Androguard - https://github.com/androguard/androguard/releases/tag/v2.0
• r2pipe - pip install r2pipe
• elftools - pip install pyelftools
• MySQL OR MongoDB
• python-mysql OR pymongo - pip install python_driver

1. APKInfo - contains apk name, architecture, shared object files, and the library signatures
2. LibSO - contains information on the shared object file, including a signature
3. Classifying - provides means for creating relationships between entities

1. ElfTagger.py - continues by dumping the .so files, finding the first call into the library after the System.loadLibrary call, and creates a signature based on the opcodes of the initializing method.

1. MongoController
2. MySQLController

1. sudo python setup.py install

1. python bulk_test.py {{APK_DIR}}

1. TO BE FINISHED: python bottools/scripts/ElfTagger.py -f test/Xamarin/com.revengdroid.XamarinHelloWorld.apk | python bottools/control/MongoController.py -a