Botanist is a program to determine the tools that were used to produce an Android Application Package binary. These include IDE's, packers, compilers, and libraries. The program is split into two parts: creating a set of signatures for a given apk and then integrating that data into the stored collection.

The name Botanist was chosen for several attributes.

1. Brevity
2. Relevance to categorization
3. Homage to growing software

Ideally, these clusters will be graphically displayed and tools can be viewed along with variations that exist in the wild. The main function takes in an APK and says what tools were used, if previously seen. This project assumes data on several instances and the ability to store instances for future reference.

Botanist uses:

• Androguard, currently using stable release v2.0 aka version 3.0, for apk/dex analysis
• radare2 python bindings for elf analysis
• MySQL for non-volatile storage of clusters
• python-mysql for interaction with past instances and storing purposes

1. APKInfo - contains apk name, architecture, shared object files, and the library signatures
2. SOFile - contains information on the shared object file
3. ToolSig - contains a signature of a particular dynamic library, the name of that library, and the name of the APK
4. Controller.py - adds signatures to the db if doesn't already exist and assigns a cluster

1. Tagging - creates the set of signatures. A simple dex signature can be made using DexTagger.py. However, this does not capture as much information as the first method called in the dynamically-loaded library. ElfTagger.py continues by dumping the .so files, finding the first call into the library after the System.loadLibrary call, and creates a signature based on the first 40 opcodes of the initializing method.
2. Classifying - provides the interface between the Tagger and Controller

initial test | | | |

1. sudo python setup.py install
2. python bottools/tag/ElfTagger.py -f test/Xamarin/com.revengdroid.XamarinHelloWorld.apk | python bottools/classify/Classifier.py -u {USERNAME} -p {PASSWORD}