APK Static Security Analyzer

Trafexia includes a powerful built-in APK & XAPK Static Security Analysis Engine powered by apktool and jadx. It allows security researchers, developers, and reverse engineers to decompile Android applications, inspect source code, extract API endpoints, discover hardcoded secrets, and evaluate AI-based risk scores.

Key Features

Automated Decompilation: Decompiles .apk and multi-split .xapk files into Dalvik bytecode and Java source files automatically.
Package & Component Audit: Identifies Package Name, Version Name/Code, Target/Min SDK, and all Exported Activities, Services, and Receivers.
Hardcoded Secret Extraction: Automatically scans decompiled code for API Keys, AWS credentials, JWT tokens, Private Keys, and Authorization headers.
API Endpoint Discovery: Scans Java classes, Retrofit interfaces, and HTTP clients to extract external backend REST & GraphQL URLs.
Resource File Inspector: Browse, search, and preview image drawables, XML layouts, AndroidManifest, audio/video assets, and fonts directly inside the app.
AI Security Audit: Powered by LLM models to generate a 0-100 Security Audit Score, vulnerability list, and custom Frida dynamic hook scripts.
MCP Integration: Exposes analyze_apk, analyze_apk_security_ai, and chat_apk_ai tools to AI clients (Claude Desktop, Cursor, Antigravity).

How to Use the APK Analyzer

Step 1: Upload or Drag & Drop APK File

Open Trafexia Desktop and navigate to the APK Analysis tab in the sidebar.
Drag and drop any .apk or .xapk file into the upload zone, or click Browse File.
Trafexia will automatically begin extraction and decompilation.

Step 2: Inspect Analysis Tabs

Overview: View package metadata, main entry activity, permissions summary, and security score.
Endpoints: View all HTTP/HTTPS REST API URLs extracted from the Java codebase.
Services & Components: Audit exported activities and services to detect intent spoofing or unauthorized component access.
Permissions: View requested Android permissions. High-risk permissions (e.g. READ_SMS, SYSTEM_ALERT_WINDOW, CAMERA) are highlighted in red.
Hardcoded Secrets: Inspect extracted API keys, tokens, and hardcoded credentials with source file references.
Third-Party SDKs: View detected libraries (Firebase, Adjust, AppsFlyer, Retrofit, OkHttp, Realm, etc.).
Resources: Browse layout XMLs, images, fonts, and assets with built-in preview pane.

AI Security Score & Frida Script Generation

Under the AI Security Analysis tab:

Click Start AI Analysis.
AI evaluates the extracted components and generates an overall Security Audit Score (0-100) along with remediation recommendations.
You can ask technical questions or request production-ready Frida dynamic hook scripts directly in the AI Chat box (e.g., "Generate a Frida script to bypass SSL Pinning for this app").

Exporting Results

You can export full analysis findings at any time:

Export JSON: Saves all metadata, endpoints, secrets, and components into a single structured .json file.
Export Postman Collection: Generates a ready-to-import Postman Collection file containing all extracted API endpoints.