# -*- coding: utf-8 -*- import re import zipfile APK = r"C:\Users\Administrator\Desktop\notiMessage\reverse\apks\seabank_ph_base.apk" needles = [b"WBRootDetectionModule", b"WBEmulatorDetectionModule", b"SPSAssessRisk", b"shpssdk"] with zipfile.ZipFile(APK) as zf: for name in zf.namelist(): if not name.endswith(".dex"): continue data = zf.read(name) hits = [n.decode() for n in needles if n in data] if hits: print(name, hits) for m in re.finditer(rb"L[a-zA-Z0-9_$/]*WBRootDetectionModule;", data): print(" ", m.group().decode()[1:-1].replace("/", ".")) for m in re.finditer(rb"L[a-zA-Z0-9_$/]*SPSAssessRisk[^;]*;", data): print(" ", m.group().decode()[1:-1].replace("/", ".")) for m in re.finditer(rb"Lcom/shopee/shpssdk[a-zA-Z0-9_$/]+;", data): s = m.group().decode()[1:-1].replace("/", ".") if "shpssdk" in s.lower(): print(" ", s)