import zipfile
import re

z = zipfile.ZipFile(r"reverse/dumps/tng_1.9.10_base.apk")
names = [n for n in z.namelist() if n.endswith(".dex")]

# Find packages that look like Promon (short random package + few classes)
# Also search string markers
markers = [
    b"promon",
    b"Promon",
    b"PROMON",
    b"xwwqazamx",
    b"Rooting",
    b"jailbroken",
    b"JailBroken",
    b"W:16",
    b"libtngdigital_ewallet",
]

for m in markers:
    hits = 0
    for n in names:
        hits += z.read(n).count(m)
    print(f"marker {m!r}: {hits}")

# Extract L.../...; type descriptors that contain 'promon' case-insensitive or weird short pkgs
pkg_re = re.compile(rb"L([a-z]{6,12})/([A-Za-z0-9_$]{1,20});")
pkg_counts = {}
for n in names:
    data = z.read(n)
    for m in pkg_re.findall(data):
        pkg = m[0].decode("ascii", errors="ignore")
        pkg_counts[pkg] = pkg_counts.get(pkg, 0) + 1

# Show rare short packages (likely obfuscated)
cands = [(p, c) for p, c in pkg_counts.items() if 5 <= c <= 500 and p.isalpha() and len(p) <= 12]
cands.sort(key=lambda x: -x[1])
print("\ncandidate obfuscated packages:")
for p, c in cands[:40]:
    print(f"  {p}: {c}")