Android Native Scanner

Android native library scanner for .so files.
This tool extracts strings, scans for sensitive data, API keys, tokens, CTF flags, base64-encoded secrets, and JNI methods. It also supports custom regex search.

---

Features

• Pure-Python string extraction: ASCII + UTF-16LE with offsets.
• Optional external tools: readelf and nm integration (if available).
• Sensitive patterns: Detect Google API keys, OpenAI keys, GitHub tokens, AWS secrets, JWTs, passwords, PEM keys, database URIs, internal hosts, and more.
• CTF/flag detection: Detect CTF{} and FLAG{} patterns.
• Base64 detection: Auto-decode likely base64 strings.
• Custom search: Supply your own string or regex patterns (overrides default patterns).
• Silent mode: Print only matches.
• Save output: Optionally save results to a file.
• No external modifications: Removed suggestions for objcopy or section removal.

---

Installation

Clone the repository:

git clone https://github.com/7absec/AndroidNativeScanner.git
cd AndroidNativeScanner

Install dependencies (optional, for colored output):

pip install termcolor

---

Usage

Scan a single .so file with default patterns

Default Mode

Using built-in sensitive and flag patterns:

python NativeScanner.py path/to/lib***.so

Scan a directory recursively

python NativeScanner.py path/to/libs/

Custom Mode

Using user-supplied search patterns:

# Plain string search
python NativeScanner.py libnativeflag.so -s "CTF{"

# Regex search
python NativeScanner.py libnativeflag.so -s "re:CTF\{[A-Za-z0-9_!@\-\.\+]{1,256}\}"

If custom search is provided, default patterns are ignored.

Silent mode (only print matches)

python NativeScanner.py libnativeflag.so -q

Save output to a file

python NativeScanner.py libnativeflag.so --save report.txt

Verbose mode (full external tool output)

python NativeScanner.py libnativeflag.so -v

---

Arguments

Argument	Description
path	Path to a .so file or directory containing .so files.
-s, --search	Custom search pattern. Can be repeated. Use re: prefix for regex. Overrides default patterns.
-q, --silent	Silent mode: print only matches.
--save FILE	Save human-readable report to FILE.
-v, --verbose	Verbose mode: prints full external tool output if available.

---

Example Output

[*] Analyzing: libnativeflag.so
[!] CTF Flag: CTF{Android_Native_Hakure} (offset=0x1234)
[*] Base64: SGVsbG8gd29ybGQ= (offset=0x5678)
    → Decoded (snippet): Hello world
[-] No other matches found.

---

Contributing

Feel free to open issues or submit pull requests. Future plans include:

• Raw binary pattern search.
• Automatic risk scoring and reporting.
• Extended CTF/flag heuristics.

---

License

MIT License