Graph of library dependencies

[mfonville]

Do you think it would maybe be possible to give a graph-representation (does not have to be graphic though) of all the library dependencies of the applications?
That would help the google-app packaging scene a lot.

[Lekensteyn]

It should be possible, maybe even in an automated way.

Ways to detect usage of a native library:

• ldd on native lib*.so libraries. Possible point of improvement: libraries which are loaded on runtime using dlsym cannot be detected this way.
• For file libFOO.so, grep for FOO. This is unfortunately a fuzzy search which requires manual validation (which I have done so far). A possibly better (more automatable) approach:
• Use smali tools and search for System.load("/system/lib/libFOO.so"), System.loadLibrary("foo") and report these.
• Check the manifest file for https://developer.android.com/reference/android/app/NativeActivity.html

Then there are jars... Do these have to be detected?

[mfonville]

The jars are afaik quite static (so just one entry per /etc/ and in /framework/) so those should not need any detection, I think. But I would not know how an apk decides it needs this framework information :-/

[Lekensteyn]

@mfonville I played a bit with pygraphviz and managed to create this graph
https://rawgit.com/Lekensteyn/ecad332df8053145c857/raw/graph.html. Tools are in the scanlibs/ folder of this repo. Is this something you had in mind? It is a bit... huge though.

Raw dependencies file and HTML source are at: https://gist.github.com/Lekensteyn/ecad332df8053145c857

Note: these are only library and program dependencies for the proprietary files extracted from the Nexus 5 factory image (5.1.1, LMY48B) and some from https://github.com/TheMuppets/proprietary_vendor_lge/tree/cm-12.1/hammerhead/proprietary/ (soundfx, libqc-opt.so, libQSEEComAPI.so). The file list is from https://github.com/CyanogenMod/android_device_lge_hammerhead/blob/cm-12.1/proprietary-blobs.txt

The jars are more work, not sure if I will get to this any time soon.

[mfonville]

It is exactly how I had it in mind, but is indeed huge, so it will take some tim to study it :)