EFF's apkeep Reaches Version 1.0: A Robust Tool for Android App Analysis
The **Electronic Frontier Foundation (EFF)** has announced version 1.0 of **apkeep**, their command-line Android package downloading software. This release marks a significant milestone, signifying stability and maturity after four years of iterative development and introduces new features focused on the **Google Play Store**.
Last week, the **EFF** released [apkeep](https://github.com/EFForg/apkeep) version [1.0.0](https://github.com/EFForg/apkeep/releases/tag/1.0.0), the latest edition of their command-line Android package downloading software. This milestone signifies a relatively stable and mature state after gradual iteration over the past four years.
**Whatβs New in apkeep 1.0.0**
This release includes several new features, all focused on the **Google Play Store**:
* You can now [download](https://github.com/EFForg/apkeep/pull/221) a [dex metadata](https://source.android.com/docs/core/runtime/configure) file associated with an app containing a [Cloud Profile](https://docs.cloud.google.com/profiler/docs), which provides information on app performance based on real usage.
* You can now provide a token generated by the [Aurora Storeβs](https://store.auroraoss.com/) [dispenser](https://gitlab.com/AuroraOSS/aurora-dispenser) to log in anonymously for app downloads.
* Users can [specify their own](https://github.com/EFForg/apkeep/commit/7aa5af6ca5dd1435188820749399cfdc3cd7f708) [device profiles](https://auroraoss.com/config-generator) when downloading apps from **Google Play**, which the store uses to deliver the app variant that works for your particular device specifications.
* Theyβve also [fixed](https://github.com/EFForg/rs-google-play/commit/fc64b7ff834280cb310578a9204e4a88a3cd1e8c) an authentication bug introduced by the **Play Store API**.
In addition to supporting various Linux, Windows, and Android environments, **apkeep** is now [included in Homebrew](https://formulae.brew.sh/formula/apkeep) for macOS users.
**How Researchers Use apkeep to Understand the Android App Landscape**
Researchers and users contributed most of the features of this release, including the ability to download dex metadata containing **Googleβs Cloud Profiles**. This feature aids in research, highlighting how Android compilation profiles can be a vital source of information for evaluating dynamic testing. Projects like [Exodus Privacy](https://exodus-privacy.eu.org/en/) use **apkeep** to power their [Ξ΅xodus](https://reports.exodus-privacy.eu.org/en/) tool's downloads when monitoring the privacy properties of apps. Research teams have also [noted](https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=11193830) their use of the tool in whitepapers, including one team who [used the tool](https://s3.eurecom.fr/docs/asiaccs24_ruggia.pdf) to download 21,154 apps in a widespread study of Android evasive malware.
**Whatβs in Store for apkeep?**
The goals for **apkeep** remain constant: to provide a reliable, fast, and safe way to download apps from multiple app providers, not just the **Google Play Store**. While the focus has been on **Google Play**, support has expanded to other stores like [F-Droid](https://f-droid.org/) for [downloading](https://github.com/EFForg/apkeep/blob/master/USAGE-fdroid.md) open-source apps. The aim is to continue broadening **apkeep**βs list of supported providers to facilitate comparative analysis of apps provided in different contexts. Contributions are welcome via [their GitHub repository](https://github.com/EFForg/apkeep).
**How You Can Help**
If youβre using **apkeep** as part of your toolbox (whether for malware analysis, auditing apps, or app archiving), [let them know](https://github.com/EFForg/apkeep/issues/202)! Consider [donating to the EFF](https://supporters.eff.org/donate/) to support their work.