What problem does it solve? Android apps that load DEX files, native libraries, or deserialize objects from attacker-controlled sources can yield arbitrary code execution, but finding these bugs requires manually tracing every dangerous sink back to its input source across thousands of decompiled classes. ## Core Features & Use Cases - Sink Triage: Consumes sinks.json and filters to the five code-execution sinks (DexClassLoader, System.load, ObjectInputStream, reflection, Runtime.exec), ranking them by severity and grouping by file. - Source-Tracing Guidance: For each hit, explains why it is risky and gives the exact static follow-up to determine whether the sink argument is attacker-controlled. - TTP Catalog & Chaining: Documents five TTPs (dynamic DEX loading, insecure native library path, insecure deserialization, unsafe reflection, TOCTOU races) with cross-skill attack chains like Zip Slip to code execution and the Play Core CVE-2020-8913 pattern. - Use Case: After decompiling an authorized-test APK and running grep_sinks.py, run the audit script to get a ranked list of dangerous execution sinks with per-finding static analysis steps and observe-only Frida trace hints. ## Quick Start Run the bundled audit script against a target's sinks.json to triage code-execution sinks and get a ranked static follow-up plan.
