title: How can I extract API calls from an APK file?
body: <p>Using Python, I am trying to extract the API calls that an Android application makes, given it's .apk file. </p>
  
  <p>Is there a way to parse/extract names of the APIs used by a package through static analysis of its APK?</p>
  
  <h2>Here's what I've tried/discovered so far....</h2>
  
  <p>I have seen this question <a href="https://stackoverflow.com/questions/33982143/extract-api-calls-from-an-apk">posted before</a> but haven't been able to follow the (very limited) answers to a working solution. </p>
  
  <p>I know there are some tools such as <a href="https://github.com/gorla/appmining" rel="nofollow noreferrer">Cartographer</a> that accomplish this among other things, but I haven't been able to get the relevant portions of the code working. Another tool <a href="https://software.imdea.org/~alessandra.gorla/papers/Gorla-CHABADA-ICSE14.pdf" rel="nofollow noreferrer">CHABADA</a> can do it but is not open-source.</p>
  
  <p>I have been able to get some other information from APKs, such as the external classes using <a href="http://androguard.readthedocs.io/en/latest/" rel="nofollow noreferrer">Androguard</a>, the components of the <code>AndroidManifest.xml</code> file using <a href="https://github.com/s3bap3/apk-analyser" rel="nofollow noreferrer">APK Static Analyzer</a>, and using <a href="https://ibotpeaches.github.io/Apktool/" rel="nofollow noreferrer">Apktool</a>, I can decode the manifest into a readable format and also get the smali files.</p>
  
  <p><a href="https://stackoverflow.com/questions/38972250/extracting-all-api-calls-from-smali-files-in-android-apk">Another previous post</a> asks about parsing the smali files for APIs, from lines like the follwing:</p>
  
  <pre><code>  invoke-virtual {p0, v0}, Landroid/net/ConnectivityManager;-&gt;getNetworkInfo(I)Landroid/net/NetworkInfo;
  </code></pre>
  
  <p>but this doesn't appear to be a useful method since <code>invoke-virtual</code> or <code>invoke-direct</code> do not always indicate API usage, and parsing the smali files is a heavier task than if there were some way to just extract the called APIs by statically-analyzing the APK itself.</p>
  
  <p><a href="https://github.com/JesusFreke/smali/tree/master/dexlib2/src/main/java/org/jf/dexlib2" rel="nofollow noreferrer">Dexlib2</a> has also been recommended but I don't see where it can extract API calls, and it's all in Java whereas I've been working in Python.</p>
  
  <p>The tool <a href="https://github.com/alessandrodd/api_key_detector" rel="nofollow noreferrer">API Key detector</a> is giving me the API Keys used, but I don't know how to get the API names from this.</p>
  
  <p>Any solutions?</p>
  
  <h2>Update #1</h2>
  
  <p>I've used Androguard to generate CFG's in the .gexf format as per @ShirishSingh, which can give me nodes in the form: </p>
  
  <pre><code>&lt;node id="0" label="Landroid/support/v4/widget/SearchViewCompatHoneycomb; newOnQueryTextListener (Landroid/support/v4/widget/SearchViewCompatHoneycomb$OnQueryTextListenerCompatBridge;)Ljava/lang/Object;"&gt;
  &lt;attvalues&gt;
  &lt;attvalue id="1" value="Landroid/support/v4/widget/SearchViewCompatHoneycomb;"/&gt;
  &lt;attvalue id="2" value="newOnQueryTextListener"/&gt;
  &lt;attvalue id="3" value="(Landroid/support/v4/widget/SearchViewCompatHoneycomb$OnQueryTextListenerCompatBridge;)Ljava/lang/Object;"/&gt;
  &lt;attvalue id="6" value="false"/&gt;
  &lt;/attvalues&gt;
  &lt;/node&gt;
  </code></pre>
  
  <p>I can see above that <code>newOnQueryTextListener</code> is a method used from <code>Landroid</code>. However there are many other nodes of methods from internal classes. How can I differentiate the nodes of methods from internal classes, to those imported from other libraries, to those that are actual API calls?</p>