Determine Which Sdks Are Used In A Third-party App

I would like to determine which third-party SDKs (like Mixpanel, Google Analytics, Facebook SDKs) are being used in an app, if any. Is there a way to find this out? Assume for the

Solution 1:

You can use a service like Appbrain to find that out. It's free for the first few lookups.

Solution 2:

It's not possible to reliably enumerate the libraries used by an application, for a few reasons.

The main reason is obfuscation: If a user turns on Proguard or R8, they will rename the library's classes, potentially in such a way as to make them unrecognizable.

Another reason is that there's simply not a comprehensive list of every Android library in existence, or a mapping of class names to libraries.

However, if you did want to try to do this, you'd want to retrieve the application's class files and then hunt through them for the start of package names from libraries you care about (as obfuscators are less likely to rename the entirety package names, though they still might). For example, if you wanted to see if an application uses okhttp3, you'd look to see if there are is an okhttp/okhttp3 folder (for the package okhttp.okhttp3).

You could maybe even automate this by finding a list of popular Maven/Gradle packages, downloading them, extracting the class names, and using that as your dataset.