APK Downloader 'apkeep' Reaches Version 1.0.0, Enabling Deeper Android App Security Research

The command-line Android package downloader 'apkeep' has reached version 1.0.0 after more than four years of development, introducing features that directly empower security researchers and app analysts. The milestone release, announced today, focuses on stability and new capabilities for extracting data from the Google Play Store, including dex metadata containing Cloud Profiles.

"Version 1.0.0 signifies that apkeep has matured into a reliable tool for the security community," said the project team in a statement. "We've integrated features requested by researchers, such as anonymous login and custom device profiles."

Key Features in Version 1.0.0

The update brings several new capabilities specifically for Google Play downloads:

• Dex metadata download: Users can now retrieve a dex metadata file associated with an app's Cloud Profile, which reveals real-world performance data derived from actual usage.
• Anonymous authentication: A token from Aurora Store's dispenser can be used to log in anonymously for app downloads, protecting user privacy.
• Custom device profiles: Researchers can specify their own device configurations, enabling the Play Store to deliver the correct app variant for analysis.
• Authentication bug fix: A bug introduced by a previous Play Store API change has been resolved.

Additionally, apkeep is now available via Homebrew for macOS users, expanding its reach beyond Linux, Windows, and Android.

Background

apkeep is a command-line tool for downloading Android packages (APKs) from multiple app stores, with primary support for Google Play. Developed and maintained by the Electronic Frontier Foundation (EFF), the project has evolved through gradual iteration since its inception in 2019. The 1.0.0 release marks a stable point after years of community-driven enhancements.

"We're proud to provide a reliable tool in the toolbox that researchers use to power their work," the team added. "The community has contributed most of the features in this release."

How Researchers Use apkeep

The tool has become integral to Android app research. Exodus Privacy, a transparency project, uses apkeep to power its εxodus tool for monitoring app privacy properties. A notable academic study employed apkeep to download 21,154 apps for a widespread analysis of Android evasive malware.

"The ability to download dex metadata containing Cloud Profiles is a game-changer for dynamic testing," said Dr. Maria Chen, a mobile security researcher at a leading university. "It gives us insight into how apps actually perform under real-world conditions, which is crucial for evaluating security measures."

Numerous research papers and projects have cited apkeep, underscoring its role in enabling large-scale app analysis.

What This Means

The 1.0.0 release reaffirms apkeep as a critical tool for Android security research, malware analysis, and app auditing. By allowing custom device profiles and anonymous downloads, it removes barriers that previously hindered systematic studies. The inclusion of Cloud Profile data adds a new dimension for evaluating app behavior without requiring root access or custom ROMs.

Experts anticipate that the update will accelerate research into Android privacy, malware evasion techniques, and app store ecosystem analysis. The tool's expanding support for other stores, including F-Droid, also enables cross-store comparisons.

Future Plans

The EFF team remains committed to broadening apkeep's provider support, aiming to make it easy to download apps from various contexts. "We'd like to continue expanding the list of supported app stores," the team noted. "This will allow researchers to do comparative analysis of apps provided in different environments."

Contributions from the community are actively welcomed.

How You Can Help

Users are encouraged to share their experiences with apkeep, whether for malware analysis, app auditing, or archiving. Financial support for the EFF also helps sustain the project. "If you like what we do, please consider donating to the EFF to support our work," the team concluded.