Building a Control Flow Graph for Android APK from smali code

Question

Are there any tools out there that parse smali code directly to construct CFG? I know that Androguard does something similar but it seems to use decompilation on the apk file which can become unreliable in situations if the apk uses obfuscation techniques.

Answer 1

Have a look at https://androguard.blogspot.co.il/2011/02/android-apps-visualization.html.

In regards to your concerns about Androguard.

it seems to use decompilation on the apk file

Do you mean "disassembling"? Well, a tool needs to understand the bytecode in order to build a call graph. If you mean "decompiling to Java", I'm pretty sure this doesn't happen.

unreliable in situations if the apk uses obfuscation techniques

There are various obfuscation techniques. And most has nothing to do with the call graph. E.g. name mangling replaces class name like org.apache.http.client.HttpClient to something meaningless like a.b.c. You will still see this class and its functions in CFG.