The article describes anti-analysis techniques found in certain Android malware samples designed to crash the AndroGuard APK analysis tool or its Python zipfile dependency, similar to anti-debugging tricks used by PC malware against tools like OllyDbg and IDA Pro. Techniques include crafting malformed 'linksize'/'linkoff' padding values that trigger unpack() failures due to 4-byte alignment issues in zipfile.py, and manipulating AndroGuard's search_methods() return values to conceal malicious behaviors like audio recording. The AndroGuard project addressed the zipfile parsing issue in a December 2012 patch.
APK Parsing
1 post
Hey AndroGuard, I Will Crash Your Python Buddy! | Zscaler