File check: check whether there are security problems such as source code, stolen and replaced resource files in the dex and res files. 2 Vulnerability scanning: No matter whether the scanning code is chaotic or not, there are security vulnerabilities. Check whether the signature and XML master file are easy to be statically injected and embedded with malicious code.

Program confidentiality detection: check code confusion, dex protection monitoring, so protection monitoring, program signature detection and other security issues. 2 component security detection: scan the security vulnerabilities of Activity, BroadcastReceiver, service and ContentProvider of code components.

File checking checks whether there are security problems such as source code, stealing and replacing resource files in dex and res files. Vulnerability scanning scanning signature, whether there are security vulnerabilities in XML files, being injected, embedding code and other risks.

There are two ways to detect security vulnerabilities of third-party open source software used in applications. One way is to infiltrate, write POC scripts for vulnerabilities, and verify the attack of POC scripts on application systems. Once successful, there are loopholes. There are many POC scripts and POC scripting tools for the loopholes in the framework like Struts.