LibChecker

LibChecker is an open-source inspector for Android packages. It inventories installed applications, then lets you examine their declared components, permissions, native libraries and recognised third-party libraries without unpacking each APK on a computer.

This page covers F-Droid build 2.5.4.5696014, version code 2671. The numeric suffix identifies the source revision used for the build; the upstream release is 2.5.4. We matched the APK to F-Droid’s signed index and checked the fixed 2.5.4 source. We did not install it or grant it Shizuku access on a physical phone.

What it can inspect

The main screen is one mixed application list with search and sorting. A Show system apps filter is enabled by default. An individual app report can show:

• activities, services, broadcast receivers and content providers;
• requested permissions and package metadata;
• native libraries and the CPU ABIs they contain;
• recognised SDKs and other libraries based on LibChecker’s rules;
• ELF details and native-library ZIP alignment when it is below the 16-kilobyte threshold; and
• installation and package details exposed by the operating system.

Snapshots preserve an inspection result so a later scan can show what changed after an update. Version 2.5.4 also adds export of app information. These are static package observations: LibChecker does not prove that a component executed, that a permission was used or that a detected SDK contacted a server.

Rules, charts and network access

Known-library names are supplied by rule databases maintained with the project. LibChecker can update rules from GitHub or GitLab and open rule details through project services, so a result may improve as the database changes and may also be wrong or incomplete. Other network paths include the Android-version chart’s Google API, update checks, remote APK previews and the developer avatar on the About page. Those fixed external services are why F-Droid marks the app TetheredNet.

The APK has internet permission, although inspecting local packages does not itself require a remote account. Our scan found no tracker SDKs. That is separate from the intentional requests above: those hosts can see ordinary connection metadata when the relevant features are used.

Optional Shizuku access

Android increasingly limits which package-management fields an ordinary app can read. LibChecker declares the Shizuku permission so it can optionally retrieve the installation requester and dump the system package service for a more accurate DEX optimisation result. The package installer itself is available without Shizuku; the extra field is specifically the requester. LibChecker does not need Shizuku for its main component, permission, library or native-file reports.

Shizuku is powerful because it brokers system-level APIs through ADB or root. Only grant it when the requester or more accurate DEX status is useful, and review the request in Shizuku rather than treating it as a routine notification permission.

Visibility and limitations

LibChecker requests QUERY_ALL_PACKAGES and a manufacturer-specific installed-app permission so it can perform its central job. Android may still hide packages under work profiles, secondary users or vendor restrictions. Split packages and dynamically downloaded code can also make a static inventory differ from what a running app eventually loads.

The composite image below comes from the project README. Its snapshot is dated August 2022, so it documents an older interface rather than claiming to reproduce every screen in 2.5.4.

About this file

• This is F-Droid’s source build of 2.5.4.5696014, signed with F-Droid’s key. Developer-signed Play or IzzyOnDroid builds are a different signing line and cannot update it in place.
• The 4.9 MB APK needs Android 7.0 or later and contains no native libraries, so it is not tied to one CPU architecture.
• It declares six permissions, including internet, installed-package visibility, optional Shizuku and notifications; our static scan found no tracker SDKs.
• Its measured SHA-256 is 06b5cb36b5002bff55be2a1e9923504be866fc8821b28c1c74963c8a9f5be24e, matching the signed F-Droid index.
• LibChecker is licensed under Apache-2.0.

Shizuku API. Uses the Shizuku API, so it can do ADB-level work without root once Shizuku is running. (rikka.shizuku.ShizukuProvider)

Flagged by F-Droid:

• TetheredNet: Uses a network service run by the developer.

Versions currently kept in the F-Droid repository. We host and check only the newest one. Full changelog.