Why
PR #958 introduced a new core library based on DexTrace. You may find a comparison with the existing Androguard-based one in the comment below.
The comparison shows that both core libraries produce identical Quark reports when tested with the built-in rules and samples from apk-samples and the malware family analysis reports.
Based on those results, I propose changing Quark's default core library to the DexTrace-based one.
How
Change the default value of the CLI flag --core-library to dextrace. However, to ensure all Quark features and the downstream tools remain functional, we should do the following checks before making this change.
Why
PR #958 introduced a new core library based on DexTrace. You may find a comparison with the existing Androguard-based one in the comment below.
The comparison shows that both core libraries produce identical Quark reports when tested with the built-in rules and samples from apk-samples and the malware family analysis reports.
Based on those results, I propose changing Quark's default core library to the DexTrace-based one.
How
Change the default value of the CLI flag
--core-librarytodextrace. However, to ensure all Quark features and the downstream tools remain functional, we should do the following checks before making this change.