Mercury
MERCURY
Android analysis Tool kit
explore the systems beneath the surface.
An Android app can add a service, reference a new domain, or shed a dependency without drawing attention. Mercury lets you examine APKs and follow those changes across version history.
Fetch APK releases from the public sources or upload your own files.
Extract domains, hosts, permissions, and other signals, then explore the results through graphs and charts.
Track when connections appear or disappear across app versions.
Build a picture of the software and infrastructure behind an app, release by release, to study how systems evolve and markets shift.
What Mercury Does
Mercury examines Android APKs version by version. It brings together URLs, subdomains, permissions, SDKs, native libraries, and Java identifiers, with links to companies and countries where those can be identified. Choose the releases you want to inspect, compare them with other apps, and export the charts as HTML or text.
An app can look the same after an update while the system behind it changes. An unfamiliar SDK in a banking app, a new domain referenced by a messaging service, or the same outside provider appearing across dozens of apps could all warrant a closer look. Mercury shows which versions contain those signals and where else they appear. Those details can affect a security decision, change the course of an investigation, or reveal a pattern of dependence across a market. Security teams, journalists, researchers, and policymakers can follow each finding back to the APKs behind it.
begin analyzing
Mercury is free for anyone researching Android apps. Run the tool locally from our GitHub repository by clicking the button below.
Bring your own APKs, fetch versions from supported app stores, or request our sample pack of more than 20,000 APK versions. Choose the releases you want to examine, compare them with other apps, and begin uncovering what lies beneath the surface.
About Mercury
-
Mercury is free to use.
Its development and availability are supported by donations, allowing us to provide access without cost while continuing to improve the platform.
-
No technical expertise is required. Mercury is designed for researchers, analysts, and organizations of all backgrounds.
-
Mercury is not designed to unpack protected apps or deobfuscate their code. It can examine information that remains accessible, but protections that conceal code or other content can leave gaps in the results.
Elkenson offers unpacking and deobfuscation services for selected apps when the research warrants deeper investigation and significant security threats exist. Contact us to discuss an investigation in further detail.
-
Mercury doesn't impose a fixed limit on how many versions you can select for analysis. You can compare releases available through the APK stores linked in Mercury, or upload versions obtained from other archives or your own collection. Historical coverage varies between stores, so checking additional sources can help fill gaps. The practical limits depend on your computer, the size of the APKs, and the analysis options you choose; larger comparisons require more processing time, memory, and storage.
-
You do not need to register an account with Elkenson. Mercury runs locally on your computer.
-
Mercury compares an app’s release history with comparisons across different apps. Its chronological heatmaps show which versions contain particular domains, permissions, SDKs, and native libraries, making additions and removals easy to locate. You can explore shared indicators across apps, view company and country associations where available, and export interactive charts as HTML or copy chart data as text. These features bring evidence from many APK releases into one interface.
Mercury makes this comparison workflow freely available to run on your own computer. You can bring your own APKs, repeat analyses, and export results without a subscription or per-APK analysis fee. This lets you expand and revisit an investigation as new releases become available.
-
No. Mercury currently analyzes Android APKs. Android accounts for nearly 70% of worldwide mobile web traffic, making it a valuable platform for studying mobile software across many markets. If the service you are investigating has an Android version, you can examine its APKs with Mercury.
For projects involving iOS or other platforms, Elkenson offers research and investigation services covering a broader range of software and systems. Contact us to discuss your project.
-
Visit our Mercury tips and tricks guide for ways to explore the tool and get more from your analysis.
-
We’re glad our tool has been useful to you! Please credit Elkenson as the developer and include the repository address, the version or commit you used, and your access date. A suggested format is:
Elkenson. Mercury: Android analysis toolkit [Software, version or commit identifier]. GitHub. https://github.com/elkenson/mercury. Accessed [Month Day, Year].
Cite any external datasets or APK collections separately, and identify the app releases examined so readers can understand the evidence behind your findings.
-
If a technical problem arises, please contact us. We are dedicated to maintaining a robust, reliable platform, and our team will help you resolve the issue.
Apk basics
-
An APK (Android Package Kit) is a file used to distribute and install Android apps. It contains code, resources, and configuration for a particular app build. The same app can have many versions released over time, with each release delivered through new APK files, sometimes split across several files. Comparing these releases can reveal changes in permissions, bundled libraries, and references to external services. Tracking those changes helps researchers investigate how suppliers, software dependencies, and potential data flows evolve, providing evidence for changes in markets and infrastructure.
-
Examining an APK can reveal the app’s compiled code, bundled libraries, configuration, declared permissions, and references to external services. Seeing how these pieces connect helps identify which supplier provides a feature and which functions need closer testing. References to external services can also indicate where app data may be sent or processed, helping researchers investigate the countries and legal jurisdictions involved. APK analysis also lets researchers examine implementation details not visible through the app’s interface.
-
Static analysis examines software without executing it; dynamic analysis observes it running. Static work can uncover code paths, configuration, and dependencies that explain how a feature is implemented. Runtime testing can establish which of those paths executes under particular conditions. For example, finding code that initializes an external service raises a question; observing that initialization during sign-in provides evidence about when it occurs.
Mercury uses static analysis to examine APKs. Elkenson also provides dynamic analysis services for investigations that require runtime testing. Contact us to discuss your project.
-
A permission request indicates that an app seeks access to something Android protects, such as precise location or the microphone. To understand its significance, identify which feature or dependency uses that access and test what happens when permission is granted, refused, or revoked. Account for the Android version, since permission behavior can differ between releases. Permissions also leave some activity outside their view: a service can receive information such as an IP address without a location or microphone prompt.
-
A package ID is an app’s unique Android identifier, such as com.example.app. It is different from the app’s display name and helps you identify the correct app when several have similar names.
For Mercury:
Search for the app by name in Mercury. This helps you find its package ID, the unique identifier used to look it up. Select the app, choose a download source, and click Fetch versions.
For Google Play:
Alternatively, open the app’s page on the Google Play website and look at its web address. The package ID appears after id=. For example, if the address contains id=com.example.app, copy com.example.app into Mercury’s package ID field.
For APK Sites:
You can also download an APK from sites such as Uptodown, APKPure, or APKMirror. Search by the app’s name and check the publisher to make sure you have the right listing. These sites often offer earlier versions alongside the latest release, which helps you track changes over time. Download the APK versions you want, then upload the file directly to Mercury.
-
Yes. An installed app can contain a feature that remains inactive until a server enables it. The operator can also change configuration, select different settings for particular users, or alter how the backend responds. None of these necessarily requires a new APK. Investigating a change therefore involves checking more than version numbers: configuration, account state, region, server responses, and the timing of observations can help explain why the same build behaves differently.
-
The APK is the installation package, while the app’s total storage includes additional files created or downloaded after installation. Parts of the package may be compressed, and Android may extract components or generate files needed to run the app. As you use it, databases, cached images, messages, offline downloads, and other content can add to its size. A small APK can therefore become a much larger installation over time.
-
Android provides several ways for apps to send requests or share information. Intents can ask another app to open a link, display a document, or receive a shared photo. Content providers can make selected data available, while bound services allow one app to request functions from another. Access depends on the interfaces exposed and the permissions or access grants involved. Researchers examine these routes to understand what information can move between apps and which applications can receive it.
Make a Donation
If our tools have been useful to you, or if you support our projects, donations like yours help us keep building, improving, and offering these resources openly.