I kept wondering which apps on my phone were Flutter, React Native or plain Kotlin. Play Store doesn't tell you, so I built StackLens, an on-device Android app inspector. Here's how the detection works.
Every framework leaves fingerprints in the APK
An APK is a zip file. Cross-platform frameworks have to ship their runtime inside it, and those files have very recognisable names:
| Framework | What to look for |
|---|---|
| Flutter | lib/<abi>/libflutter.so, libapp.so, assets/flutter_assets/ |
| React Native | assets/index.android.bundle, libhermes.so or libjsc.so, libreactnativejni.so |
| Unity | lib/<abi>/libunity.so, libil2cpp.so, assets/bin/Data/ |
| Xamarin / .NET MAUI | assemblies/*.dll, libmonodroid.so, libmonosgen-2.0.so |
| Cordova / Capacitor | assets/www/index.html, cordova.js, capacitor.config.json |
| Jetpack Compose | androidx.compose.* classes in the dex files |
Reading the APK without root
PackageManager gives you applicationInfo.sourceDir (and splitSourceDirs for split APKs). Those files are world-readable, so you can open them with ZipFile and list the entries. No root needed, and you never extract anything to disk.
The catch: on Android 11+ you need QUERY_ALL_PACKAGES to see other installed apps at all.
Confidence, not guesses
One file name isn't always proof (an app can bundle a stray .so), so StackLens scores matches:
- High: the core runtime library plus the app payload (e.g.
libflutter.so+libapp.so) - Medium: only part of the signature
- Low: weak hints only
If nothing matches, it says "unknown" instead of guessing, and it always shows the exact files it matched so you can check for yourself.
While I was in there…
Once you have the APK and the PackageInfo, a lot more is cheap to show:
- Requested permissions vs the ones actually granted
- Target/min SDK, debuggable, allowBackup and cleartext-traffic flags
- SHA-256 signing certificate fingerprints
- Activities, services, receivers and providers, and which are exported
- Native libraries per ABI and split APK names
Privacy
StackLens doesn't declare the INTERNET permission, so your app list physically can't leave the phone. Results are kept in memory only.
It's free, no ads, no account: https://play.google.com/store/apps/details?id=com.veltack.stacklens
I'd love to hear about false positives or frameworks I'm missing (Kotlin Multiplatform and NativeScript are next on my list). What signatures would you add?
