What is the process of finding deep links from an Android application?

Question

I'm very curious on how to go about this the only solution i can think of is to decompile, modify the code to print when a deep link is clicked, and recompile, if you have any other suggestions i would be very happy to hear!

Answer 1

A deep link is similar to opening a URL with an application in other operating systems. You can run firefox https://example.com to open that URL in your browser, and applications can tell the operating system that they can handle certain protocols (such as myapp://some/place).

In Android, the way to tell the operating system what your app can handle, is by using the AndroidManifest.xml file. This is explained in the documentation:
https://developer.android.com/training/app-links/deep-linking

To extract that file from an APK (Android Package), you used to be able to just unzip your.apk. These days, that will still work, but the XML is transformed into a binary format, so you need special tools to extract it. Most commonly, one would use apktool or aapt.

Taking F-Droid as example (I know it can open f-droid.org links):

$ wget https://f-droid.org/f-droid.apk
$ apktool d f-droid.apk
$ cd f-droid
$ cat AndroidManifest.xml
[...]
        <intent-filter android:autoVerify="true">
            <action android:name="android.intent.action.VIEW"/>
            <category android:name="android.intent.category.DEFAULT"/>
            <category android:name="android.intent.category.BROWSABLE"/>
            <data android:scheme="https"/>
            <data android:host="f-droid.org"/>
            <data android:host="www.f-droid.org"/>
            <data android:host="staging.f-droid.org"/>
            <data android:pathPrefix="/app/"/>
            <data android:pathPrefix="/packages/"/>
            <data android:pathPrefix="/repository/browse"/>
            <data android:pathPattern="/.*/packages/.*"/>
            <data android:pathPattern="/.*/packages/.*/"/>
        </intent-filter>
[...]
        <intent-filter>
            <action android:name="android.intent.action.VIEW"/>
            <category android:name="android.intent.category.DEFAULT"/>
            <category android:name="android.intent.category.BROWSABLE"/>
            <data android:scheme="http"/>
            <data android:scheme="https"/>
            <data android:host="play.google.com"/>
            <data android:path="/store/apps/details"/>
        </intent-filter>
[...]

We see that f-droid will open https://f-droid.org, https://www.f-droid.org, https://staging.fdroid.org, but a little further down we also find that it can also handle Google Play Store URLs. There are some more, but I'll leave those as an exercise to the reader :-). Look for the <data ... tags.