Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
Awesome-Android-Reverse-Engineering
A curated list of awesome Android Reverse Engineering training, resources, and tools.
https://github.com/user1342/Awesome-Android-Reverse-Engineering
Last synced: 4 days ago
JSON representation
-
Tools
-
Static Analysis Tools
- Quark Engine - The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or pentest the targets. Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other.
- ☆ APK Dependency Graph - An APK class dependency visualizer. Useful for attack surface mapping.
- COVA - COVA is a static analysis tool to compute path constraints based on user-defined APIs.
- DIS{integrity} - A tool for analysing Android APKs and extracting root, integrity, and tamper detection checks.
- ☆ Obfu[DE - Obfu[DE]scate is a de-obfuscation tool for Android APKs that uses fuzzy comparison logic to identify similarities between functions, even if they have been renamed as part of obfuscation. It compares two versions of an APK and generates a mapping text file and an interactive HTML file as outputs!
- TinySmaliEmulator - A minimalist smali emulator that could be used to "decrypt" obfuscated strings.
- simplify - Android virtual machine and deobfuscator.
- deoptfuscator - Deoptfuscator is a tool for deobfuscating Android applications that have been transformed using control-flow obfuscation mechanisms.
- QARK - An open-source tool developed by LinkedIn for automatic Android app vulnerability scanning, including identifying potential security issues such as SQL injection, insecure data storage, and more.
- MobSF - An open-source mobile app security testing framework that supports static and dynamic analysis of Android apps for vulnerabilities and privacy issues.
- AndroBugs Framework - An open-source framework for analysing and scanning Android apps for security issues, including static and dynamic analysis capabilities.
- ☆ imjtool - Firmware unpacking tool applicable to the widest variety of vendors and formats.
- Android Studio - Useful if you don’t have a JEB licence and want to open a decompiled (via JADx) app into a proper IDE.
- disarm - A simple command line utility that takes as an argument a 32-bit hexadecimal number, and parses it as an ARM-64 instruction, providing the disassembly.
-
Dynamic Analysis Tools
- AutoDroid - Tool for mass gathering APKs from a device(s), decompiling, filtering on strings, etc.
- RMS Runtime Mobile Security - Frida web interface.
- ☆ FriDump - A Python script that utilises Frida to dump the memory of a running gadget, such as an app activity.
- jnitrace - A Frida based tool to trace use of the JNI API in Android apps.
- ☆ Binder Trace - Binder Trace is a tool for intercepting and parsing Android Binder messages. Think of it as "Wireshark for Binder".
- Drozer - An open-source framework for Android security testing that provides a comprehensive set of tools for dynamic analysis, including intercepting, modifying, and analysing app traffic.
- jtrace - strace for Android - for tracing system-level calls including Binder.
- sesearch - Command line tool to query SELinux policies.
- MITMProxy - An open-source man-in-the-middle proxy that allows for intercepting and analysing network traffic generated by Android apps for security testing and analysis.
- ☆ Frida - A dynamic instrumentation toolkit for Android apps that allows for runtime manipulation and analysis of app behaviour.
- Wireshark - A widely used open-source network protocol analyzer that can capture, analyse, and dissect network traffic generated by Android apps for security analysis.
- SSLsplit - An open-source tool for intercepting and manipulating SSL/TLS encrypted traffic, which can be used for analysing SSL/TLS communication in Android apps.
- ☆ Burp Suite - A popular commercial web security testing tool that can be used for analysing network traffic of Android apps for potential security vulnerabilities.
- ☆ Objection - A runtime mobile exploration tool for Android that provides various features for analysing, manipulating, and bypassing app security controls.
-
Decompilers
- apk2gold - CLI tool for decompiling Android apps to Java. Doing both resources and Java (this repo is 9 years old, and so may not work with newer Android versions).
- AndroidProjectCreator - Convert an APK to an Android Studio Project using multiple open-source decompilers.
- APK Studio - Open-source, cross platform Qt based IDE for reverse-engineering Android application packages.
- show-java - An APK (android application), JAR & Dex decompiler for android.
- Procyon - Procyon is a suite of Java metaprogramming tools, including a rich reflection API, a LINQ-inspired expression tree API for runtime code generation, and a Java decompiler.
- Cfr - An open-source Java decompiler that supports decompilation of Android APK files into Java source code, including support for newer Java language features.
- FernFlower - Fernflower is the first actually working analytical decompiler for Java and probably for a high-level programming language in general.
- IDA Pro - A powerful commercial disassembler and debugger for analysing Android native code.
- Radare2 - A free and open-source reverse engineering framework that supports Android analysis, including disassembly, debugging, and binary analysis.
- Androguard - An open-source tool for analysing and reverse engineering Android apps, including decompiling APK files, analysing Dalvik bytecode, and more.
- DEX2JAR - A tool for converting Android DEX files to JAR files, which can be further analysed using Java decompilers.
- ☆ Ghidra - A free and open-source software reverse engineering (SRE) framework developed by the National Security Agency (NSA) that supports Android analysis.
- ☆ Apktool - A popular open-source tool for decompiling and recompiling Android APK files.
- ☆ JADX - An open-source tool for decompiling and analysing Android APK files into Java source code for reverse engineering and analysis.
- JDGui - JD-GUI is a standalone graphical utility that displays Java source codes of “.class” files.
- ☆ APKLab - APKLab seamlessly integrates Quark-Engine, Apktool, Jadx, uber-apk-signer, apk-mitm and more to VS Code.
-
Malware Analysis
- DroidDetective - A machine learning malware analysis framework for Android apps.
- Cuckoo Droid - CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox.
- androwarn - A static code analyzer for malicious Android applications.
-
-
CTFs and CrackMes
-
Case Studies
- CyberTruckChallenge19 - Android security workshop material taught during the CyberTruck Challenge 2019 (Detroit USA).
- KGB Messenger - KGB Messenger is an open source CTF practice challenge that aims to help people learn how to reverse engineer Android applications.
- ☆ UnCrackable Mobile Apps - A set of OWASP Android app Crackme's. These challenges are used as examples throughout the OWASP MASTG. Of course, you can also solve them for fun.
-
-
Misc
-
Case Studies
- LADB - A local ADB shell for Android!
- Broken Droid Factory - BDF is a Python tool designed to spin-up pseudo random vulnerable Android applications for training when it comes to vulnerability research, ethical hacking, and pen testing on Android apps.
- uber-apk-signer - A cli tool that helps signing and zip aligning single or multiple Android application packages (APKs) with either debug or provided release certificates. It supports v1, v2 and v3 Android signing scheme has an embedded debug keystore and auto verifies after signing.
- RUNIC tamper detection demo - Designed to serve as a parallel for understanding more complex Android tamper detection and integrity systems such as Google Play SafetyNet and Huawei Safety Detect.
-
-
Training
-
Videos
- Using Frida To Modify Android Games | Mobile Dynamic Instrumentation - Focusing on Reverse engineering Android applications and on using Frida to dynamically modify Android games.
- Kristina Balaam Android Reverse Engineering - A video series on reverse engineering basics and reverse engineering Android malware.
- LaurieWired Android Reverse Engineering videos - A YouTube channel focusing on Android reverse engineering.
-
Books
- Blue Fox: Arm Assembly Internals and Reverse Engineering - Provides readers with a solid foundation in Arm assembly internals and reverse-engineering fundamentals as the basis for analysing and securing billions of Arm devices.
- Android Software Internals Quick Reference - This book focuses on easily digestible, useful, and interesting techniques in Java and the Android system. Including: encryption and obfuscation, debugging, and APK extraction.
- ☆ Mobile Offensive Security Pocket Guide - Focusing on Android and iOS operating systems, the book contains a series of succinct chapters that highlight key information, approaches, and tooling used by mobile penetration testers and offensive security practitioners.
- Android Security Internals - Describing Android security architecture from the bottom up, delving into the implementation of major security-related components and subsystems, like Binder IPC, permissions, cryptographic providers, and device administration.
- Android Malware Detection with Machine Learning - Examine the machine-learning techniques used to detect malicious apps, the types of classification models that defenders can use, and the various features of malware specimens that can become input to these models.
- ☆ Android Internals: A Confectioner's Cookbook - An in-depth exploration of the inner-workings of Android: In Volume I, we take the perspective of the Power User as we delve into the foundations of Android, filesystems, partitions, boot process, native daemons and services.
-
Courses and Material
- ☆ Maddie Stone's Android Reverse Engineering Training - A comprehensive online training course on Android reverse engineering by Maddie Stone.
- Introduction to Assembly from Azeria Labs - Covering everything from Data Types, Registers, the ARM Instruction Set, Memory Instructions, and more
- Android Penetration Testing From #TODO - This course will see you develop a baseline knowledge of what is involved in mobile penetration testing along with the specific tools, techniques, and frameworks involved in taking apart and analyzing Android applications.
-
-
Resources
-
Documentation
- Android Security Documentation - Official documentation from Google on Android security, including topics related to reverse engineering.
- Android Reverse Engineering Challenges - A curated list of Android reverse engineering challenges and CTFs (Capture The Flag) for practice.
- AndroidXref - Open code search for Android source.
- APKMirror - Repository of Android APKs from sources such as the Play Store and user uploads.
- APKPure - Repository of Android APKs from sources such as the Play Store and user uploads.
-
Case Studies
-
Programming Languages
Categories
Sub Categories
Keywords
android
13
reverse-engineering
8
malware-analysis
4
smali
4
androguard
3
obfuscation
3
deobfuscation
3
frida
3
apktool
3
apk
3
emulator
2
tamper-detection
2
root-detection
2
deobfuscator
2
security
2
java
2
malware
2
android-application
2
artificial-intelligence
2
dalvik
1
malware-analyzer
1
android-malware
1
malware-research
1
optimization
1
reverse-engineer-apk
1
virtual-machine
1
android-dex
1
jeb
1
deguard
1
vulnerability-research
1
versioning
1
reverseengineering
1
dependency-injection
1
decompile
1
architecture
1
apk-dependency-graph
1
android-dependency-visualizer
1
vulnerability
1
security-vulnerability-assessment
1
llm-agent
1
defcon
1
blackhat
1
blackbox-testing
1
blackbox
1
qt5
1
machine-learning
1
malware-detection
1
python
1
random-forest
1
car
1