Awesome-Android-Reverse-Engineering

A curated list of awesome Android Reverse Engineering training, resources, and tools.
https://github.com/user1342/Awesome-Android-Reverse-Engineering

Last synced: 1 day ago
JSON representation

Resources
- Documentation
  - Android Reverse Engineering Challenges - Curated list of reverse engineering challenges and CTFs.
  - Android Security Documentation - Official Google documentation on Android security.
  - AndroidXref - Open code search for Android source.
  - APKMirror - Repository of APKs from the Play Store and user uploads.
  - Android Security Documentation - Official documentation from Google on Android security, including topics related to reverse engineering.
  - APKPure - Repository of APKs for testing and research.
  - AndroidXref - Open code search for Android source.
- Case Studies
Tools
- Dynamic Analysis Tools
  - Wireshark - Open-source network protocol analyzer.
  - ☆ Frida - Dynamic instrumentation toolkit for runtime manipulation.
  - ☆ Burp Suite - Commercial tool for analyzing network traffic of Android apps.
  - Drozer - An open-source framework for Android security testing that provides a comprehensive set of tools for dynamic analysis, including intercepting, modifying, and analysing app traffic.
  - jtrace - strace for Android - for tracing system-level calls including Binder.
  - sesearch - Command line tool for querying SELinux policies.
  - ☆ Burp Suite - A popular commercial web security testing tool that can be used for analysing network traffic of Android apps for potential security vulnerabilities.
  - Wireshark - A widely used open-source network protocol analyzer that can capture, analyse, and dissect network traffic generated by Android apps for security analysis.
  - SSLsplit - An open-source tool for intercepting and manipulating SSL/TLS encrypted traffic, which can be used for analysing SSL/TLS communication in Android apps.
  - MITMProxy - An open-source man-in-the-middle proxy that allows for intercepting and analysing network traffic generated by Android apps for security testing and analysis.
  - ☆ Frida - A dynamic instrumentation toolkit for Android apps that allows for runtime manipulation and analysis of app behaviour.
  - ☆ Objection - A runtime mobile exploration tool for Android that provides various features for analysing, manipulating, and bypassing app security controls.
  - ☆ Objection - Runtime exploration tool to bypass app security controls.
  - RMS Runtime Mobile Security - Frida web interface.
  - jnitrace - Frida-based JNI API tracer.
  - SSLsplit - Intercepts and manipulates SSL/TLS encrypted traffic.
  - AutoDroid - Mass APK gathering and analysis tool.
  - ☆ FriDump - Uses Frida to dump memory of running apps.
  - ☆ Binder Trace - Intercepts and parses Android Binder messages.
  - Drozer - Framework for Android security testing with dynamic analysis features.
  - apk-mitm - Prepares APKs for HTTPS inspection.
  - jtrace - Similar to strace, but for Android system calls.
- Static Analysis Tools
  - Android Studio - Useful for analyzing decompiled apps via an IDE.
  - QARK - An open-source tool developed by LinkedIn for automatic Android app vulnerability scanning, including identifying potential security issues such as SQL injection, insecure data storage, and more.
  - MobSF - An open-source mobile app security testing framework that supports static and dynamic analysis of Android apps for vulnerabilities and privacy issues.
  - AndroBugs Framework - An open-source framework for analysing and scanning Android apps for security issues, including static and dynamic analysis capabilities.
  - ☆ imjtool - Firmware unpacking tool applicable to the widest variety of vendors and formats.
  - disarm - A simple command line utility that takes as an argument a 32-bit hexadecimal number, and parses it as an ARM-64 instruction, providing the disassembly.
  - QARK - An open-source tool for automatic Android app vulnerability scanning.
  - AndroBugs Framework - Analyzes and scans Android apps for security issues.
  - MobSF - Supports both static and dynamic analysis for Android app security testing.
  - Quark Engine - Integrates various tools as Quark Script APIs for mobile security research.
  - Dexcalibur - Automated tool for analyzing and instrumenting Android applications.
  - simplify - Android virtual machine and deobfuscator.
  - ☆ APK Dependency Graph - Visualizes APK class dependencies.
  - COVA - Computes path constraints based on user-defined APIs.
  - DIS{integrity} - Analyzes APKs for root, integrity, and tamper detection.
  - ☆ Obfu[DE - De-obfuscation tool that uses fuzzy comparison logic.
  - TinySmaliEmulator - Minimalist smali emulator for "decrypting" obfuscated strings.
  - deoptfuscator - Tool for deobfuscating apps using control-flow obfuscation.
  - ☆ imjtool - Firmware unpacking tool for various vendors and formats.
  - disarm - Command line utility for parsing ARM-64 instructions.
- Decompilers
  - JDGui - Graphical utility to view Java source from class files.
  - Radare2 - Reverse engineering framework with disassembly and debugging.
  - ☆ JADX - An open-source tool for decompiling and analysing Android APK files into Java source code for reverse engineering and analysis.
  - Procyon - Procyon is a suite of Java metaprogramming tools, including a rich reflection API, a LINQ-inspired expression tree API for runtime code generation, and a Java decompiler.
  - Cfr - An open-source Java decompiler that supports decompilation of Android APK files into Java source code, including support for newer Java language features.
  - FernFlower - Fernflower is the first actually working analytical decompiler for Java and probably for a high-level programming language in general.
  - ☆ Apktool - A popular open-source tool for decompiling and recompiling Android APK files.
  - DEX2JAR - A tool for converting Android DEX files to JAR files, which can be further analysed using Java decompilers.
  - IDA Pro - A powerful commercial disassembler and debugger for analysing Android native code.
  - ☆ Ghidra - A free and open-source software reverse engineering (SRE) framework developed by the National Security Agency (NSA) that supports Android analysis.
  - Radare2 - A free and open-source reverse engineering framework that supports Android analysis, including disassembly, debugging, and binary analysis.
  - Androguard - An open-source tool for analysing and reverse engineering Android apps, including decompiling APK files, analysing Dalvik bytecode, and more.
  - ☆ APKLab - VS Code extension integrating multiple tools.
  - show-java - APK, JAR & Dex decompiler.
  - ☆ JADX - Decompiles APKs into Java source code.
  - Androguard - Analyzes and reverse engineers Android apps.
  - DEX2JAR - Converts DEX files to JAR files.
  - APK Studio - Qt-based IDE for reverse-engineering APKs.
  - Cfr - Supports decompilation of Android APK files.
  - apk2gold - Decompiles Android apps to Java (note: may be outdated).
  - AndroidProjectCreator - Converts APKs to Android Studio projects.
  - Procyon - Suite of Java decompilation tools.
  - ☆ Apktool - Popular tool for decompiling/recompiling APK files.
  - ☆ Ghidra - Free and open-source SRE framework.
  - FernFlower - Analytical decompiler for Java.
- Malware Analysis
  - DroidDetective - Machine learning malware analysis for Android apps.
  - Cuckoo Droid - Automated Android malware analysis with Cuckoo Sandbox.
  - androwarn - Static code analyzer for malicious Android applications.
CTFs and CrackMes
- Case Studies
  - ☆ UnCrackable Mobile Apps - A set of OWASP Android app Crackme's. These challenges are used as examples throughout the OWASP MASTG. Of course, you can also solve them for fun.
  - KGB Messenger - CTF challenge for learning Android reverse engineering.
  - CyberTruckChallenge19 - Security workshop material from CyberTruck Challenge 2019.
  - ☆ UnCrackable Mobile Apps - OWASP Android app CrackMes.
  - Flare-On Challenge - High-level reverse engineering CTF with Android challenges.
  - OverTheWire Narnia - Not Android-specific but excellent for binary exploitation practice.
Obfuscation & Anti-Reversing
- Case Studies
  - DexGuard - Commercial tool for advanced app obfuscation.
  - ProGuard - Code shrinker, optimizer, and obfuscator.
  - R8 - Google’s code shrinker and obfuscator.
  - Android Tamper Detection Framework (ATDF) - Implements tamper detection.
  - Paranoid - Detects root and tampering.
  - libhooker - Detects hooking frameworks like Frida and Xposed.
Training
- Courses and Material
  - ☆ Maddie Stone's Android Reverse Engineering Training - A comprehensive online training course on Android reverse engineering by Maddie Stone.
  - Introduction to Assembly from Azeria Labs - Covering everything from data types, registers, the ARM instruction set, memory instructions, and more.
  - ☆ Maddie Stone's Android Reverse Engineering Training - A comprehensive online training course on Android reverse engineering by Maddie Stone.
  - Android Penetration Testing From #TODO - This course will see you develop a baseline knowledge of what is involved in mobile penetration testing along with the specific tools, techniques, and frameworks involved in taking apart and analyzing Android applications.
- Books
  - The IDA Pro Book - Essential for advanced IDA Pro techniques.
  - ☆ Android Internals: A Confectioner's Cookbook - An in-depth exploration of the inner-workings of Android: In Volume I, we take the perspective of the Power User as we delve into the foundations of Android, filesystems, partitions, boot process, native daemons and services.
  - Blue Fox: Arm Assembly Internals and Reverse Engineering - Provides a solid foundation in ARM assembly internals.
  - Android Software Internals Quick Reference - Techniques in Java and Android system internals.
  - ☆ Mobile Offensive Security Pocket Guide - Focusing on Android and iOS operating systems, the book contains a series of succinct chapters that highlight key information, approaches, and tooling used by mobile penetration testers and offensive security practitioners.
  - Android Security Internals - Detailed look into Android security architecture.
  - Android Malware Detection with Machine Learning - Examine the machine-learning techniques used to detect malicious apps, the types of classification models that defenders can use, and the various features of malware specimens that can become input to these models.
  - ☆ Android Internals: A Confectioner's Cookbook - An in-depth exploration of the inner-workings of Android.
  - ☆ Mobile Offensive Security Pocket Guide - Key information, approaches, and tooling for mobile penetration testers.
  - Android Malware Detection with Machine Learning - Machine learning techniques for detecting malicious apps.
  - Android Hacker's Handbook - A deep dive into Android exploitation and forensics.
  - Practical Reverse Engineering - Covers low-level reverse engineering concepts, including ARM assembly.
- Videos
  - Kristina Balaam Android Reverse Engineering - A video series on reverse engineering basics and reverse engineering Android malware.
  - LaurieWired Android Reverse Engineering videos - A YouTube channel focusing on Android reverse engineering.
  - Using Frida To Modify Android Games | Mobile Dynamic Instrumentation - Focusing on reverse engineering Android applications and on using Frida to dynamically modify Android games.
  - Kristina Balaam Android Reverse Engineering - A video series on reverse engineering basics and reverse engineering Android malware.
  - LaurieWired Android Reverse Engineering videos - A YouTube channel focusing on Android reverse engineering.
Firmware & Kernel Analysis
- Case Studies
  - Binwalk - Analyze, extract, and reverse engineer firmware images.
  - AFLSmart - Fuzzer optimized for firmware image analysis.
  - FirmWire - Dynamic analysis platform for baseband firmware.
  - Android Kernel Exploits - Collection of kernel vulnerabilities and exploit techniques.
Misc
- Case Studies
  - LADB - Local ADB shell for Android.
  - Broken Droid Factory - Generates pseudo-random vulnerable Android apps for training.
  - uber-apk-signer - CLI tool for signing and zip aligning APKs.
  - RUNIC tamper detection demo - Demo for understanding Android tamper detection and integrity systems.
Licence
- Case Studies
  - GitHub

Programming Languages

Python 17 Java 12 JavaScript 4 C 2 C++ 2 Kotlin 2 HTML 1 Shell 1 TypeScript 1 Rust 1

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

Awesome-Android-Reverse-Engineering

Resources

Documentation

Case Studies

Tools

Dynamic Analysis Tools

Static Analysis Tools

Decompilers

Malware Analysis

CTFs and CrackMes

Case Studies

Obfuscation & Anti-Reversing

Case Studies

Training

Courses and Material

Books

Videos

Firmware & Kernel Analysis

Case Studies

Misc

Case Studies

Licence

Case Studies