Open-source alternatives to Andromeda

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

GUI for Frida -Scripts

APKLab is an integrated security analysis platform and reverse engineering IDE for Android applications. It provides a unified environment for decompiling binaries into source code, repackaging modified applications into signed installers, and performing comprehensive security analysis. The platform distinguishes itself by combining static and dynamic analysis workflows. It enables the injection of runtime hooks and gadget libraries to monitor application behavior, while providing specialized patching capabilities to intercept and decrypt encrypted network traffic via a proxy. The toolkit co

Android Framework for Exploitation, is a framework for exploiting android based devices

RetDec is a reverse engineering framework and static binary analysis tool. Its primary purpose is to function as an LLVM-based machine code decompiler that translates binary machine code from multiple architectures into high-level C source code. The system employs a multi-stage lifting pipeline to recover program logic, using an intermediate representation to apply optimizations before emitting source code. It distinguishes itself through the ability to identify compilers and packers, perform executable unpacking, and reconstruct class hierarchies and original program structures. The framewo

PhoneSploit-Pro is an Android exploitation and remote administration toolkit. It provides a system for remotely controlling Android devices and extracting data using the Android Debug Bridge protocol. The project integrates with Metasploit to automate the creation and installation of payloads, establishing persistent command-and-control sessions. It also includes a network device scanner to identify active Android hosts on local networks by probing TCP ports. The toolkit covers a broad range of administrative and forensic capabilities, including remote shell execution, application management

ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.

Simplify is an Android virtual machine sandbox, bytecode execution tracer, and static analysis framework. It serves as a Dalvik bytecode deobfuscator designed to recover readable code from binaries by simulating program behavior without a physical device. The project distinguishes itself by using execution graph analysis to resolve reflection calls and simplify obfuscated code through constant propagation and dead code removal. It employs multi-path execution simulation to track all possible conditional branch outcomes and maps instruction flow to identify constant values. The system covers

An automatic obfuscation tool for Android apps that works in a black-box fashion, supports advanced obfuscation features and has a modular architecture easily extensible with new techniques

Python Command-Line Ghidra Binary Diffing Engine

Fernflower is a Java bytecode decompiler and reverse engineering tool. It transforms compiled Java class files back into human-readable Java source code to reconstruct original program logic and variable names. The tool functions as a command line bytecode processor capable of batch processing Java archives and class files. It specifically handles obfuscated code analysis by renaming ambiguous identifiers and resolving naming conflicts to make the resulting source code easier to follow. The system employs static analysis to convert bytecode to source, utilizing debug information extraction t

Frida is a dynamic binary instrumentation toolkit that provides a framework for deep process introspection and live application state manipulation. It enables the injection of custom scripts into running processes to trace function calls, modify memory, and analyze application behavior in real-time across diverse operating systems and processor architectures. The project distinguishes itself by embedding a high-performance JavaScript engine directly within the target process, allowing for the execution of user-defined logic for real-time inspection. It utilizes instruction-level hooking to re

Gnirehtet is a reverse tethering tool that allows Android devices to share a computer's internet connection over USB. It functions as a network relay for TCP and UDP IPv4 traffic using the Android Debug Bridge protocol. The system provides connectivity for Android devices without requiring root access by utilizing a local virtual network interface to intercept traffic. It includes a manager capable of controlling and resetting relay sessions for multiple connected devices from a single server. The tool supports batch connection activation and the management of individual device tunnels. It e

Run arbitrary code by patching OAT files

dexmod is a tool written in python to exemplify patching Dalvik bytecode in a DEX (Dalvik Executable) file, and assist in the static analysis of Android applications.

Enjarify is a tool for translating Dalvik bytecode to equivalent Java bytecode. This allows Java analysis tools to analyze Android applications.

Full featured multi arch/os debugger built on top of PyQt5 and frida

Bypass signature and permission checks for IPCs

Make any application debuggable

Security profiling for blackbox Android

This project is a desktop application designed for the reverse engineering and inspection of compiled Java code. It functions as a graphical interface that translates Java bytecode back into readable source code, allowing users to examine the internal logic of class files and archives when original source files are unavailable. The tool provides a structured environment for navigating complex file hierarchies, including nested archives like JAR and WAR files. By maintaining an in-memory representation of loaded classes, it enables rapid searching and cross-referencing of code elements. The ap

Smali is a two-way binary translation toolset designed to convert Dalvik bytecode to human-readable assembly and back again. It provides a mechanism for the disassembly and assembly of executable files used in virtual machine environments. The project enables the modification of compiled Android application logic by transforming binary files into editable assembly and rebuilding them. It is used for reverse engineering, malware analysis, and the study of low-level instructions to identify program behavior or security flaws. The toolkit covers binary construction through smali code assembly a

Diaphora is a binary diffing tool and similarity engine designed to compare compiled binaries and identify changed or matching code sections. It functions as a reverse engineering plugin that maps relationships between functions and detects compilation units using assembler analysis and graph theory. The project specializes in vulnerability patch analysis, allowing users to detect security fixes by comparing different versions of a binary. It synchronizes analysis metadata, such as symbol names and comments, between binaries and generates patches by comparing decompiled pseudo-code. The engi

This project is a Java bytecode reverse engineering suite that functions as a disassembler, decompiler, and editor for Java class files and Android APK binaries. It provides tools to transform compiled bytecode into assembly instructions or readable source code. The toolset supports Android APK analysis and Java binary patching, allowing for the modification of source code or bytecode and subsequent recompilation into functional binaries. It includes capabilities for removing Java obfuscation and performing malware analysis through the detection of malicious code patterns. The system incorpo

Malimite is an iOS and macOS decompiler designed to help researchers analyze and decode IPA files and Application Bundles.