Awesome GitHub RepositoriesAndroid Analysis

Jadx is a comprehensive Java decompilation suite designed to transform compiled binary application files into readable source code. It functions as a static analysis workbench, providing a graphical interface for navigating, searching, and inspecting the internal logic of complex software packages. By utilizing a bytecode-to-Java pipeline, the project reconstructs high-level logical structures from low-level binary instructions, making it a primary tool for Android application reverse engineering. The project distinguishes itself through a sophisticated control flow reconstruction engine and

Apktool is an Android APK reverse engineering tool designed to decode application packages into human-readable form and rebuild them after modification. It functions as a Dalvik bytecode disassembler and a resource decoder, transforming binary Android XML and DEX files into editable text and Smali representation. The project serves as an application rebuilder, packing modified resources and Smali code back into a functional Android application package. This capability enables the modification of application logic and resources for testing and deployment. The tool covers a broad surface of an

dex2jar is an Android dex decompiler and reverse engineering tool designed to convert Dalvik executable bytecode into Java class files. It functions as a bytecode converter that transforms compiled Android binaries into a format compatible with standard Java analysis tools. The project facilitates Android app decompilation and Java bytecode recovery by translating executable files into readable structures. This allows for the analysis of application logic and the identification of security vulnerabilities or malicious behavior during Android malware analysis. The tool performs static bytecod

Detect-It-Easy is a binary file identifier and analysis toolkit designed to determine file formats, compilers, and packers. It functions as a binary file identifier that utilizes signature matching and heuristic analysis to identify executable and archive formats. The project includes a custom file signature engine and a scriptable rule system for defining and applying detection logic to identify specific binary patterns. It features specialized detectors for Android packages, such as APK and DEX files, and a malware packer detector to identify protections, obfuscators, and virus families. T

Android Classyshark is a binary analysis toolset designed to extract structural data from Android executable files. It functions as a bytecode viewer and binary XML parser to analyze compiled Java and Android binaries. The project converts binary XML files into readable formats for the inspection of application manifests, layouts, and resource files. It also provides the ability to analyze class interfaces, members, and dependency counts without requiring access to the original source code. The toolset supports static analysis and the export of binary information into plain text formats for

BlackDex is an Android runtime-level DEX extraction tool that recovers bytecode from protected APK files across Android versions 5 through 12 without requiring root access. It operates by hooking system APIs, reading DexFile cookies, and repairing obfuscated method bodies from memory, supporting both 32-bit and 64-bit architectures for installed and uninstalled applications. The tool distinguishes itself through a multi-method approach that combines cookie-based dumping, API hooking, and memory-based instruction repair to handle first through third generation packers. It reconstructs method b

Este proyecto es una suite integral de ingeniería inversa para Android que funciona como descompilador, desofuscador de bytecode y herramienta de análisis de malware. Está diseñado para convertir binarios APK, DEX y OAT en código fuente legible por humanos utilizando una implementación nativa que no requiere una Máquina Virtual Java. La plataforma destaca por su integración con Frida para el análisis dinámico, permitiendo a los usuarios enganchar métodos, inyectar JavaScript personalizado y volcar la memoria del dispositivo en tiempo real. También cuenta con motores de seguridad especializados, incluyendo un motor de propagación de contaminación (taint propagation) y una máquina de estados de pila, para detectar fugas de privacidad, comportamientos maliciosos y vulnerabilidades de seguridad. La suite cubre una amplia gama de capacidades analíticas, incluyendo el parcheo y reempaquetado de binarios, mapeo de dependencias de referencias cruzadas y análisis de flujo de datos. Proporciona herramientas para la identificación de empaquetadores de software, decodificación de cadenas cifradas y búsqueda global de metadatos a través de los recursos de la aplicación. La herramienta proporciona una interfaz de línea de comandos y admite la automatización del análisis mediante scripts personalizados en Python o Java.