Open-source alternatives to Epic

JustTrustMe is an Android security auditing tool and mobile application penetration testing utility. Its primary purpose is to bypass hardcoded certificate requirements and disable SSL pinning in mobile applications to allow the inspection of encrypted API requests and responses. The project functions as a dynamic method hooking module that integrates with the Xposed framework. It uses system-level instrumentation to intercept Java runtime function calls and override security checks within third-party Android applications. The tool covers a range of capabilities including the disabling of SS

tiny-spring is a Java inversion of control container and aspect-oriented programming framework. It provides a system for managing object lifecycles and dependency injection to decouple application components. The project features a bytecode proxy generator that enables method interception and behavioral modification for classes that do not implement interfaces. It uses pointcut expressions to match specific classes and methods for the execution of cross-cutting logic via dynamic proxies. The framework manages singleton components and resolves object dependencies using lazy initialization. Ap

Aspects is an aspect-oriented programming library and method hooking framework designed for intercepting and modifying JavaScript function behavior without altering the original source code. It serves as a runtime logic injector that allows for the addition and removal of executable code wrappers from active functions. The library enables the injection of custom logic before or after methods to change application behavior at runtime. It further provides the ability to intercept method calls to capture or override return values before they reach the caller. The framework manages these interce

jvm-sandbox is a bytecode instrumentation framework and plugin container for the Java Virtual Machine. It acts as a runtime application modifier that enables the injection and modification of bytecode in a running process without requiring an application restart or changes to the original source code. The system provides a non-invasive aspect-oriented programming framework to intercept method execution and alter behavior in live processes. It functions as an isolated environment for functional modules, employing a custom class loader hierarchy to prevent dependency conflicts between plugins a

Harmony is a library for modifying, replacing, and decorating compiled .NET and Mono methods during execution without altering binary files on disk. It functions as a runtime method patching tool, a CIL instruction manipulator, and a reflection extension for C#. The project provides mechanisms to intercept method execution, allowing custom code to run before or after original methods while maintaining the existing program flow. It enables the analysis and rewriting of Common Intermediate Language instructions to change the internal logic of compiled methods. The toolkit also includes utiliti

This project is a comprehensive Android reverse engineering suite that functions as a decompiler, bytecode deobfuscator, and malware analysis tool. It is designed to convert APK, DEX, and OAT binaries into human-readable source code using a native implementation that does not require a Java Virtual Machine. The platform is distinguished by its integration with Frida for dynamic analysis, allowing users to hook methods, inject custom JavaScript, and dump device memory in real time. It also features specialized security engines, including a taint propagation engine and a stack-state machine, to

tModLoader is a modding framework and toolset designed for expanding game content and extending core game logic. It provides a polymorphic content API that allows for the creation of new items, NPCs, projectiles, and world assets through object-oriented inheritance. The project is distinguished by its advanced code modification capabilities, utilizing intermediate language bytecode patching and reflection-based private access to alter internal game behavior. It features a hot-reloading assembly runtime that enables developers to recompile and apply source code changes in real-time without res

Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)

Drozer is a security testing framework for Android applications that operates through an agent-based remote execution model. It combines a client-server command routing system with a device-side agent, enabling security assessments by mapping inter-process communication (IPC) attack surfaces and running dynamic exploit modules directly on Android devices. The framework distinguishes itself through its ability to discover and enumerate exported Android components by analyzing manifest data and crafting Intents to probe for vulnerabilities. It supports content provider query injection to detect

LSPosed is an Android runtime hooking framework and system modification tool. It enables the modification of application and system behavior in memory without altering original installation files, serving as a platform for distributing and managing community-created extension modules. The project provides a comprehensive suite for device and identity spoofing, including the ability to mask hardware identifiers, simulate geographic locations, and conceal root access or hooking frameworks to bypass security and integrity checks. It also functions as an application modder to unlock premium featu

ProxyManager is a JavaScript proxy wrapper library and object-oriented utility for intercepting and modifying object behavior. It functions as an object behavior interceptor that wraps target objects to monitor, restrict, or modify method calls and property access at runtime. The library provides mechanisms for lazy initialization and lazy loading, deferring the creation of resource-heavy objects until a property or method is first accessed to reduce memory overhead. It uses an object-oriented structure to manage these proxy wrappers and their associated target objects. The tool covers capab

Xposed is a native Android runtime hooking framework and instrumentation tool. It provides a modified version of the Android app process binary to intercept and modify the behavior of system and application processes at the binary level. The framework enables Android operating system customization by altering internal function calls and runtime execution flow. It achieves this through native process instrumentation, allowing for the modification of functionality without altering original application files. The tool covers several low-level capabilities, including native library injection and

cglib is a suite of tools for JVM bytecode generation, class transformation, and dynamic proxying. It provides a high-level API for creating and transforming Java bytecode at runtime to modify class behavior and a framework for intercepting method calls and field access. The project implements dynamic proxy generation to support aspect oriented programming and custom data access patterns. It also includes a serialization manager to implement serialization contracts by adding specific methods and controlling object replacement within proxy classes. The library covers bytecode manipulation and

Powermock is a Java mocking framework and unit testing tool that uses bytecode manipulation to mock static methods, final classes, and private constructors. It includes a Java agent instrumentation tool and a reflection-based testing utility to bypass encapsulation and modify class behavior at runtime. The project distinguishes itself by providing the ability to intercept the instantiation of objects via the new keyword and simulate the behavior of core Java system classes and native methods. It can override final modifiers on classes and methods and bypass signature restrictions for classes

btrace is a JVM dynamic tracing tool and performance profiler used for injecting safe instrumentation scripts into a running Java Virtual Machine without requiring a process restart. It functions as a Java agent framework and a Model Context Protocol server, exposing JVM diagnostic operations and tracing tools to large language models and AI assistants. The project distinguishes itself by enabling real-time code injection and bytecode-level instrumentation via a secure binary protocol. It ensures production stability through a static safety analysis engine that blocks unstable code patterns,

Windhawk is a Windows OS modding framework and user-mode code injector designed to customize the behavior of Windows applications and system components. It functions as a process customization tool and API hooking engine that allows for the insertion of custom logic into running programs. The framework enables software behavior modification and user interface tweaking without requiring access to the original source code. This is achieved by intercepting function calls and altering how software interacts with the operating system to implement patches or feature enhancements. The system covers

OpenTelemetry PHP is a standard-compliant observability framework designed to instrument applications for the collection and export of telemetry data. It provides a comprehensive suite of tools for capturing traces, metrics, and logs, enabling developers to monitor operational behavior and system performance in real time. The project distinguishes itself through an interface-driven plugin architecture that allows for the modular configuration of exporters, processors, and samplers. To maintain performance in production environments, it supports the use of native binary extensions for data ser

ZygiskNext is an Android rooting integration layer and system hooking framework. It functions as a code injector for the Android Zygote process, allowing for the modification of system behavior across various rooting environments and superuser managers. The project provides a specialized API to intercept and modify low-level system calls. This enables the injection of custom code into the base process that spawns applications, facilitating deep Android system customization and rooted development. The framework utilizes dynamic library loading, hook-based runtime modification, and Java Native

Small-Spring is a simplified Java implementation of the Spring framework designed to study the internal architecture of inversion of control containers and dependency injection frameworks. It functions as a bean container that manages object lifecycles and resolves dependencies through automated instantiation and property injection. The project implements a mechanism for intercepting method calls using dynamic proxies to support aspect-oriented programming. It separates cross-cutting concerns from business logic by wrapping target objects to modify method executions. The system covers compon

VirtualApp is an Android application virtualization engine and user-space sandbox that enables the execution of applications within an isolated environment. It allows for the running of multiple independent instances of the same application on a single device and supports private application installation without requiring system-level root access. The project features a comprehensive hooking framework for intercepting Java and native layer functions to modify application behavior. It includes tools for hardware simulation to spoof device models and system information, as well as a non-root pr

This project is a comprehensive security hardening and privacy management guide for macOS. It provides a set of instructions and checklists for reducing the system attack surface through manual configuration, policy enforcement, and a layered defense strategy. The guide emphasizes a system auditing framework, using binary analysis, system logs, and packet inspection to verify that security controls and application sandboxing are functioning as intended. It offers tool-agnostic recommendations, defining security goals while allowing users to select their own third-party software for implementa

Mockito is a Java mocking framework and JUnit testing library used to create simulated objects and stub method calls to isolate components during unit tests. It functions as a dynamic proxy generator and bytecode instrumentation tool, allowing for the creation of runtime substitutes that mimic the behavior of real classes. The framework distinguishes itself by providing the ability to mock final classes and methods, bypassing standard language restrictions through bytecode modification. This capability enables the testing of legacy code that lacks interfaces. The toolset covers behavioral mo

mini-spring is a Java dependency injection framework and inversion of control container. It manages the full lifecycle of beans, including instantiation, property population, and scope management, while providing a system for automating the wiring of components. The project implements a Java AOP framework that uses dynamic proxies to intercept method calls for cross-cutting logic. It also functions as a Java component scanner to automatically discover and register managed objects via annotations and as a Java event bus to decouple components through a publish-subscribe multicast system. The

Moq4 is a .NET mocking framework used to create simulated implementations of interfaces and abstract classes. It serves as a test double generator and behavior verification tool, allowing developers to isolate code during unit testing by replacing real dependencies with programmed mocks. The framework enables the definition of expected method behaviors and return values to control the execution flow of tests. It provides specialized capabilities for simulating methods that use output or reference parameters and mechanisms to monitor and trigger events on simulated objects. The library includ

Prophecy is a PHP mocking framework and test double library used to simulate object dependencies during unit testing. It serves as a behavioral testing tool for creating mocks, stubs, and dummies to isolate code and ensure predictable test results. The framework enables interaction verification by tracking method call counts and arguments to validate that specific interactions occurred. It supports defining specific return values or custom logic for method calls to simulate various execution scenarios. The library provides capabilities for argument matching based on type or value, interactio

xHook is a low-level instrumenter and hooking library for Android ELF binaries. It functions as a framework for intercepting native symbols and redirecting function calls by modifying the procedure linkage table. The tool utilizes regular expressions to filter specific binary files and symbols for interception. It enables the redirection of native calls toward custom function implementations without altering the original binary files. The framework covers dynamic symbol resolution, ELF table modification, and security analysis of native libraries. It also includes stability mechanisms that u