Projects sharing features with APKLab

Hooker is a toolkit for the dynamic instrumentation, memory analysis, and deobfuscation of Android applications. It functions as a reverse engineering framework that uses Frida to inject scripts into running processes, monitor native calls, and extract executable DEX files. The project provides specialized utilities for bypassing security controls, including tools to disable SSL certificate validation and BoringSSL pinning to enable HTTPS traffic interception. It includes capabilities for detecting application packing, extracting cryptographic keys by hooking encryption algorithms, and circum

This project is an Android RPA framework designed for automating user interfaces and system tasks on rooted Android devices using Python and ADB. It provides a suite of tools for rooted device management, allowing for programmatic control of system settings, application lifecycles, and shell command execution via a remote API. The framework distinguishes itself through a combination of dynamic instrumentation and AI integration. It can inject scripts into running processes to hook Java interfaces and modifies application behavior in real time. Additionally, it supports large language model in

Apkstudio is a reverse engineering integrated development environment designed for decompiling, modifying, and recompiling Android application packages. It provides a specialized suite for transforming binary files into readable source code and bundling them back into installable application archives. The project features a framework integration system that imports manufacturer-specific files to ensure accurate decompilation of vendor-modified applications. It includes a dedicated editor for Smali, Java, and XML files with syntax highlighting, as well as a hex editor for the direct modificati

Proxypin is a cross-platform HTTP and HTTPS proxy debugger designed to capture, inspect, and modify network traffic. It functions as a man-in-the-middle interceptor, allowing developers to analyze application data flows and validate network communication during development and testing. The tool distinguishes itself through its focus on mobile and remote device integration, utilizing QR-code-based configuration synchronization to simplify the setup of proxy settings and security certificates. It includes an event-driven scripting engine that enables programmatic manipulation of requests and re

This project is a toolkit for reverse engineering, modifying, and re-signing Android application packages. It provides a suite of utilities designed to decompile compiled binary files into readable source code and translate low-level bytecode into formats suitable for human analysis. The tool facilitates security auditing and research by allowing users to extract and interpret manifest metadata, decode Unicode sequences, and inspect internal application logic. Beyond analysis, it supports the modification of application packages, enabling users to rebuild and re-align files to optimize perfor

This project is a proxy server designed to intercept and modify HTTP and HTTPS traffic for Netease Cloud Music. It functions as network middleware to restore playback for songs and albums restricted by geographic regions and to unlock premium account features, such as high-fidelity audio. The server utilizes header-based privilege injection to spoof premium status and employs conditional content redirection to route requests for unavailable media to alternative source providers. It also incorporates upstream proxy routing and IP parameters to bypass regional access restrictions. Additional c

r0capture is a tool for intercepting network traffic from Android applications. It serves as a traffic interceptor, packet sniffer, and client certificate exporter used to analyze application-layer communication on Android devices. The project provides mechanisms to bypass SSL pinning and certificate validation, allowing the decryption of encrypted traffic without modifying device trust stores. It also enables the extraction of client-side certificates from application memory for saving to local device storage. Captured network data is serialized into PCAP files to support offline protocol a

Mitmproxy is an interactive, programmable network proxy engine designed for traffic analysis and protocol manipulation. It functions as a gateway that intercepts, inspects, and modifies network traffic in real-time, supporting HTTP, HTTPS, WebSocket, DNS, and generic TCP or UDP streams. By acting as a trusted certificate authority, the proxy can dynamically generate and sign certificates to decrypt and analyze secure TLS-encrypted connections. The project distinguishes itself through a highly extensible, event-driven architecture that allows users to automate traffic transformation using cust

Reverse engineering and pentesting for Android applications

Simplify is an Android virtual machine sandbox, bytecode execution tracer, and static analysis framework. It serves as a Dalvik bytecode deobfuscator designed to recover readable code from binaries by simulating program behavior without a physical device. The project distinguishes itself by using execution graph analysis to resolve reflection calls and simplify obfuscated code through constant propagation and dead code removal. It employs multi-path execution simulation to track all possible conditional branch outcomes and maps instruction flow to identify constant values. The system covers

The ReVanced Patcher is a framework designed for modifying compiled Android application binaries. It functions as an engine for injecting custom code, altering bytecode, and updating resources directly within package files without requiring access to the original source code. The project distinguishes itself through a modular system that organizes modifications into independent, reusable units. These patches are managed through a dependency-aware execution process that ensures modifications are applied in the correct order, allowing for consistent behavior changes across different application

Smali is a two-way binary translation toolset designed to convert Dalvik bytecode to human-readable assembly and back again. It provides a mechanism for the disassembly and assembly of executable files used in virtual machine environments. The project enables the modification of compiled Android application logic by transforming binary files into editable assembly and rebuilding them. It is used for reverse engineering, malware analysis, and the study of low-level instructions to identify program behavior or security flaws. The toolkit covers binary construction through smali code assembly a

Invidious is a privacy-focused, self-hosted alternative frontend for mainstream video platforms. It operates as a decentralized network of independent instances that provide a lightweight, ad-free interface for consuming media. By acting as a proxy between the user and the content provider, the platform prevents tracking and data collection while maintaining a familiar browsing experience. The project distinguishes itself through its robust suite of network-level traffic management and anonymization tools. It employs techniques such as IP rotation, reverse proxy stream routing, and integratio

Jadx is a comprehensive Java decompilation suite designed to transform compiled binary application files into readable source code. It functions as a static analysis workbench, providing a graphical interface for navigating, searching, and inspecting the internal logic of complex software packages. By utilizing a bytecode-to-Java pipeline, the project reconstructs high-level logical structures from low-level binary instructions, making it a primary tool for Android application reverse engineering. The project distinguishes itself through a sophisticated control flow reconstruction engine and

dex2jar is an Android dex decompiler and reverse engineering tool designed to convert Dalvik executable bytecode into Java class files. It functions as a bytecode converter that transforms compiled Android binaries into a format compatible with standard Java analysis tools. The project facilitates Android app decompilation and Java bytecode recovery by translating executable files into readable structures. This allows for the analysis of application logic and the identification of security vulnerabilities or malicious behavior during Android malware analysis. The tool performs static bytecod

Apktool is an Android APK reverse engineering tool designed to decode application packages into human-readable form and rebuild them after modification. It functions as a Dalvik bytecode disassembler and a resource decoder, transforming binary Android XML and DEX files into editable text and Smali representation. The project serves as an application rebuilder, packing modified resources and Smali code back into a functional Android application package. This capability enables the modification of application logic and resources for testing and deployment. The tool covers a broad surface of an

Xpatch is a collection of specialized utilities designed for modifying and resigning Android application packages to enable rootless hooking and plugin injection. It functions as an APK repackager that allows for the injection of loading logic and the application of new digital signatures to ensure modified binaries can be installed on devices. The project features a rootless hooking tool that inserts plugin loaders into application binaries, enabling runtime modifications without requiring system-level root access. It includes a signature bypass tool to disable internal verification checks,

WAuxiliary_Public is a dynamic code instrumentation framework and application plugin framework designed to intercept and alter the execution flow of compiled applications. It functions as a process injection toolkit and software reverse engineering tool, enabling the injection of custom logic into active application memory spaces to extend functionality without requiring original source code. The framework specifically provides capabilities for extending the WeChat desktop client. It achieves this through runtime process injection and software reverse engineering to modify internal operations

Trojan-go is a network proxy implementation that uses the Trojan protocol to disguise internet traffic as standard TLS to bypass censorship and deep packet inspection. It functions as a tunneling gateway that encapsulates network data within encrypted tunnels to mimic ordinary web browsing. The project distinguishes itself through advanced obfuscation techniques, including TLS fingerprint mimicry to avoid detection by client signature identification and the use of WebSockets to relay encrypted traffic through content delivery networks. It also supports UDP forwarding through the Trojan protoc

jsproxy is a web traffic proxy designed to route requests through a ServiceWorker to bypass network restrictions while minimizing server-side processing overhead. It focuses on browser API virtualization, rewriting URL-related functions and properties so that proxied pages behave as if they are running on their original domains. The project utilizes a decoupled architecture that separates the static user interface from the data forwarding backend, allowing for deployment across multiple providers. It includes weight-based load balancing to distribute traffic across multiple proxy nodes and im

Script is a collection of scripts and rule-sets designed for iOS proxy tools to modify mobile application behavior, filter network traffic, and automate interactions with online services. It provides a library of scripts and a network filter to manage how applications communicate with web services. The project enables the unlocking of premium features, memberships, and VIP content within third-party applications. It also allows for the bypass of geographical restrictions on downloads and the removal of advertisements from mobile application interfaces. The toolset covers the automation of we

Envoy is a cloud-native service proxy and distributed system traffic manager designed to route and control network traffic between services and clients. It operates as an L4 and L7 network proxy, managing communication at the edge and middle levels of a distributed cloud environment. The project provides capabilities for API gateway implementation and edge proxy routing to direct external requests to internal services. It serves as a foundation for service mesh traffic management and cloud-native load balancing to ensure high availability across backend instances. The system also includes to

Redbird is a Node.js reverse proxy used to route external network traffic to internal servers. It functions as a layer 7 load balancer that maps incoming requests from specific domains or hosts to target upstream servers, shielding backend services from direct public exposure. The project features dynamic route management, allowing routing rules to be updated programmatically at runtime. It synchronizes these routes automatically by polling external sources such as Docker containers and etcd clusters to align proxy configurations with service lifecycles. Additional capabilities include SSL a

Dobby is a dynamic function hooking framework and binary instrumentation tool designed to intercept and redirect function calls in compiled binaries. It serves as a cross-platform and cross-architecture library that provides a unified interface for modifying program execution flow across different operating systems and CPU architectures. The library enables low-level binary instrumentation and runtime application instrumentation by injecting custom handlers into live processes. It is used for software reverse engineering to observe real-time data flow and logic by hooking internal functions.

frida-dexdump is an Android memory forensics tool that recovers Dalvik Executable (DEX) files from running application processes using the Frida dynamic instrumentation framework. It functions as a Frida-based runtime analyzer and DEX memory dumper, capable of extracting obfuscated or packed DEX files without modifying the Android system. The tool distinguishes itself through its ability to repair corrupted or missing DEX file headers using heuristic analysis and fuzzy matching techniques. It employs fuzzy boundary detection to identify DEX file boundaries in memory even when headers are dama

Tproxy is a set of command-line utilities designed for throttling bandwidth, simulating network latency, proxying TCP traffic, and analyzing connection stability. It provides a toolset for redirecting network traffic from local ports to remote destinations while monitoring the resulting connection behavior. The project differentiates itself by combining traffic manipulation with diagnostic monitoring. It can introduce configurable packet delays and cap upload and download transfer speeds to simulate constrained or low-bandwidth network environments. Beyond traffic control, the utilities incl

Xray is a security assessment tool focused on web vulnerability scanning, attack surface mapping, and technology fingerprinting. It identifies common security flaws through automated scanning and semantic analysis, while verifying findings via a custom proof-of-concept execution engine. The system distinguishes itself with a containerized vulnerability testbed used to deploy pre-configured vulnerable applications. This environment allows for the simulation of specific vulnerabilities and edge-case scenarios to validate scanner accuracy and eliminate false positives. The platform covers a bro