# credittone/hooker

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/credittone-hooker).**

5,195 stars · 1,264 forks · JavaScript

## Links

- GitHub: https://github.com/CreditTone/hooker
- awesome-repositories: https://awesome-repositories.com/repository/credittone-hooker.md

## Topics

`android` `apk` `boringssl` `frida` `justtrustme` `mcp` `reverse-engineering` `sslunpinning` `xposed`

## Description

Hooker is a toolkit for the dynamic instrumentation, memory analysis, and deobfuscation of Android applications. It functions as a reverse engineering framework that uses Frida to inject scripts into running processes, monitor native calls, and extract executable DEX files.

The project provides specialized utilities for bypassing security controls, including tools to disable SSL certificate validation and BoringSSL pinning to enable HTTPS traffic interception. It includes capabilities for detecting application packing, extracting cryptographic keys by hooking encryption algorithms, and circumventing root or debugging environment checks.

The framework covers a broad range of analysis capabilities, including memory scanning for active component detection, SOCKS5 proxy configuration for network traffic routing, and UI interaction analysis. It also supports the collection of device fingerprints and the debugging of embedded WebViews.

## Tags

### Operating Systems & Systems Programming

- [Frida-Based Instrumentation](https://awesome-repositories.com/f/operating-systems-systems-programming/system-instrumentation-frameworks/android-instrumentation/frida-based-instrumentation.md) — Utilizes Frida to inject JavaScript agents into running Android processes for memory inspection and function interception.
- [Binary Memory Dumping](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-memory-dumping.md) — Extracts executable bytecode from application process memory to recover files from packed or obfuscated binaries.
- [Dynamic Process Instrumentation](https://awesome-repositories.com/f/operating-systems-systems-programming/system-instrumentation-frameworks/android-instrumentation/dynamic-process-instrumentation.md) — Provides a framework for injecting scripts into running Android processes to monitor calls and extract DEX files.

### Development Tools & Productivity

- [Dynamic Instrumentation Hooks](https://awesome-repositories.com/f/development-tools-productivity/application-customization-frameworks/system-hooking-frameworks/dynamic-instrumentation-hooks.md) — Frida automates the process of inserting scripts into running apps to monitor behavior and generate custom interceptors. ([source](https://github.com/credittone/hooker#readme))
- [Android DEX Dumpers](https://awesome-repositories.com/f/development-tools-productivity/java-bytecode-viewers/dex-to-class-converters/android-dex-dumpers.md) — Frida dumps memory to retrieve executable files from protected or packed Android applications. ([source](https://github.com/credittone/hooker#readme))
- [Instrumentation Script Generation](https://awesome-repositories.com/f/development-tools-productivity/automation-scripts/instrumentation-script-generation.md) — Creates scripts for specific classes or methods using memory analysis to automate stack trace printing. ([source](https://github.com/credittone/hooker#readme))

### Mobile Development

- [Android Application Debugging](https://awesome-repositories.com/f/mobile-development/android-application-debugging.md) — Provides tools for inspecting the internal state and monitoring UI interactions of running Android apps.
- [Environment Cloaking](https://awesome-repositories.com/f/mobile-development/android-application-debugging/environment-cloaking.md) — Bypasses root detection and debugging checks to allow instrumentation tools to run on protected applications.
- [Android Traffic Analysis Tools](https://awesome-repositories.com/f/mobile-development/android-traffic-analysis-tools.md) — Routes application data through SOCKS5 proxies and captures SSL traffic for offline analysis.
- [Automated Hook Generation](https://awesome-repositories.com/f/mobile-development/dynamic-hooking/automated-hook-generation.md) — Automates the creation of interceptor scripts by analyzing class structures and method signatures in memory.

### Programming Languages & Runtimes

- [Call Tracing](https://awesome-repositories.com/f/programming-languages-runtimes/native-call-synchronization/managed-to-native-function-calls/call-tracing.md) — Monitors native method registration and execution flows to analyze interactions between high-level and low-level code. ([source](https://github.com/credittone/hooker#readme))

### Security & Cryptography

- [Android Application Reverse Engineering](https://awesome-repositories.com/f/security-cryptography/android-application-reverse-engineering.md) — Analyzes Android applications using Frida to inspect internal functions, map memory, and trace native calls.
- [Certificate Pinning Bypasses](https://awesome-repositories.com/f/security-cryptography/certificate-pinning-bypasses.md) — Overrides certificate validation methods in system libraries to circumvent SSL pinning and enable traffic interception.
- [Mobile Binary Decryption](https://awesome-repositories.com/f/security-cryptography/file-encryptions-and-decryptions/mobile-binary-decryption.md) — Extracts DEX files from packed applications and captures cryptographic keys by hooking encryption algorithms.
- [Environment Detection Bypasses](https://awesome-repositories.com/f/security-cryptography/security-configurations/security-check-bypasses/environment-detection-bypasses.md) — Frida circumvents detection for root access and debugging tools to ensure applications run normally during reverse engineering. ([source](https://github.com/credittone/hooker#readme))
- [Memory Component Detection](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning/scan-contextualization/active-scanning-engines/memory-component-detection.md) — A toolkit for scanning application memory to detect active services and map component addresses.
- [App Deobfuscation Utilities](https://awesome-repositories.com/f/security-cryptography/app-deobfuscation-utilities.md) — Identifies app packing and dumps internal functions to aid in reverse engineering.
- [Runtime Certificate Extractions](https://awesome-repositories.com/f/security-cryptography/cryptography/ssl-tls-certificate-management/certificate-authority-management/certificate-export/runtime-certificate-extractions.md) — Frida extracts client-side certificates as portable files by hooking keystore methods during bidirectional authentication. ([source](https://github.com/credittone/hooker#readme))
- [Packed Executable Warnings](https://awesome-repositories.com/f/security-cryptography/custom-detection-rules/prebuilt-detection-rule-packs/packed-executable-warnings.md) — Frida identifies the hardening technology used in a package by analyzing its runtime behavior. ([source](https://github.com/credittone/hooker#readme))
- [Cryptographic Key Interceptions](https://awesome-repositories.com/f/security-cryptography/encryption-key-management/cryptographic-key-interceptions.md) — Frida intercepts standard encryption functions to capture plaintexts, ciphertexts, and cryptographic keys. ([source](https://github.com/credittone/hooker#readme))
- [SSL Traffic Captures](https://awesome-repositories.com/f/security-cryptography/ssl-traffic-captures.md) — Frida intercepts and saves SSL/TLS traffic into packet capture files for offline analysis. ([source](https://github.com/credittone/hooker#readme))

### Networking & Communication

- [SOCKS5 Traffic Routings](https://awesome-repositories.com/f/networking-communication/proxy-servers/proxy-configurations/session-and-traffic-routing/socks5-traffic-routings.md) — Configures system-level networking to tunnel application traffic through a SOCKS5 proxy for interception and debugging.