Open-source alternatives to Andromeda

GUI for Frida -Scripts

Android Reverse-Engineering Workbench for VS Code

Android Framework for Exploitation, is a framework for exploiting android based devices

RetDec is a reverse engineering framework and static binary analysis tool. Its primary purpose is to function as an LLVM-based machine code decompiler that translates binary machine code from multiple architectures into high-level C source code. The system employs a multi-stage lifting pipeline to recover program logic, using an intermediate representation to apply optimizations before emitting source code. It distinguishes itself through the ability to identify compilers and packers, perform executable unpacking, and reconstruct class hierarchies and original program structures. The framewo

PhoneSploit-Pro is an Android exploitation and remote administration toolkit. It provides a system for remotely controlling Android devices and extracting data using the Android Debug Bridge protocol. The project integrates with Metasploit to automate the creation and installation of payloads, establishing persistent command-and-control sessions. It also includes a network device scanner to identify active Android hosts on local networks by probing TCP ports. The toolkit covers a broad range of administrative and forensic capabilities, including remote shell execution, application management

ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.

Android virtual machine and deobfuscator

An automatic obfuscation tool for Android apps that works in a black-box fashion, supports advanced obfuscation features and has a modular architecture easily extensible with new techniques

Python Command-Line Ghidra Binary Diffing Engine

Decompiler from Java bytecode to Java, used in IntelliJ IDEA.

Frida is a dynamic binary instrumentation toolkit that provides a framework for deep process introspection and live application state manipulation. It enables the injection of custom scripts into running processes to trace function calls, modify memory, and analyze application behavior in real-time across diverse operating systems and processor architectures. The project distinguishes itself by embedding a high-performance JavaScript engine directly within the target process, allowing for the execution of user-defined logic for real-time inspection. It utilizes instruction-level hooking to re

Gnirehtet is a reverse tethering tool that allows Android devices to share a computer's internet connection over USB. It functions as a network relay for TCP and UDP IPv4 traffic using the Android Debug Bridge protocol. The system provides connectivity for Android devices without requiring root access by utilizing a local virtual network interface to intercept traffic. It includes a manager capable of controlling and resetting relay sessions for multiple connected devices from a single server. The tool supports batch connection activation and the management of individual device tunnels. It e

Run arbitrary code by patching OAT files

dexmod is a tool written in python to exemplify patching Dalvik bytecode in a DEX (Dalvik Executable) file, and assist in the static analysis of Android applications.

Enjarify is a tool for translating Dalvik bytecode to equivalent Java bytecode. This allows Java analysis tools to analyze Android applications.

Full featured multi arch/os debugger built on top of PyQt5 and frida

Bypass signature and permission checks for IPCs

Make any application debuggable

Security profiling for blackbox Android

This project is a desktop application designed for the reverse engineering and inspection of compiled Java code. It functions as a graphical interface that translates Java bytecode back into readable source code, allowing users to examine the internal logic of class files and archives when original source files are unavailable. The tool provides a structured environment for navigating complex file hierarchies, including nested archives like JAR and WAR files. By maintaining an in-memory representation of loaded classes, it enables rapid searching and cross-referencing of code elements. The ap

Smali is a two-way binary translation toolset designed to convert Dalvik bytecode to human-readable assembly and back again. It provides a mechanism for the disassembly and assembly of executable files used in virtual machine environments. The project enables the modification of compiled Android application logic by transforming binary files into editable assembly and rebuilding them. It is used for reverse engineering, malware analysis, and the study of low-level instructions to identify program behavior or security flaws. The toolkit covers binary construction through smali code assembly a

Diaphora, the most advanced Free and Open Source program diffing tool.

This project is a Java bytecode reverse engineering suite that functions as a disassembler, decompiler, and editor for Java class files and Android APK binaries. It provides tools to transform compiled bytecode into assembly instructions or readable source code. The toolset supports Android APK analysis and Java binary patching, allowing for the modification of source code or bytecode and subsequent recompilation into functional binaries. It includes capabilities for removing Java obfuscation and performing malware analysis through the detection of malicious code patterns. The system incorpo

Malimite is an iOS and macOS decompiler designed to help researchers analyze and decode IPA files and Application Bundles.