#1Tools focused on penetration testing, reversing, and securing Android apps and the Android OS.
Kitploit recommended
permissionlesstech/bitchat-androidDecentralized, encrypted peer-to-peer messaging app over Bluetooth mesh networks. No internet, servers, or phone numbers required. Features X25519 +…
ablation-tool/ablationReverse engineering framework with disassembly, decompilation, taint analysis, version diffing and semantic search, plus LLM-driven autonomous binary…
amd2g2zz/kunglao-agentThe reverse-engineering expert agent: plans its own analysis path, derives every fact from raw evidence, and converges under mechanical verification…
ibotpeaches/apktoolA tool for reverse engineering Android apk files
nowsecure/r2fridaRadare2 and Frida better together.
piotr-kniaz/eslockdecryptorTool for recovering and decrypting ES File Explorer encrypted files (.eslock)
ch0pin/medusaMobile Edge-Dynamic Unified Security Analysis
librepods-org/librepodsAirPods liberated from Apple's ecosystem.
topjohnwu/magiskAndroid customization suite providing root access (MagiskSU), systemless module installation, boot image unpacking/repacking, and Zygisk runtime code…
knowlily/cve-2026-43499-honorCVE-2026-43499 (GhostLock) rt_mutex stack-UAF privilege escalation research on Honor BVL-AN16 (Magic6 Pro, SM8650, kernel 6.1.128). Includes analysis…
ch0pin/rdxA native APK and DEX decompiler written in Rust
marin-m/pbtkA toolset for reverse engineering and fuzzing Protobuf-based apps
impact-i/reflutterPatches Flutter engine libraries to enable runtime reverse engineering, traffic interception, and SSL pinning bypass for Android and iOS apps without…
1-3-7/disrobeRust CLI suite that statically decompiles, deobfuscates, and unpacks native code, bytecode, scripts, firmware, and app packages across 15+ ecosystems…
crissyfield/super-trouperMCP server exposing Frida instrumentation as tools for coding agents to connect to devices, inspect processes, manage sessions, and load JavaScript…
droid-ash/finalrun-agentAI-driven CLI for testing Android and iOS apps using natural language. Generates, runs, and fixes end-to-end tests on emulators/simulators with…
xiaohj233/ghostlock-x200-appvivo X200 设备端一键 root App（Shizuku 授权 shell 域执行，CVE-2026-43499）
zaproxy/zaproxyOpen-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…
