BogusMips

BogusMips is written in Rust and allows performing analyses on how far your Android app can be disassembled. It allows you to open the *.apk or *.xapk file of your app to see how far your app can be disassembled.

_{All releases and changelogs}

Features

• VS Code style interface (Dark+ colors): a sidebar card with Explorer and Search views, an editor with tab and breadcrumbs, a file information panel and a status bar. The File and View menus are in the macOS menu bar, and in the window's menu bar on Windows.
• Open an *.apk or *.xapk with File → Open… (⌘O / Ctrl+O), by dropping it onto the window, or as a command-line argument.
• Left: package tree
  • Source code: every class from all classes*.dex files, grouped by Java package and disassembled to smali.
  • Resources: resources.arsc decoded into the res/values*/*.xml files it was compiled from (strings, colors, dimens, styles, attrs, arrays, plurals, …) plus public.xml with every resource ID.
  • Files: every entry in the archive.
  • XAPK bundles show each contained APK (base and split APKs) separately.
  • Filter box (⌘F) and keyboard navigation with the arrow keys.
  • Right-click an item (or File → Export…, ⌘E) to export it: files as stored in the package, or as shown (decoded binary XML, beautified text); classes as .smali; generated resource files as XML; APKs contained in an XAPK as .apk.
• Search (⇧⌘F): searches the contents of all classes (smali), text files, decoded XML and generated resource files, with match case / whole word / regular expression options. Clicking a result opens it in the editor at the highlighted match. The search index is built in the background on the first search.
• Center: content of the selected item
  • Classes are shown as smali (baksmali-compatible output).
  • Binary XML (AndroidManifest.xml, res/**/*.xml) is decoded. Resource references are resolved to names (@string/app_name, @android:style/Theme), and attribute values to their symbolic names (protectionLevel="signature").
  • Images are previewed, text is shown as text, and everything else as a hex dump.
  • Minified JSON, JavaScript (incl. React Native bundles), CSS, HTML and XML are beautified automatically, with syntax highlighting. Only whitespace is changed; Original shows the file as stored.
  • A hex view is available for any file.
• Right: AI Agent (⇧⌘A) and collapsible file information (⌘I):
  • AI Agent: prompt an AI agent about the disassembled smali source code, decoded resource files (AndroidManifest.xml, resources.arsc values), and captured HTTP/HTTPS network traffic. Configurable with Grok (xAI), Gemini (Google), Claude (Anthropic), OpenAI (ChatGPT), or any custom OpenAI-compatible endpoint (e.g. Ollama, OpenRouter). The agent has built-in tools (search_package, list_nodes, read_node, list_network_flows, inspect_network_flow) to autonomously search and read classes, resources, and captured network flows.
  • File / Request information: size, compression, CRC, SHA-256, DEX header details, class details, manifest summary, permissions, and any anomalies found.

Network

The Network view (⇧⌘N) is a stripped-down, Postman-like traffic sniffer. It starts an Android emulator (AVD), routes the guest's traffic through a built-in man-in-the-middle proxy, installs the open APK/XAPK, launches it, and captures its HTTP and HTTPS requests live. Captured requests appear in a list on the left; selecting one shows its full request/response (headers and body, pretty / raw / hex) in the editor, with timing and connection details in the information panel.

Full HTTPS decryption requires a rootable emulator image (google_apis / aosp_atd, not google_apis_playstore), because the proxy's CA must be installed as a system trust anchor. On start, BogusMips enables adb root and installs its generated CA (a short-lived, per-session CA, as PEM) into the system and Conscrypt (APEX) trust stores. On Android 14+ (API 34+) those stores live in per-process mount namespaces, so the CA is placed in an overlay directory — relabelled with the system_security_cacerts_file SELinux context (both the files and the directory, or apps are denied access) — and bind-mounted over the stores in every process's mount namespace via nsenter. The target app is installed and launched after this, so it forks fresh and its system-trust-store HTTPS is decrypted. Per-host leaf certificates are short-lived and sent without the CA in the chain, to satisfy clients that enforce the 398-day maximum certificate validity.

Caveats — what cannot be decrypted:

• Chrome and WebView / Chromium-based apps. Modern Chromium (the Chrome browser, Android System WebView, and the Cronet networking library) validates server certificates with the Chrome Root Store, which ignores user- or admin-installed system CAs. Such apps show ERR_CERT_AUTHORITY_INVALID; their traffic reaches the proxy but the TLS handshake is rejected. Many hybrid apps (Cordova/Capacitor/Ionic) render in a WebView and fall into this category.
• Apps with certificate pinning, which only accept a specific known certificate.
• Google's own services (Play Services / GMS traffic to *.google.com), which additionally require Certificate Transparency.

What is decrypted: apps using the Android system trust store — HttpURLConnection, OkHttp/Retrofit, Conscrypt and most native networking. (Already-running cached system processes are not re-forked, so they may keep showing trust-anchor errors until restarted; this does not affect the launched target app.)