Awesome Android Reverse Engineering

A curated list of awesome Android Reverse Engineering training, resources, and tools.

How to Use

Awesome-Android-Reverse-Engineering is an amazing list for people who work in taking apart Android applications, systems, or components. Simply press ctrl + F to search for a keyword, go through our Contents Menu, or lookout for a '☆' indicating some great and up-to-date resources.

Contents

• Training
  • Courses and Material
  • Videos
  • Books
• Tools
  • Static Analysis Tools
  • Dynamic Analysis Tools
  • Decompilers
  • Malware Analysis
• Resources
  • Documentation
  • Case Studies
• CTFs and CrackMes
• Misc
• Obfuscation & Anti-Reversing
• Firmware & Kernel Analysis
• Cloud API & Web Services Reversing

Training

Courses and Material

• ☆ Maddie Stone's Android Reverse Engineering Training - A comprehensive online training course on Android reverse engineering by Maddie Stone.
• Introduction to Assembly from Azeria Labs - Covering everything from data types, registers, the ARM instruction set, memory instructions, and more.

Videos

• Kristina Balaam Android Reverse Engineering - A video series on reverse engineering basics and reverse engineering Android malware.
• LaurieWired Android Reverse Engineering videos - A YouTube channel focusing on Android reverse engineering.
• Using Frida To Modify Android Games | Mobile Dynamic Instrumentation - Focusing on reverse engineering Android applications and on using Frida to dynamically modify Android games.

Books

• ☆ Android Internals: A Confectioner's Cookbook - An in-depth exploration of the inner-workings of Android.
• Blue Fox: Arm Assembly Internals and Reverse Engineering - Provides a solid foundation in ARM assembly internals.
• Android Software Internals Quick Reference - Techniques in Java and Android system internals.
• ☆ Mobile Offensive Security Pocket Guide - Key information, approaches, and tooling for mobile penetration testers.
• Android Security Internals - Detailed look into Android security architecture.
• Android Malware Detection with Machine Learning - Machine learning techniques for detecting malicious apps.
• Android Hacker's Handbook - A deep dive into Android exploitation and forensics.
• Practical Reverse Engineering - Covers low-level reverse engineering concepts, including ARM assembly.
• The IDA Pro Book - Essential for advanced IDA Pro techniques.

Tools

Static Analysis Tools

• QARK - An open-source tool for automatic Android app vulnerability scanning.
• Quark Engine - Integrates various tools as Quark Script APIs for mobile security research.
• MobSF - Supports both static and dynamic analysis for Android app security testing.
• AndroBugs Framework - Analyzes and scans Android apps for security issues.
• ☆ imjtool - Firmware unpacking tool for various vendors and formats.
• Android Studio - Useful for analyzing decompiled apps via an IDE.
• ☆ APK Dependency Graph - Visualizes APK class dependencies.
• disarm - Command line utility for parsing ARM-64 instructions.
• COVA - Computes path constraints based on user-defined APIs.
• DIS{integrity} - Analyzes APKs for root, integrity, and tamper detection.
• Dexcalibur - Automated tool for analyzing and instrumenting Android applications.

De-Obfuscation

• ☆ Obfu[DE]scate - De-obfuscation tool that uses fuzzy comparison logic.
• TinySmaliEmulator - Minimalist smali emulator for "decrypting" obfuscated strings.
• simplify - Android virtual machine and deobfuscator.
• deoptfuscator - Tool for deobfuscating apps using control-flow obfuscation.

Dynamic Analysis Tools

• Drozer - Framework for Android security testing with dynamic analysis features.
• jtrace - Similar to strace, but for Android system calls.
• sesearch - Command line tool for querying SELinux policies.
• AutoDroid - Mass APK gathering and analysis tool.
• Networking:
  • ☆ Burp Suite - Commercial tool for analyzing network traffic of Android apps.
  • Wireshark - Open-source network protocol analyzer.
  • SSLsplit - Intercepts and manipulates SSL/TLS encrypted traffic.
  • MITMProxy - Man-in-the-middle proxy for analyzing network traffic.
  • apk-mitm - Prepares APKs for HTTPS inspection.
• Dynamic Instrumentation:
  • ☆ Frida - Dynamic instrumentation toolkit for runtime manipulation.
  • Xposed Framework - For hooking and modifying app behavior at runtime.
  • ☆ Objection - Runtime exploration tool to bypass app security controls.
  • RMS Runtime Mobile Security - Frida web interface.
  • ☆ FriDump - Uses Frida to dump memory of running apps.
  • jnitrace - Frida-based JNI API tracer.
  • ☆ Binder Trace - Intercepts and parses Android Binder messages.