Tools

facebook/mariana-trench

A security focused static analysis tool for Android and Java applications.

bytedance/appshark

Static taint analysis platform for Android apps that detects vulnerabilities and compliance issues using customizable rule-based scanning and…

d78ui98/apkdeeplens

Android security insights in full spectrum.

honeynet/apkinspector

APKinspector is a powerful GUI tool for analysts to analyze the Android applications.

mobsf/mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and…

maoabc/nmmp

dex-vm used to protect the android classes.dex file

xtiankisutsa/mara_framework

MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse…

ejfkdev/ddc

Android DEX → Java decompiler in Rust, built for speed — full apps in seconds, queries in milliseconds. Progressive analysis, javac-verified output,…

mpast/mobileaudit

Django application that performs SAST and Malware Analysis for Android APKs

ch0pin/rdx

A native APK and DEX decompiler written in Rust

arguslab/argus-saf

Scala-based static analysis framework for Android and Java bytecode with flow analysis, decompilation, and native code analysis via symbolic…

canyie/magiskeop

Exploit and writeup for installed app to root privilege escalation through CVE-2024-48336 (Magisk Bug #8279), Privileges Escalation / Arbitrary Code…

noveogroup/android-check

Static code analysis plugin for Android project. (Checkstyle, PMD)

symbioticsec/hermes-decomp

A powerful decompiler that lets you reverse-engineer React Native mobile apps by converting their compiled Hermes bytecode (.hbc) files back into…

githubsecuritylab/seclab-taskflows

Example AI-agent taskflows and MCP servers for auditing source code, triaging issues, and detecting vulnerabilities across web, Android, and iOS…

michalbednarski/abxoverflow

Writeup and exploit for CVE-2024-34740, integer overflow in Android's BinaryXmlSerializer to system_server file write and then to system_server code…

aancw/sslpindetect

SSLPinDetect is a tool for analyzing Android APKs to detect SSL pinning implementations by scanning for known patterns in decompiled code. It helps…

deemoun/pulseapk

PulseAPK is a WPF frontend for apktool and uber-signer with drag-and-drop support, live decompilation output, smali analysis, and integrated APK…