Open Source Android Reverse Engineering Tools

Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts. Works on Windows, macOS, GNU/Linux, iOS, Android, and QNX. Install the Node.js bindings from npm, grab a Python package from PyPI, or use Frida through its Swift bindings, .NET bindings, Qt/Qml bindings, or C API. Frida is and will always be free software (free as in freedom). We want to empower the next generation of developer tools, and help other free software developers achieve interoperability through reverse engineering. We are proud that NowSecure is using Frida to do fast, deep analysis of mobile apps at scale. Frida has a comprehensive test-suite and has gone through years of rigorous testing across a broad range of use-cases.

A free/libre toolchain for easing several low-level tasks like forensics, software reverse engineering, exploiting, and debugging. It is composed by a bunch of libraries (which are extended with plugins) and programs that can be automated with almost any programming language. It is recommended to install it from git, alternatively, you can pick the last release (every 6 weeks) from Github. Batch, Commandline, visual, and panels interactive modes. Embedded webserver with js scripting and WebUI. Assemble and disassemble a large list of CPUs. Runs on Windows and any other UNIX flavor out there. Analyze and emulate code with ESIL. Native debugger and GDB, WINDBG, QNX, and FRIDA. Navigate ASCII-art control flow graphs. Ability to patch binaries, and modify code or data. Search for patterns, magic headers, and function signatures. Easy to extend and modify. Commandline, C API, script with r2pipe in any language.

A tool for reverse engineering 3rd party, closed, binary Android apps. It can decode resources to nearly original form and rebuild them after making some modifications. It also makes working with an app easier because of the project like file structure and automation of some repetitive tasks like building apk, etc. It is NOT intended for piracy and other non-legal uses. It could be used for localizing, adding some features or support for custom platforms, analyzing applications and much more. The decode option on Apktool can be invoked either from d or decode. In order to run a rebuilt application. You must resign the application. Android documentation can help with this. As you probably know, Android apps utilize code and resources that are found on the Android OS itself. These are known as framework resources and Apktool relies on these to properly decode and build apks.

Some of Bytecode Viewer features are that it provides Java Decompiling with Six different decompilers (DJ-GUI/Core, Procyon, CFR, Fernflower, Krakatau, and JADX-Core). Bytecode Decompiling with CFIDE. Android APK integrated with Dex2Jar. Securely launch Java applications and insert hooks via EZ-Injection. Scan for malicious code with the Malicious Code Scanner plugin. Export as DEX, Jar, Class, Zip or Java Source File. Open Android APKs, Android DEX, Java Class Files and Java Jars. (WAR & JSP Support!). Extensively configurable, over 100+ settings! Works seamlessly with all Operating Systems. Integrates BCV into Windows by installing it, it'll associate all .class, .dex and .apk to open with BCV. You can view Jar & APK Resources with ease by APKTool.jar integration. It is 100% free and open sourced under GPL v3 CopyLeft.

OWASP Mobile Application Security Testing Guide (MASTG) is a free, open-source resource that provides comprehensive guidance for testing and evaluating the security of mobile applications. Developed by the Open Worldwide Application Security Project (OWASP), the guide offers practical methodologies, technical instructions, and testing procedures for identifying security vulnerabilities in Android and iOS applications. MASTG covers a wide range of mobile security topics, including data storage, cryptography, authentication, network communication, platform interactions, and reverse engineering. The guide aligns with the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Weakness Enumeration (MASWE), helping organizations evaluate applications against established security requirements. Security professionals can use its detailed testing techniques, tool recommendations, practical examples, and hands-on exercises.

Android reverse engineering & automation framework. The most powerful Android capture/reverse/HOOK & cloud phone/remote desktop/automation framework in history, your work has never been so easy and fast. LAMDA is an auxiliary framework for reverse engineering and automation. It is designed to reduce the time and trivial problems of security analysts and application testers. It replaces a large number of manual operations with a programmed interface. It is not a single-function framework. To give you a general idea of ​​its usefulness: Do you install various agents, plug-ins, or point-and-click settings on your phone to complete your work? Do you want to operate a mobile phone thousands of miles away in a different place? Do you have the need to programmatically control your phone? Are you still paying for expensive IP switching , remote ADB debugging , RPA automation and even logcat logs from some cloud mobile phone manufacturers? If so, then yes, just one LAMDA can solve all this.

apk-reverse is an Agent Skill for structured Android application reverse-engineering work in authorized research environments. It is designed for Claude Code, Codex, and other systems that support the Agent Skills format rather than as a conventional end-user application. Its scope includes APK analysis, debloating, controlled Dex modifications, repacking, runtime investigation, and client-versus-server diagnosis. A gated workflow forces agents to verify assumptions, environment state, and control builds before making changes. Detailed references catalog common failure modes involving signing, packaging, native code, protected applications, and runtime behavior. Parameterized scripts, environment checks, tests, and evidence records help agents perform repeatable analysis while the project explicitly restricts its intended use to owned, authorized, or sandboxed targets.