Android Security Awesome

StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.

APKinspector is a powerful GUI tool for analysts to analyze the Android applications.

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

Dynamic analysis of Android apps

Bluetooth experimentation framework for Broadcom and Cypress chips.

Oversecured Vulnerable Android App

A vulnerable Android application that shows simple examples of vulnerabilities in a ctf style.

Andromeda - Interactive Reverse Engineering Tool for Android Applications

MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.

CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox.

Android Debugging Library

Play with Google Play API :)

Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.

Yet another static code analyzer for malicious Android applications

Security profiling for blackbox Android

Secure, Unified, Powerful and Extensible Rust Android Analyzer

Hooker is an opensource project for dynamic analyses of Android applications. This project provides various tools and applications that can be use to automaticaly intercept and modify any API calls made by a targeted application.

A framework for automated extraction of static and dynamic features from Android applications

Extract given archive to images

Joint Advanced Defect assEsment for android applications

Media Fuzzing Framework for Android

ARMv7 payload that provides arbitrary code execution on MediaTek bootloaders

Static Code Analysis for Smali files

One-Step APK Decompilation With Multiple Backends

Android Malware Sandbox

Get details and download apps from https://play.google.com by emulating an Android (Nexus 5X) device by default. For a rust version of this library check out https://github.com/dweinstein/rs-google-play

Bash completion for "adb" from the Google Android SDK

An Intentionally designed Vulnerable Android Application built in Kotlin.

*This project is no longer maintained* OWASP GoatDroid is a fully functional and self-contained training environment for educating developers and testers on Android security. GoatDroid requires minimal dependencies and is ideal for both Android beginners as well as more advanced users. The project currently includes two applications: FourGoats, a location-based social network, and Herd Financial, a mobile banking application. There are also several feature that greatly simplify usage within a training environment or for absolute beginners who want a good introduction to working with the Android platform. Download the built version here: https://github.com/jackMannino/OWASP-GoatDroid-Project/downloads

Django application that performs SAST and Malware Analysis for Android APKs

Android Loadable Kernel Modules - mostly used for reversing and debugging on controlled systems/emulators

Android Mobile Device Hardening

Android Framework for Exploitation, is a framework for exploiting android based devices

A SDK for the creation of analysis tools without obtaining app source code in order to profile runtime performance, examine code coverage, and track high-risk behaviors of a given app on Android 5.0 and above.

Radio frequency scanner with recon and offensive capabilities

GUI for Frida -Scripts

The tool is used to analyze the content of the android application in local storage.

No description.

The Redexer binary instrumentation framework for Dalvik bytecode

A tool for quantitative risk analysis of Android applications based on machine learning techniques

No description.

Make any application debuggable

[WIP] Simple mobile applications sandbox file browser tool. Powered with [frida.re](https://www.frida.re).

Zygisk module that intercepts Flutter app traffic — redirects to a proxy and bypasses BoringSSL TLS pinning. Persistent, no Frida session. Installable via MMRL.

A flexible playground for Android CTF challenges.

Yet Another Linux Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis

Simple framework to extract "actionable" data from Android malware (C&Cs, phone numbers etc.)

Android small footprint inspection tool

Run arbitrary code by patching OAT files

Mobile runtime detection workbench for AI (iOS and Android)