[38;5;12m                                                  [39m[38;2;255;187;0m[1m[4mandroid-security-awesome ![0m[38;5;14m[1m[4mAwesome[0m[38;2;255;187;0m[1m[4m (https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)[0m

[38;5;14m[1m![0m[38;5;12mLink[39m[38;5;12m [39m[38;5;12mLiveness[39m[38;5;12m [39m[38;5;12mChecker[39m[38;5;14m[1m [0m[38;5;14m[1m(https://github.com/ashishb/android-security-awesome/actions/workflows/validate-links.yml/badge.svg)[0m[38;5;12m [39m[38;5;12m(https://github.com/ashishb/android-security-awesome/actions/workflows/validate-links.yml)[39m[38;5;12m [39m[38;5;14m[1m![0m[38;5;12mLint[39m[38;5;12m [39m[38;5;12mShell[39m[38;5;12m [39m[38;5;12mscripts[39m[38;5;14m[1m [0m
[38;5;14m[1m(https://github.com/ashishb/android-security-awesome/actions/workflows/lint-shell-script.yaml/badge.svg)[0m[38;5;12m [39m[38;5;12m(https://github.com/ashishb/android-security-awesome/actions/workflows/lint-shell-script.yaml)[39m[38;5;12m [39m[38;5;14m[1m![0m[38;5;12mLint[39m[38;5;12m [39m[38;5;12mMarkdown[39m[38;5;14m[1m [0m
[38;5;14m[1m(https://github.com/ashishb/android-security-awesome/actions/workflows/lint-markdown.yaml/badge.svg)[0m[38;5;12m [39m[38;5;12m(https://github.com/ashishb/android-security-awesome/actions/workflows/lint-markdown.yaml)[39m[38;5;12m  [39m[38;5;14m[1m![0m[38;5;12mLint[39m[38;5;12m [39m[38;5;12mYAML[39m[38;5;14m[1m [0m
[38;5;14m[1m(https://github.com/ashishb/android-security-awesome/actions/workflows/lint-yaml.yaml/badge.svg)[0m[38;5;12m [39m[38;5;12m(https://github.com/ashishb/android-security-awesome/actions/workflows/lint-yaml.yaml)[39m

[38;5;12mA collection of Android security-related resources.[39m

[38;5;12m1. [39m[38;5;14m[1mTools[0m[38;5;12m (#tools)[39m
[38;5;12m1. [39m[38;5;14m[1mAcademic/Research/Publications/Books[0m[38;5;12m (#academic)[39m
[38;5;12m1. [39m[38;5;14m[1mExploits/Vulnerabilities/Bugs[0m[38;5;12m (#exploits)[39m

[38;2;255;187;0m[4mTools[0m

[38;2;255;187;0m[4mOnline Analyzers[0m

[38;5;12m1. [39m[38;5;14m[1mAndroTotal[0m[38;5;12m (http://andrototal.org/)[39m
[38;5;12m1. [39m[38;5;14m[1mAppknox[0m[38;5;12m (https://www.appknox.com/) - not free[39m
[38;5;12m1. [39m[38;5;14m[1mVirustotal[0m[38;5;12m (https://www.virustotal.com/) - max 128MB[39m
[38;5;12m1. [39m[38;5;14m[1mFraunhofer App-ray[0m[38;5;12m (http://app-ray.co/) - not free[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mNowSecure[0m[38;5;14m[1m [0m[38;5;14m[1mLab[0m[38;5;14m[1m [0m[38;5;14m[1mAutomated[0m[38;5;12m [39m[38;5;12m(https://www.nowsecure.com/blog/2016/09/19/announcing-nowsecure-lab-automated/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mEnterprise[39m[38;5;12m [39m[38;5;12mtool[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mmobile[39m[38;5;12m [39m[38;5;12mapp[39m[38;5;12m [39m[38;5;12msecurity[39m[38;5;12m [39m[38;5;12mtesting[39m[38;5;12m [39m[38;5;12mboth[39m[38;5;12m [39m[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12miOS[39m[38;5;12m [39m[38;5;12mmobile[39m[38;5;12m [39m[38;5;12mapps.[39m[38;5;12m [39m[38;5;12mLab[39m[38;5;12m [39m[38;5;12mAutomated[39m[38;5;12m [39m[38;5;12mfeatures[39m[38;5;12m [39m[38;5;12mdynamic[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mstatic[39m[38;5;12m [39m
[38;5;12manalysis[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12mreal[39m[38;5;12m [39m[38;5;12mdevices[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mcloud[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mreturn[39m[38;5;12m [39m[38;5;12mresults[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mminutes.[39m[38;5;12m [39m[38;5;12mNot[39m[38;5;12m [39m[38;5;12mfree[39m
[38;5;12m1. [39m[38;5;14m[1mApp Detonator[0m[38;5;12m (https://appdetonator.run/) - Detonate APK binary to provide source code level details including app author, signature, build, and manifest information. 3 Analysis/day free quota.[39m
[38;5;12m1. [39m[38;5;14m[1mPithus[0m[38;5;12m (https://beta.pithus.org/) - Open-Source APK analyzer. Still in Beta for the moment and limited to static analysis for the moment. Possible to hunt malware with Yara rules. More [39m[38;5;14m[1mhere[0m[38;5;12m (https://beta.pithus.org/about/).[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mOversecured[0m[38;5;12m [39m[38;5;12m(https://oversecured.com/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mEnterprise[39m[38;5;12m [39m[38;5;12mvulnerability[39m[38;5;12m [39m[38;5;12mscanner[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12miOS[39m[38;5;12m [39m[38;5;12mapps,[39m[38;5;12m [39m[38;5;12mit[39m[38;5;12m [39m[38;5;12moffers[39m[38;5;12m [39m[38;5;12mapp[39m[38;5;12m [39m[38;5;12mowners[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mdevelopers[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mability[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12msecure[39m[38;5;12m [39m[38;5;12meach[39m[38;5;12m [39m[38;5;12mnew[39m[38;5;12m [39m[38;5;12mversion[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mmobile[39m[38;5;12m [39m[38;5;12mapp[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12mintegrating[39m[38;5;12m [39m[38;5;12mOversecured[39m[38;5;12m [39m[38;5;12minto[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m
[38;5;12mdevelopment[39m[38;5;12m [39m[38;5;12mprocess.[39m[38;5;12m [39m[38;5;12mNot[39m[38;5;12m [39m[38;5;12mfree.[39m
[38;5;12m1. [39m[38;5;14m[1mAppSweep by Guardsquare[0m[38;5;12m (https://appsweep.guardsquare.com/) - Free, fast Android application security testing for developers[39m
[38;5;12m1. [39m[38;5;14m[1mKoodous[0m[38;5;12m (https://koodous.com) - Performs static/dynamic malware analysis over a vast repository of Android samples and checks them against public and private Yara rules.[39m
[38;5;12m1. [39m[38;5;14m[1mImmuniweb[0m[38;5;12m (https://www.immuniweb.com/mobile/). Does a "OWASP Mobile Top 10 Test", "Mobile App Privacy Check" and an application permissions test. Free tier is 4 tests per day incl. report after registration[39m
[38;5;12m1. [39m[38;5;14m[1m[9mBitBaan[0m[38;5;12m[9m (https://malab.bitbaan.com/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mAVC UnDroid[0m[38;5;12m[9m (http://undroid.av-comparatives.info/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mAMAaaS[0m[38;5;12m[9m (https://amaaas.com) - Free Android Malware Analysis Service. A bare-metal service features static and dynamic analysis for Android applications. A product of [0m[38;5;14m[1m[9mMalwarePot[0m[38;5;12m[9m (https://malwarepot.com/index.php/AMAaaS)[0m[38;5;12m.[39m
[38;5;12m1. [39m[38;5;14m[1m[9mAppCritique[0m[38;5;12m[9m (https://appcritique.boozallen.com) - Upload your Android APKs and receive comprehensive free security assessments[0m
[38;5;12m1. [39m[38;5;14m[1m[9mNVISO ApkScan[0m[38;5;12m[9m (https://apkscan.nviso.be/) - sunsetting on Oct 31, 2019[0m
[38;5;12m1. [39m[38;5;14m[1m[9mMobile Malware Sandbox[0m[38;5;12m[9m (http://www.mobilemalware.com.br/analysis/index_en.php)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mIBM Security AppScan Mobile Analyzer[0m[38;5;12m[9m (https://appscan.bluemix.net/mobileAnalyzer) - not free[0m
[38;5;12m1. [39m[38;5;14m[1m[9mVisual Threat[0m[38;5;12m[9m (https://www.visualthreat.com/) - no longer an Android app analyzer[0m
[38;5;12m1. [39m[38;5;14m[1m[9mTracedroid[0m[38;5;12m[9m (http://tracedroid.few.vu.nl/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mhabo[0m[38;5;12m[9m (https://habo.qq.com/) - 10/day[0m
[38;5;12m1. [39m[38;5;14m[1m[9mCopperDroid[0m[38;5;12m[9m (http://copperdroid.isg.rhul.ac.uk/copperdroid/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mSandDroid[0m[38;5;12m[9m (http://sanddroid.xjtu.edu.cn/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mStowaway[0m[38;5;12m[9m (http://www.android-permissions.org/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mAnubis[0m[38;5;12m[9m (http://anubis.iseclab.org/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mMobile app insight[0m[38;5;12m[9m (http://www.mobile-app-insight.org)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mMobile-Sandbox[0m[38;5;12m[9m (http://mobile-sandbox.com)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mIjiami[0m[38;5;12m[9m (http://safe.ijiami.cn/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mComdroid[0m[38;5;12m[9m (http://www.comdroid.org/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mAndroid Sandbox[0m[38;5;12m[9m (http://www.androidsandbox.net/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mForesafe[0m[38;5;12m[9m (http://www.foresafe.com/scan)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mDexter[0m[38;5;12m[9m (https://dexter.dexlabs.org/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mMobiSec Eacus[0m[38;5;12m[9m (http://www.mobiseclab.org/eacus.jsp)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mFireeye[0m[38;5;12m[9m (https://fireeye.ijinshan.com/)- max 60MB 15/day[0m
[38;5;12m1. [39m[38;5;14m[1m[9mapprover[0m[38;5;12m[9m (https://approver.talos-sec.com/) - Approver  is a fully automated security analysis and risk assessment platform for Android and iOS apps. Not free.[0m

[38;2;255;187;0m[4mStatic Analysis Tools[0m

[38;5;12m1. [39m[38;5;14m[1mAndrowarn[0m[38;5;12m (https://github.com/maaaaz/androwarn/) - detect and warn the user about potential malicious behaviors developed by an Android application.[39m
[38;5;12m1. [39m[38;5;14m[1mApkAnalyser[0m[38;5;12m (https://github.com/sonyxperiadev/ApkAnalyser)[39m
[38;5;12m1. [39m[38;5;14m[1mAPKInspector[0m[38;5;12m (https://github.com/honeynet/apkinspector/)[39m
[38;5;12m1. [39m[38;5;14m[1mDroid Intent Data Flow Analysis for Information Leakage[0m[38;5;12m (https://www.cert.org/secure-coding/tools/didfail.cfm)[39m
[38;5;12m1. [39m[38;5;14m[1mDroidLegacy[0m[38;5;12m (https://bitbucket.org/srl/droidlegacy)[39m
[38;5;12m1. [39m[38;5;14m[1mFlowDroid[0m[38;5;12m (https://blogs.uni-paderborn.de/sse/tools/flowdroid/)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Decompiler[0m[38;5;12m (https://www.pnfsoftware.com/) – not free[39m
[38;5;12m1. [39m[38;5;14m[1mPSCout[0m[38;5;12m (https://security.csl.toronto.edu/pscout/) - A tool that extracts the permission specification from the Android OS source code using static analysis[39m
[38;5;12m1. [39m[38;5;14m[1mAmandroid[0m[38;5;12m (http://amandroid.sireum.org/)[39m
[38;5;12m1. [39m[38;5;14m[1mSmaliSCA[0m[38;5;12m (https://github.com/dorneanu/smalisca) - Smali Static Code Analysis[39m
[38;5;12m1. [39m[38;5;14m[1mCFGScanDroid[0m[38;5;12m (https://github.com/douggard/CFGScanDroid) - Scans and compares CFG against CFG of malicious applications[39m
[38;5;12m1. [39m[38;5;14m[1mMadrolyzer[0m[38;5;12m (https://github.com/maldroid/maldrolyzer) - extracts actionable data like C&C, phone number etc.[39m
[38;5;12m1. [39m[38;5;14m[1mSPARTA[0m[38;5;12m (https://www.cs.washington.edu/sparta) - verifies (proves) that an app satisfies an information-flow security policy; built on the [39m[38;5;14m[1mChecker Framework[0m[38;5;12m (https://types.cs.washington.edu/checker-framework/)[39m
[38;5;12m1. [39m[38;5;14m[1mConDroid[0m[38;5;12m (https://github.com/JulianSchuette/ConDroid) - Performs a combination of symbolic + concrete execution of the app[39m
[38;5;12m1. [39m[38;5;14m[1mDroidRA[0m[38;5;12m (https://github.com/serval-snt-uni-lu/DroidRA)[39m
[38;5;12m1. [39m[38;5;14m[1mRiskInDroid[0m[38;5;12m (https://github.com/ClaudiuGeorgiu/RiskInDroid) - A tool for calculating the risk of Android apps based on their permissions, with an online demo available.[39m
[38;5;12m1. [39m[38;5;14m[1mSUPER[0m[38;5;12m (https://github.com/SUPERAndroidAnalyzer/super) - Secure, Unified, Powerful and Extensible Rust Android Analyzer[39m
[38;5;12m1. [39m[38;5;14m[1mClassyShark[0m[38;5;12m (https://github.com/google/android-classyshark) - Standalone binary inspection tool which can browse any Android executable and show important info.[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mStaCoAn[0m[38;5;12m [39m[38;5;12m(https://github.com/vincentcox/StaCoAn)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mCross-platform[39m[38;5;12m [39m[38;5;12mtool[39m[38;5;12m [39m[38;5;12mwhich[39m[38;5;12m [39m[38;5;12maids[39m[38;5;12m [39m[38;5;12mdevelopers,[39m[38;5;12m [39m[38;5;12mbug-bounty[39m[38;5;12m [39m[38;5;12mhunters,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12methical[39m[38;5;12m [39m[38;5;12mhackers[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mperforming[39m[38;5;12m [39m[38;5;12mstatic[39m[38;5;12m [39m[38;5;12mcode[39m[38;5;12m [39m[38;5;12manalysis[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12mmobile[39m[38;5;12m [39m[38;5;12mapplications.[39m[38;5;12m [39m[38;5;12mThis[39m[38;5;12m [39m[38;5;12mtool[39m[38;5;12m [39m[38;5;12mwas[39m[38;5;12m [39m[38;5;12mcreated[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mbig[39m[38;5;12m [39m[38;5;12mfocus[39m[38;5;12m [39m[38;5;12mon[39m
[38;5;12musability[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mgraphical[39m[38;5;12m [39m[38;5;12mguidance[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12muser[39m[38;5;12m [39m[38;5;12minterface.[39m
[38;5;12m1. [39m[38;5;14m[1mJAADAS[0m[38;5;12m (https://github.com/flankerhqd/JAADAS) - Joint intraprocedural and interprocedural program analysis tool to find vulnerabilities in Android apps, built on Soot and Scala[39m
[38;5;12m1. [39m[38;5;14m[1mQuark-Engine[0m[38;5;12m (https://github.com/quark-engine/quark-engine) - An Obfuscation-Neglect Android Malware Scoring System[39m
[38;5;12m1. [39m[38;5;14m[1mOne Step Decompiler[0m[38;5;12m (https://github.com/b-mueller/apkx) - Android APK Decompilation for the Lazy[39m
[38;5;12m1. [39m[38;5;14m[1mAPKLeaks[0m[38;5;12m (https://github.com/dwisiswant0/apkleaks) - Scanning APK file for URIs, endpoints & secrets.[39m
[38;5;12m1. [39m[38;5;14m[1mMobile Audit[0m[38;5;12m (https://github.com/mpast/mobileAudit) - Web application for performing Static Analysis and detecting malware in Android APKs.[39m
[38;5;12m1. [39m[38;5;14m[1m[9mSmali CFG generator[0m[38;5;12m[9m (https://github.com/EugenioDelfa/Smali-CFGs)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mSeveral tools from PSU[0m[38;5;12m[9m (http://siis.cse.psu.edu/tools.html)[0m

[38;2;255;187;0m[4mApp Vulnerability Scanners[0m

[38;5;12m1. [39m[38;5;14m[1mQARK[0m[38;5;12m (https://github.com/linkedin/qark/) - QARK by LinkedIn is for app developers to scan apps for security issues[39m
[38;5;12m1. [39m[38;5;14m[1mAndroBugs[0m[38;5;12m (https://github.com/AndroBugs/AndroBugs_Framework)[39m
[38;5;12m1. [39m[38;5;14m[1mNogotofail[0m[38;5;12m (https://github.com/google/nogotofail)[39m
[38;5;12m1. [39m[38;5;14m[1m[9mDevknox[0m[38;5;12m[9m (https://devknox.io/) - IDE plugin to build secure Android apps. Not maintained anymore.[0m

[38;2;255;187;0m[4mDynamic Analysis Tools[0m

[38;5;12m1. [39m[38;5;14m[1mAndroid DBI frameowork[0m[38;5;12m (http://www.mulliner.org/blog/blosxom.cgi/security/androiddbiv02.html)[39m
[38;5;12m1. [39m[38;5;14m[1mAndrol4b[0m[38;5;12m (https://github.com/sh4hin/Androl4b)- A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis[39m
[38;5;12m1. [39m[38;5;14m[1mHouse[0m[38;5;12m (https://github.com/nccgroup/house)- House: A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python.[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mMobile-Security-Framework[0m[38;5;14m[1m [0m[38;5;14m[1mMobSF[0m[38;5;12m [39m[38;5;12m(https://github.com/MobSF/Mobile-Security-Framework-MobSF)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mMobile[39m[38;5;12m [39m[38;5;12mSecurity[39m[38;5;12m [39m[38;5;12mFramework[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12man[39m[38;5;12m [39m[38;5;12mintelligent,[39m[38;5;12m [39m[38;5;12mall-in-one[39m[38;5;12m [39m[38;5;12mopen-source[39m[38;5;12m [39m[38;5;12mmobile[39m[38;5;12m [39m[38;5;12mapplication[39m[38;5;12m [39m[38;5;12m(Android/iOS)[39m[38;5;12m [39m[38;5;12mautomated[39m[38;5;12m [39m[38;5;12mpen-testing[39m[38;5;12m [39m[38;5;12mframework[39m[38;5;12m [39m[38;5;12mcapable[39m
[38;5;12mof[39m[38;5;12m [39m[38;5;12mperforming[39m[38;5;12m [39m[38;5;12mstatic,[39m[38;5;12m [39m[38;5;12mdynamic[39m[38;5;12m [39m[38;5;12manalysis[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mweb[39m[38;5;12m [39m[38;5;12mAPI[39m[38;5;12m [39m[38;5;12mtesting.[39m
[38;5;12m1. [39m[38;5;14m[1mAppUse[0m[38;5;12m (https://appsec-labs.com/AppUse/) – custom build for penetration testing[39m
[38;5;12m1. [39m[38;5;14m[1mDroidbox[0m[38;5;12m (https://github.com/pjlantz/droidbox)[39m
[38;5;12m1. [39m[38;5;14m[1mDrozer[0m[38;5;12m (https://github.com/mwrlabs/drozer)[39m
[38;5;12m1. [39m[38;5;14m[1mXposed[0m[38;5;12m (https://forum.xda-developers.com/xposed/xposed-installer-versions-changelog-t2714053) - equivalent of doing Stub-based code injection but without any modifications to the binary[39m
[38;5;12m1. [39m[38;5;14m[1mInspeckage[0m[38;5;12m (https://github.com/ac-pm/Inspeckage) - Android Package Inspector - dynamic analysis with API hooks, start unexported activities, and more. (Xposed Module)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Hooker[0m[38;5;12m (https://github.com/AndroidHooker/hooker) - Dynamic Java code instrumentation (requires the Substrate Framework)[39m
[38;5;12m1. [39m[38;5;14m[1mProbeDroid[0m[38;5;12m (https://github.com/ZSShen/ProbeDroid) - Dynamic Java code instrumentation[39m
[38;5;12m1. [39m[38;5;14m[1mDECAF[0m[38;5;12m (https://github.com/sycurelab/DECAF) - Dynamic Executable Code Analysis Framework based on QEMU (DroidScope is now an extension to DECAF)[39m
[38;5;12m1. [39m[38;5;14m[1mCuckooDroid[0m[38;5;12m (https://github.com/idanr1986/cuckoo-droid) - Android extension for Cuckoo sandbox[39m
[38;5;12m1. [39m[38;5;14m[1mMem[0m[38;5;12m (https://github.com/MobileForensicsResearch/mem) - Memory analysis of Android (root required)[39m
[38;5;12m1. [39m[38;5;14m[1mCrowdroid[0m[38;5;12m (http://www.ida.liu.se/labs/rtslab/publications/2011/spsm11-burguera.pdf) – unable to find the actual tool[39m
[38;5;12m1. [39m[38;5;14m[1mAuditdAndroid[0m[38;5;12m (https://github.com/nwhusted/AuditdAndroid) – android port of auditd, not under active development anymore[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Security Evaluation Framework[0m[38;5;12m (https://code.google.com/p/asef/) - not under active development anymore[39m
[38;5;12m1. [39m[38;5;14m[1mAurasium[0m[38;5;12m (https://github.com/xurubin/aurasium) – Practical security policy enforcement for Android apps via bytecode rewriting and in-place reference monitor.[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Linux Kernel modules[0m[38;5;12m (https://github.com/strazzere/android-lkms)[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mAppie[0m[38;5;12m [39m[38;5;12m(https://manifestsecurity.com/appie/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mAppie[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12msoftware[39m[38;5;12m [39m[38;5;12mpackage[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mhas[39m[38;5;12m [39m[38;5;12mbeen[39m[38;5;12m [39m[38;5;12mpre-configured[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mfunction[39m[38;5;12m [39m[38;5;12mas[39m[38;5;12m [39m[38;5;12man[39m[38;5;12m [39m[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mPentesting[39m[38;5;12m [39m[38;5;12mEnvironment.[39m[38;5;12m [39m[38;5;12mIt[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12mcompletely[39m[38;5;12m [39m[38;5;12mportable[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mcan[39m[38;5;12m [39m[38;5;12mbe[39m[38;5;12m [39m[38;5;12mcarried[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mUSB[39m[38;5;12m [39m[38;5;12mstick[39m[38;5;12m [39m[38;5;12mor[39m[38;5;12m [39m[38;5;12msmartphone.[39m[38;5;12m [39m[38;5;12mThis[39m[38;5;12m [39m
[38;5;12mis[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mone-stop[39m[38;5;12m [39m[38;5;12manswer[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mall[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mtools[39m[38;5;12m [39m[38;5;12mneeded[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mApplication[39m[38;5;12m [39m[38;5;12mSecurity[39m[38;5;12m [39m[38;5;12mAssessment[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12man[39m[38;5;12m [39m[38;5;12mawesome[39m[38;5;12m [39m[38;5;12malternative[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mexisting[39m[38;5;12m [39m[38;5;12mvirtual[39m[38;5;12m [39m[38;5;12mmachines.[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mStaDynA[0m[38;5;12m [39m[38;5;12m(https://github.com/zyrikby/StaDynA)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12msystem[39m[38;5;12m [39m[38;5;12msupporting[39m[38;5;12m [39m[38;5;12msecurity[39m[38;5;12m [39m[38;5;12mapp[39m[38;5;12m [39m[38;5;12manalysis[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mpresence[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mdynamic[39m[38;5;12m [39m[38;5;12mcode[39m[38;5;12m [39m[38;5;12mupdate[39m[38;5;12m [39m[38;5;12mfeatures[39m[38;5;12m [39m[38;5;12m(dynamic[39m[38;5;12m [39m[38;5;12mclass[39m[38;5;12m [39m[38;5;12mloading[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mreflection).[39m[38;5;12m [39m[38;5;12mThis[39m[38;5;12m [39m[38;5;12mtool[39m[38;5;12m [39m[38;5;12mcombines[39m[38;5;12m [39m[38;5;12mstatic[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mdynamic[39m[38;5;12m [39m[38;5;12manalysis[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m
[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mapplications[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12morder[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mreveal[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mhidden/updated[39m[38;5;12m [39m[38;5;12mbehavior[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mextend[39m[38;5;12m [39m[38;5;12mstatic[39m[38;5;12m [39m[38;5;12manalysis[39m[38;5;12m [39m[38;5;12mresults[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12mthis[39m[38;5;12m [39m[38;5;12minformation.[39m
[38;5;12m1. [39m[38;5;14m[1mDroidAnalytics[0m[38;5;12m (https://github.com/zhengmin1989/DroidAnalytics) - incomplete[39m
[38;5;12m1. [39m[38;5;14m[1mVezir Project[0m[38;5;12m (https://github.com/oguzhantopgul/Vezir-Project) - Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis[39m
[38;5;12m1. [39m[38;5;14m[1mMARA[0m[38;5;12m (https://github.com/xtiankisutsa/MARA_Framework) - Mobile Application Reverse Engineering and Analysis Framework[39m
[38;5;12m1. [39m[38;5;14m[1mTaintdroid[0m[38;5;12m (http://appanalysis.org) - requires AOSP compilation[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mARTist[0m[38;5;12m [39m[38;5;12m(https://artist.cispa.saarland)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mflexible[39m[38;5;12m [39m[38;5;12mopen-source[39m[38;5;12m [39m[38;5;12minstrumentation[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mhybrid[39m[38;5;12m [39m[38;5;12manalysis[39m[38;5;12m [39m[38;5;12mframework[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mapps[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mAndroid's[39m[38;5;12m [39m[38;5;12mJava[39m[38;5;12m [39m[38;5;12mmiddleware.[39m[38;5;12m [39m[38;5;12mIt[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12mbased[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mRuntime's[39m[38;5;12m [39m[38;5;12m(ART)[39m[38;5;12m [39m[38;5;12mcompiler[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mmodifies[39m[38;5;12m [39m[38;5;12mcode[39m[38;5;12m [39m
[38;5;12mduring[39m[38;5;12m [39m[38;5;12mon-device[39m[38;5;12m [39m[38;5;12mcompilation.[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Malware Sandbox[0m[38;5;12m (https://github.com/Areizen/Android-Malware-Sandbox)[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mAndroPyTool[0m[38;5;12m [39m[38;5;12m(https://github.com/alexMyG/AndroPyTool)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mtool[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mextracting[39m[38;5;12m [39m[38;5;12mstatic[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mdynamic[39m[38;5;12m [39m[38;5;12mfeatures[39m[38;5;12m [39m[38;5;12mfrom[39m[38;5;12m [39m[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mAPKs.[39m[38;5;12m [39m[38;5;12mIt[39m[38;5;12m [39m[38;5;12mcombines[39m[38;5;12m [39m[38;5;12mdifferent[39m[38;5;12m [39m[38;5;12mwell-known[39m[38;5;12m [39m[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mapp[39m[38;5;12m [39m[38;5;12manalysis[39m[38;5;12m [39m[38;5;12mtools[39m[38;5;12m [39m[38;5;12msuch[39m[38;5;12m [39m[38;5;12mas[39m[38;5;12m [39m[38;5;12mDroidBox,[39m[38;5;12m [39m[38;5;12mFlowDroid,[39m[38;5;12m [39m[38;5;12mStrace,[39m[38;5;12m [39m[38;5;12mAndroGuard,[39m[38;5;12m [39m
[38;5;12mor[39m[38;5;12m [39m[38;5;12mVirusTotal[39m[38;5;12m [39m[38;5;12manalysis.[39m
[38;5;12m1. [39m[38;5;14m[1mRuntime Mobile Security (RMS)[0m[38;5;12m (https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security) - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime[39m
[38;5;12m1. [39m[38;5;14m[1mPAPIMonitor[0m[38;5;12m (https://github.com/Dado1513/PAPIMonitor) – PAPIMonitor (Python API Monitor for Android apps) is a Python tool based on Frida for monitoring user-select APIs during the app execution.[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid_application_analyzer[0m[38;5;12m (https://github.com/NotSoSecure/android_application_analyzer) - The tool is used to analyze the content of the Android application in local storage.[39m
[38;5;12m1. [39m[38;5;14m[1mDecompiler.com[0m[38;5;12m (https://www.decompiler.com/) - Online APK and Java decompiler[39m
[38;5;12m1. [39m[38;5;14m[1m[9mAndroid Tamer[0m[38;5;12m[9m (https://androidtamer.com/) - Virtual / Live Platform for Android Security Professionals[0m
[38;5;12m1. [39m[38;5;14m[1m[9mAndroid Malware Analysis Toolkit[0m[38;5;12m[9m (http://www.mobilemalware.com.br/amat/download.html) - (Linux distro) Earlier it use to be an [0m[38;5;14m[1m[9monline analyzer[0m[38;5;12m[9m (http://dunkelheit.com.br/amat/analysis/index_en.php)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mAndroid Reverse Engineering[0m[38;5;12m[9m (https://redmine.honeynet.org/projects/are/wiki) – ARE (android reverse engineering) not under active development anymore[0m
[38;5;12m1. [39m[38;5;14m[1m[9mViaLab Community Edition[0m[38;5;12m[9m (https://www.nowsecure.com/blog/2014/09/09/introducing-vialab-community-edition/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mMercury[0m[38;5;12m[9m (https://labs.mwrinfosecurity.com/tools/2012/03/16/mercury/)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mCobradroid[0m[38;5;12m[9m (https://thecobraden.com/projects/cobradroid/) – custom image for malware analysis[0m

[38;2;255;187;0m[4mReverse Engineering[0m

[38;5;12m1. [39m[38;5;14m[1mSmali/Baksmali[0m[38;5;12m (https://github.com/JesusFreke/smali) – apk decompilation[39m
[38;5;12m1. [39m[38;5;14m[1memacs syntax coloring for smali files[0m[38;5;12m (https://github.com/strazzere/Emacs-Smali)[39m
[38;5;12m1. [39m[38;5;14m[1mvim syntax coloring for smali files[0m[38;5;12m (http://codetastrophe.com/smali.vim)[39m
[38;5;12m1. [39m[38;5;14m[1mAndBug[0m[38;5;12m (https://github.com/swdunlop/AndBug)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroguard[0m[38;5;12m (https://github.com/androguard/androguard) – powerful, integrates well with other tools[39m
[38;5;12m1. [39m[38;5;14m[1mApktool[0m[38;5;12m (https://ibotpeaches.github.io/Apktool/) – really useful for compilation/decompilation (uses smali)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Framework for Exploitation[0m[38;5;12m (https://github.com/appknox/AFE)[39m
[38;5;12m1. [39m[38;5;14m[1mBypass signature and permission checks for IPCs[0m[38;5;12m (https://github.com/iSECPartners/Android-KillPermAndSigChecks)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid OpenDebug[0m[38;5;12m (https://github.com/iSECPartners/Android-OpenDebug) – make any application on the device debuggable (using cydia substrate).[39m
[38;5;12m1. [39m[38;5;14m[1mDex2Jar[0m[38;5;12m (https://github.com/pxb1988/dex2jar) - dex to jar converter[39m
[38;5;12m1. [39m[38;5;14m[1mEnjarify[0m[38;5;12m (https://github.com/google/enjarify) - dex to jar converter from Google[39m
[38;5;12m1. [39m[38;5;14m[1mDedexer[0m[38;5;12m (https://sourceforge.net/projects/dedexer/)[39m
[38;5;12m1. [39m[38;5;14m[1mFino[0m[38;5;12m (https://github.com/sysdream/fino)[39m
[38;5;12m1. [39m[38;5;14m[1mFrida[0m[38;5;12m (https://www.frida.re/) - inject javascript to explore applications and a [39m[38;5;14m[1mGUI tool[0m[38;5;12m (https://github.com/antojoseph/diff-gui) for it[39m
[38;5;12m1. [39m[38;5;14m[1mIndroid[0m[38;5;12m (https://bitbucket.org/aseemjakhar/indroid) – thread injection kit[39m
[38;5;12m1. [39m[38;5;14m[1mIntentSniffer[0m[38;5;12m (https://www.nccgroup.com/us/our-research/intent-sniffer/)[39m
[38;5;12m1. [39m[38;5;14m[1mIntrospy[0m[38;5;12m (https://github.com/iSECPartners/Introspy-Android)[39m
[38;5;12m1. [39m[38;5;14m[1mJad[0m[38;5;12m ( https://varaneckas.com/jad/) - Java decompiler[39m
[38;5;12m1. [39m[38;5;14m[1mJD-GUI[0m[38;5;12m (https://github.com/java-decompiler/jd-gui) - Java decompiler[39m
[38;5;12m1. [39m[38;5;14m[1mCFR[0m[38;5;12m (http://www.benf.org/other/cfr/) - Java decompiler[39m
[38;5;12m1. [39m[38;5;14m[1mKrakatau[0m[38;5;12m (https://github.com/Storyyeller/Krakatau) - Java decompiler[39m
[38;5;12m1. [39m[38;5;14m[1mFernFlower[0m[38;5;12m (https://github.com/fesh0r/fernflower) - Java decompiler[39m
[38;5;12m1. [39m[38;5;14m[1mRedexer[0m[38;5;12m (https://github.com/plum-umd/redexer) – apk manipulation[39m
[38;5;12m1. [39m[38;5;14m[1mSimplify Android deobfuscator[0m[38;5;12m (https://github.com/CalebFenton/simplify)[39m
[38;5;12m1. [39m[38;5;14m[1mBytecode viewer[0m[38;5;12m (https://github.com/Konloch/bytecode-viewer)[39m
[38;5;12m1. [39m[38;5;14m[1mRadare2[0m[38;5;12m (https://github.com/radare/radare2)[39m
[38;5;12m1. [39m[38;5;14m[1mJadx[0m[38;5;12m (https://github.com/skylot/jadx)[39m
[38;5;12m1. [39m[38;5;14m[1mDwarf[0m[38;5;12m (https://github.com/iGio90/Dwarf) - GUI for reverse engineering[39m
[38;5;12m1. [39m[38;5;14m[1mAndromeda[0m[38;5;12m (https://github.com/secrary/Andromeda) - Another basic command-line reverse engineering tool[39m
[38;5;12m1. [39m[38;5;14m[1mapk-mitm[0m[38;5;12m (https://github.com/shroudedcode/apk-mitm) - A CLI application that prepares Android APK files for HTTPS inspection[39m
[38;5;12m1. [39m[38;5;14m[1mNoia[0m[38;5;12m (https://github.com/0x742/noia) - Simple Android application sandbox file browser tool[39m
[38;5;12m1. [39m[38;5;14m[1mObfuscapk[0m[38;5;12m (https://github.com/ClaudiuGeorgiu/Obfuscapk) - Obfuscapk is a modular Python tool for obfuscating Android apps without needing their source code.[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mARMANDroid[0m[38;5;12m [39m[38;5;12m(https://github.com/Mobile-IoT-Security-Lab/ARMANDroid)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mARMAND[39m[38;5;12m [39m[38;5;12m(Anti-Repackaging[39m[38;5;12m [39m[38;5;12mthrough[39m[38;5;12m [39m[38;5;12mMulti-patternAnti-tampering[39m[38;5;12m [39m[38;5;12mbased[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12mNative[39m[38;5;12m [39m[38;5;12mDetection)[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mnovel[39m[38;5;12m [39m[38;5;12manti-tampering[39m[38;5;12m [39m[38;5;12mprotection[39m[38;5;12m [39m[38;5;12mscheme[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12membeds[39m[38;5;12m [39m[38;5;12mlogic[39m[38;5;12m [39m[38;5;12mbombs[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mAT[39m[38;5;12m [39m
[38;5;12mdetection[39m[38;5;12m [39m[38;5;12mnodes[39m[38;5;12m [39m[38;5;12mdirectly[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mapk[39m[38;5;12m [39m[38;5;12mfile[39m[38;5;12m [39m[38;5;12mwithout[39m[38;5;12m [39m[38;5;12mneeding[39m[38;5;12m [39m[38;5;12mtheir[39m[38;5;12m [39m[38;5;12msource[39m[38;5;12m [39m[38;5;12mcode.[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mMVT[0m[38;5;14m[1m [0m[38;5;14m[1m(Mobile[0m[38;5;14m[1m [0m[38;5;14m[1mVerification[0m[38;5;14m[1m [0m[38;5;14m[1mToolkit)[0m[38;5;12m [39m[38;5;12m(https://github.com/mvt-project/mvt)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mcollection[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mutilities[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12msimplify[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mautomate[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mprocess[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mgathering[39m[38;5;12m [39m[38;5;12mforensic[39m[38;5;12m [39m[38;5;12mtraces[39m[38;5;12m [39m[38;5;12mhelpful[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12midentify[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mpotential[39m[38;5;12m [39m[38;5;12mcompromise[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12miOS[39m[38;5;12m [39m
[38;5;12mdevices[39m
[38;5;12m1. [39m[38;5;14m[1mDexmod[0m[38;5;12m (https://github.com/google/dexmod) - tool to exemplify patching Dalvik bytecode in a DEX (Dalvik Executable) file, and assist in the static analysis of Android applications.[39m
[38;5;12m1. [39m[38;5;14m[1m[9mProcyon[0m[38;5;12m[9m (https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler) - Java decompiler[0m
[38;5;12m1. [39m[38;5;14m[1m[9mSmali viewer[0m[38;5;12m[9m (http://blog.avlyun.com/wp-content/uploads/2014/04/SmaliViewer.zip)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mZjDroid[0m[38;5;12m[9m (https://github.com/BaiduSecurityLabs/ZjDroid)[0m[38;5;12m, [39m[38;5;14m[1m[9mfork/mirror[0m[38;5;12m[9m (https://github.com/yangbean9/ZjDroid)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mDare[0m[38;5;12m[9m (http://siis.cse.psu.edu/dare/index.html) – .dex to .class converter[0m

[38;2;255;187;0m[4mFuzz Testing[0m

[38;5;12m1. [39m[38;5;14m[1mRadamsa Fuzzer[0m[38;5;12m (https://github.com/anestisb/radamsa-android)[39m
[38;5;12m1. [39m[38;5;14m[1mHonggfuzz[0m[38;5;12m (https://github.com/google/honggfuzz)[39m
[38;5;12m1. [39m[38;5;14m[1mAn Android port of the Melkor ELF fuzzer[0m[38;5;12m (https://github.com/anestisb/melkor-android)[39m
[38;5;12m1. [39m[38;5;14m[1mMedia Fuzzing Framework for Android[0m[38;5;12m (https://github.com/fuzzing/MFFA)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroFuzz[0m[38;5;12m (https://github.com/jonmetz/AndroFuzz)[39m
[38;5;12m1. [39m[38;5;14m[1mQuarksLab's Android Fuzzing[0m[38;5;12m (https://github.com/quarkslab/android-fuzzing)[39m
[38;5;12m1. [39m[38;5;14m[1m[9mIntentFuzzer[0m[38;5;12m[9m (https://www.nccgroup.trust/us/about-us/resources/intent-fuzzer/)[0m

[38;2;255;187;0m[4mApp Repackaging Detectors[0m

[38;5;12m1. [39m[38;5;14m[1mFSquaDRA[0m[38;5;12m (https://github.com/zyrikby/FSquaDRA) - a tool for the detection of repackaged Android applications based on app resources hash comparison.[39m

[38;2;255;187;0m[4mMarket Crawlers[0m

[38;5;12m1. [39m[38;5;14m[1mGoogle Play crawler (Java)[0m[38;5;12m (https://github.com/Akdeniz/google-play-crawler)[39m
[38;5;12m1. [39m[38;5;14m[1mGoogle Play crawler (Python)[0m[38;5;12m (https://github.com/egirault/googleplay-api)[39m
[38;5;12m1. [39m[38;5;14m[1mGoogle Play crawler (Node)[0m[38;5;12m (https://github.com/dweinstein/node-google-play) - get app details and download apps from the official Google Play Store.[39m
[38;5;12m1. [39m[38;5;14m[1mAptoide downloader (Node)[0m[38;5;12m (https://github.com/dweinstein/node-aptoide) - download apps from Aptoide third-party Android market[39m
[38;5;12m1. [39m[38;5;14m[1mAppland downloader (Node)[0m[38;5;12m (https://github.com/dweinstein/node-appland) - download apps from Appland third-party Android market[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1mPlaystoreDownloader[0m[38;5;12m [39m[38;5;12m(https://github.com/ClaudiuGeorgiu/PlaystoreDownloader)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mPlaystoreDownloader[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mtool[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mdownloading[39m[38;5;12m [39m[38;5;12mAndroid[39m[38;5;12m [39m[38;5;12mapplications[39m[38;5;12m [39m[38;5;12mdirectly[39m[38;5;12m [39m[38;5;12mfrom[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mGoogle[39m[38;5;12m [39m[38;5;12mPlay[39m[38;5;12m [39m[38;5;12mStore.[39m[38;5;12m [39m[38;5;12mAfter[39m[38;5;12m [39m[38;5;12man[39m[38;5;12m [39m[38;5;12minitial[39m[38;5;12m [39m[38;5;12m(one-time)[39m[38;5;12m [39m[38;5;12mconfiguration,[39m[38;5;12m [39m
[38;5;12mapplications[39m[38;5;12m [39m[38;5;12mcan[39m[38;5;12m [39m[38;5;12mbe[39m[38;5;12m [39m[38;5;12mdownloaded[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12mspecifying[39m[38;5;12m [39m[38;5;12mtheir[39m[38;5;12m [39m[38;5;12mpackage[39m[38;5;12m [39m[38;5;12mname.[39m
[38;5;12m1. [39m[38;5;14m[1mAPK Downloader[0m[38;5;12m (https://apkcombo.com/apk-downloader/) Online Service to download APK from Playstore for specific Android Device Configuration[39m
[38;5;12m1. [39m[38;5;14m[1m[9mApkpure[0m[38;5;12m[9m (https://apkpure.com/) - Online apk downloader. Provides also its own app for downloading.[0m

[38;2;255;187;0m[4mMisc Tools[0m

[38;5;12m1. [39m[38;5;14m[1msmalihook[0m[38;5;12m (http://androidcracking.blogspot.com/2011/03/original-smalihook-java-source.html)[39m
[38;5;12m1. [39m[38;5;14m[1mAXMLPrinter2[0m[38;5;12m (http://code.google.com/p/android4me/downloads/detail?name=AXMLPrinter2.jar) - to convert binary XML files to human-readable XML files[39m
[38;5;12m1. [39m[38;5;14m[1madb autocomplete[0m[38;5;12m (https://github.com/mbrubeck/android-completion)[39m
[38;5;12m1. [39m[38;5;14m[1mmitmproxy[0m[38;5;12m (https://github.com/mitmproxy/mitmproxy)[39m
[38;5;12m1. [39m[38;5;14m[1mdockerfile/androguard[0m[38;5;12m (https://github.com/dweinstein/dockerfile-androguard)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Vulnerability Test Suite[0m[38;5;12m (https://github.com/AndroidVTS/android-vts) - android-vts scans a device for set of vulnerabilities[39m
[38;5;12m1. [39m[38;5;14m[1mAppMon[0m[38;5;12m (https://github.com/dpnishant/appmon)- AppMon is an automated framework for monitoring and tampering with system API calls of native macOS, iOS, and Android apps. It is based on Frida.[39m
[38;5;12m1. [39m[38;5;14m[1mInternal Blue[0m[38;5;12m (https://github.com/seemoo-lab/internalblue) - Bluetooth experimentation framework based on Reverse Engineering of Broadcom Bluetooth Controllers[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Mobile Device Hardening[0m[38;5;12m (https://github.com/SecTheTech/AMDH) - AMDH scans and hardens the device's settings and lists harmful installed Apps based on permissions.[39m
[38;5;12m1. [39m[38;5;14m[1m[9mAndroid Device Security Database[0m[38;5;12m[9m (https://www.android-device-security.org/client/datatable) - Database of security features of Android devices[0m
[38;5;12m1. [39m[38;5;14m[1m[9mOpcodes table for quick reference[0m[38;5;12m[9m (http://ww38.xchg.info/corkami/opcodes_tables.pdf)[0m
[38;5;12m1. [39m[38;5;14m[1m[9mAPK-Downloader[0m[38;5;12m[9m (http://codekiem.com/2012/02/24/apk-downloader/)[0m[38;5;12m - seems dead now[39m
[38;5;12m1. [39m[38;5;14m[1m[9mDalvik opcodes[0m[38;5;12m[9m (http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html)[0m

[38;2;255;187;0m[4mVulnerable Applications for practice[0m

[38;5;12m1. [39m[38;5;14m[1mDamn Insecure Vulnerable Application (DIVA)[0m[38;5;12m (https://github.com/payatu/diva-android)[39m
[38;5;12m1. [39m[38;5;14m[1mVuldroid[0m[38;5;12m (https://github.com/jaiswalakshansh/Vuldroid)[39m
[38;5;12m1. [39m[38;5;14m[1mExploitMe Android Labs[0m[38;5;12m (http://securitycompass.github.io/AndroidLabs/setup.html)[39m
[38;5;12m1. [39m[38;5;14m[1mGoatDroid[0m[38;5;12m (https://github.com/jackMannino/OWASP-GoatDroid-Project)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid InsecureBank[0m[38;5;12m (https://github.com/dineshshetty/Android-InsecureBankv2)[39m
[38;5;12m1. [39m[38;5;14m[1mInsecureshop[0m[38;5;12m (https://github.com/optiv/insecureshop)[39m
[38;5;12m1. [39m[38;5;14m[1mOversecured Vulnerable Android App (OVAA)[0m[38;5;12m (https://github.com/oversecured/ovaa)[39m

[38;2;255;187;0m[4mAcademic/Research/Publications/Books[0m

[38;2;255;187;0m[4mResearch Papers[0m

[38;5;12m1. [39m[38;5;14m[1mExploit Database[0m[38;5;12m (https://www.exploit-db.com/papers/)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid security-related presentations[0m[38;5;12m (https://github.com/jacobsoo/AndroidSlides)[39m
[38;5;12m1. [39m[38;5;14m[1mA good collection of static analysis papers[0m[38;5;12m (https://tthtlc.wordpress.com/2011/09/01/static-analysis-of-android-applications/)[39m

[38;2;255;187;0m[4mBooks[0m

[38;5;12m1. [39m[38;5;14m[1mSEI CERT Android Secure Coding Standard[0m[38;5;12m (https://www.securecoding.cert.org/confluence/display/android/Android+Secure+Coding+Standard)[39m

[38;2;255;187;0m[4mOthers[0m

[38;5;12m1. [39m[38;5;14m[1mOWASP Mobile Security Testing Guide Manual[0m[38;5;12m (https://github.com/OWASP/owasp-mstg)[39m
[38;5;12m1. [39m[38;5;14m[1mdoridori/Android-Security-Reference[0m[38;5;12m (https://github.com/doridori/Android-Security-Reference)[39m
[38;5;12m1. [39m[38;5;14m[1mandroid app security checklist[0m[38;5;12m (https://github.com/b-mueller/android_app_security_checklist)[39m
[38;5;12m1. [39m[38;5;14m[1mMobile App Pentest Cheat Sheet[0m[38;5;12m (https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Reverse Engineering 101 by Daniele Altomare (Web Archive link)[0m[38;5;12m (http://web.archive.org/web/20180721134044/http://www.fasteque.com:80/android-reverse-engineering-101-part-1/)[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1m[9mMobile[0m[38;5;14m[1m[9m [0m[38;5;14m[1m[9mSecurity[0m[38;5;14m[1m[9m [0m[38;5;14m[1m[9mReading[0m[38;5;14m[1m[9m [0m[38;5;14m[1m[9mRoom[0m[38;5;12m[9m [0m[38;5;12m[9m(https://mobile-security.zeef.com)[0m[38;5;12m[9m [0m[38;5;12m[9m-[0m[38;5;12m[9m [0m[38;5;12m[9mA[0m[38;5;12m[9m [0m[38;5;12m[9mreading[0m[38;5;12m[9m [0m[38;5;12m[9mroom[0m[38;5;12m[9m [0m[38;5;12m[9mthat[0m[38;5;12m[9m [0m[38;5;12m[9mcontains[0m[38;5;12m[9m [0m[38;5;12m[9mwell-categorized[0m[38;5;12m[9m [0m[38;5;12m[9mtechnical[0m[38;5;12m[9m [0m[38;5;12m[9mreading[0m[38;5;12m[9m [0m[38;5;12m[9mmaterial[0m[38;5;12m[9m [0m[38;5;12m[9mabout[0m[38;5;12m[9m [0m[38;5;12m[9mmobile[0m[38;5;12m[9m [0m[38;5;12m[9mpenetration[0m[38;5;12m[9m [0m[38;5;12m[9mtesting,[0m[38;5;12m[9m [0m[38;5;12m[9mmobile[0m[38;5;12m[9m [0m[38;5;12m[9mmalware,[0m[38;5;12m[9m [0m[38;5;12m[9mmobile[0m[38;5;12m[9m [0m[38;5;12m[9mforensics,[0m[38;5;12m[9m [0m[38;5;12m[9mand[0m[38;5;12m[9m [0m[38;5;12m[9mall[0m[38;5;12m[9m [0m[38;5;12m[9mkind[0m[38;5;12m[9m [0m[38;5;12m[9mof[0m[38;5;12m[9m [0m[38;5;12m[9mmobile[0m[38;5;12m[9m [0m
[38;5;12m[9msecurity-related[0m[38;5;12m[9m [0m[38;5;12m[9mtopics[0m

[38;2;255;187;0m[4mExploits/Vulnerabilities/Bugs[0m

[38;2;255;187;0m[4mList[0m

[38;5;12m1. [39m[38;5;14m[1mAndroid Security Bulletins[0m[38;5;12m (https://source.android.com/security/bulletin/)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid's reported security vulnerabilities[0m[38;5;12m (https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-19997/Google-Android.html)[39m
[38;5;12m1. [39m[38;5;14m[1mAOSP - Issue tracker[0m[38;5;12m (https://code.google.com/p/android/issues/list?can=2&q=priority=Critical&sort=-opened)[39m
[38;5;12m1. [39m[38;5;14m[1mOWASP Mobile Top 10 2016[0m[38;5;12m (https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10)[39m
[38;5;12m1. [39m[38;5;14m[1mExploit Database[0m[38;5;12m (https://www.exploit-db.com/search/?action=search&q=android) - click search[39m
[38;5;12m1. [39m[38;5;14m[1mVulnerability Google Doc[0m[38;5;12m (https://docs.google.com/spreadsheet/pub?key=0Am5hHW4ATym7dGhFU1A4X2lqbUJtRm1QSWNRc3E0UlE&single=true&gid=0&output=html)[39m
[38;5;12m1. [39m[38;5;14m[1mGoogle Android Security Team’s Classifications for Potentially Harmful Applications (Malware)[0m[38;5;12m (https://source.android.com/security/reports/Google_Android_Security_PHA_classifications.pdf)[39m
[38;5;12m1. [39m[38;5;14m[1m[9mAndroid Devices Security Patch Status[0m[38;5;12m[9m (https://kb.androidtamer.com/Device_Security_Patch_tracker/)[0m

[38;2;255;187;0m[4mMalware[0m

[38;5;12m1. [39m[38;5;14m[1mandroguard - Database Android Malware wiki[0m[38;5;12m (https://code.google.com/p/androguard/wiki/DatabaseAndroidMalwares)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Malware Github repo[0m[38;5;12m (https://github.com/ashishb/android-malware)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Malware Genome Project[0m[38;5;12m (http://www.malgenomeproject.org/policy.html) - contains 1260 malware samples categorized into 49 different malware families, free for research purposes.[39m
[38;5;12m1. [39m[38;5;14m[1mContagio Mobile Malware Mini Dump[0m[38;5;12m (http://contagiominidump.blogspot.com)[39m
[38;5;12m1. [39m[38;5;14m[1mDrebin[0m[38;5;12m (https://www.sec.tu-bs.de/~danarp/drebin/)[39m
[38;5;12m1. [39m[38;5;14m[1mKharon Malware Dataset[0m[38;5;12m (http://kharon.gforge.inria.fr/dataset/) - 7 malware which have been reverse-engineered and documented[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Adware and General Malware Dataset[0m[38;5;12m (https://www.unb.ca/cic/datasets/android-adware.html)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroZoo[0m[38;5;12m (https://androzoo.uni.lu/) - AndroZoo is a growing collection of Android Applications collected from several sources, including the official Google Play app market.[39m
[38;5;12m1.[39m[38;5;12m [39m[38;5;14m[1m[9mAndroid[0m[38;5;14m[1m[9m [0m[38;5;14m[1m[9mPRAGuard[0m[38;5;14m[1m[9m [0m[38;5;14m[1m[9mDataset[0m[38;5;12m[9m [0m[38;5;12m[9m(http://pralab.diee.unica.it/en/AndroidPRAGuardDataset)[0m[38;5;12m[9m [0m[38;5;12m[9m-[0m[38;5;12m[9m [0m[38;5;12m[9mThe[0m[38;5;12m[9m [0m[38;5;12m[9mdataset[0m[38;5;12m[9m [0m[38;5;12m[9mcontains[0m[38;5;12m[9m [0m[38;5;12m[9m10479[0m[38;5;12m[9m [0m[38;5;12m[9msamples,[0m[38;5;12m[9m [0m[38;5;12m[9mobtained[0m[38;5;12m[9m [0m[38;5;12m[9mby[0m[38;5;12m[9m [0m[38;5;12m[9mobfuscating[0m[38;5;12m[9m [0m[38;5;12m[9mthe[0m[38;5;12m[9m [0m[38;5;12m[9mMalGenome[0m[38;5;12m[9m [0m[38;5;12m[9mand[0m[38;5;12m[9m [0m[38;5;12m[9mthe[0m[38;5;12m[9m [0m[38;5;12m[9mContagio[0m[38;5;12m[9m [0m[38;5;12m[9mMinidump[0m[38;5;12m[9m [0m[38;5;12m[9mdatasets[0m[38;5;12m[9m [0m[38;5;12m[9mwith[0m[38;5;12m[9m [0m[38;5;12m[9mseven[0m[38;5;12m[9m [0m[38;5;12m[9mdifferent[0m[38;5;12m[9m [0m[38;5;12m[9mobfuscation[0m[38;5;12m[9m [0m
[38;5;12m[9mtechniques.[0m
[38;5;12m1. [39m[38;5;14m[1m[9mAdmire[0m[38;5;12m[9m (http://admire.necst.it/)[0m

[38;2;255;187;0m[4mBounty Programs[0m

[38;5;12m1. [39m[38;5;14m[1mAndroid Security Reward Program[0m[38;5;12m (https://www.google.com/about/appsecurity/android-rewards/)[39m

[38;2;255;187;0m[4mHow to report Security issues[0m

[38;5;12m1. [39m[38;5;14m[1mAndroid - reporting security issues[0m[38;5;12m (https://source.android.com/security/overview/updates-resources.html#report-issues)[39m
[38;5;12m1. [39m[38;5;14m[1mAndroid Reports and Resources[0m[38;5;12m (https://github.com/B3nac/Android-Reports-and-Resources) - List of Android Hackerone disclosed reports and other resources[39m

[38;2;255;187;0m[4mContributing[0m

[38;5;12mYour contributions are always welcome![39m
