AwesomeREA.org

Tool

AppMon

Frida-based framework by Nishant Das Patnaik, shown at Black Hat Arsenal 2016, for watching the system API calls that native macOS, iOS and Android apps make. Its Sniffer attaches to or spawns an app, loads hook scripts from a bundled library covering areas such as crypto, keychain, files, SQLite, HTTP, IPC and WebView, and records each intercepted call in a per-app SQLite database that a local Flask web interface displays. Further components trace Java classes, methods and argument types in Android apps and repackage IPAs or APKs with Frida Gadget so they can be inspected on non-jailbroken or non-rooted devices.

Targets
App
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The repository is archived on GitHub and read-only. Its last commit on master, from 2022-11-08, changed the Frida release URL in apk_builder/getlibs.sh, and there are no releases. The usage documentation lives in the project wiki, last edited in 2019; the GitHub Pages site only links to it.
  • requirements.txt pins frida 12.2.6 (September 2018), Flask 1.0.2, Werkzeug 0.15.3 and other packages of that period. The hook scripts rely on Frida's Java and ObjC bridges and on legacy calls such as Module.findExportByName and Memory.readUtf8String, which Frida 17.0.0's release notes (May 2025) say are no longer bundled or have been removed, so current Frida releases are unlikely to work without changes.
  • The wiki's host setup covers macOS and Ubuntu or Kali Linux, with Android command-line tools on Linux. Jailbroken iOS and rooted Android devices run frida-server. For other devices the IPA Installer injects the committed ipa_installer/release/FridaGadget.dylib (about 14 MB) and re-signs the app with the user's iOS developer provisioning profile, while the APK Builder adds Frida Gadget libraries that getlibs.sh downloads and re-signs the APK with apk_builder/appmon.keystore, a shared key committed with a fixed password. Use these only on apps and devices you are permitted to test.
  • The README also lists an Intruder component that changes API-call data to alter an app's behavior; this record covers monitoring and tracing only. Apache-2.0 (LICENSE). The reviewed sources mention no AI or REA use, and nothing was installed or run for this record.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · dpnishant/appmon · Revision f753c4d
  2. requirements.txt GitHub · dpnishant/appmon · Revision f753c4d
  3. appmon.py GitHub · dpnishant/appmon · Revision f753c4d
  4. scripts GitHub · dpnishant/appmon · Revision f753c4d
  5. apk_builder/apk_builder.py GitHub · dpnishant/appmon · Revision f753c4d
  6. apk_builder/getlibs.sh GitHub · dpnishant/appmon · Revision f753c4d
  7. ipa_installer/ipa_installer.py GitHub · dpnishant/appmon · Revision f753c4d
  8. ipa_installer/release GitHub · dpnishant/appmon · Revision f753c4d
  9. LICENSE GitHub · dpnishant/appmon · Revision f753c4d
  10. https://github.com/dpnishant/appmon/wiki/4.a-Setup-Host/84516f44cf5ca37f669c8c8429d6cb46c10f0a7e
  11. https://github.com/dpnishant/appmon/wiki/6.-Usage-Guide:-AppMon-Sniffer/4dc32e5740fdfad523d71fa9e6862bd34d0c1c83
  12. https://frida.re/news/2025/05/17/frida-17-0-0-released/

More in Native binaries

All 158 entries in Native binaries