AwesomeREA.org

Tool

Dexcalibur (Reversense)

Android reverse-engineering platform that combines static analysis with Frida-based dynamic instrumentation; the master branch is Reversense (Dexcalibur 2.0), a rewrite that runs as a Node.js web server for collaborative projects. Its README describes modeling an app's files, Smali and native code into one searchable representation with Radare2 integration, generating hooks for Java methods, Objective-C and native functions, and building dynamic cross-references from traces collected on attached devices. Inspector plugins in the repository observe areas such as permissions, cryptography, file-system, network and UI activity.

Requirements & limits

  • The latest GitHub release and npm package are still the original Dexcalibur v0.7.10 (2021-09-27, Apache-2.0 in its package metadata); the reviewed master commit (2026-10-02) declares the unreleased 2.0.0 rewrite. Its README getting-started, prerequisite and installation sections, and the installation page of the linked documentation site, are unfinished placeholders, and TESTED.md lists only a short set of basic engine, web-server, platform, device, project and ADB-bridge checks.
  • package.json targets Node.js on macOS, Linux and Windows (.nvmrc pins 22.14.0), and the reviewed commit adds Deno as a second runner; the documentation site says Windows is not officially supported. The README asks for a .dexcalibur settings folder in the user's home directory and names Frida 16.1.4, while package.json depends on frida ^17.6.2. MongoDB backs the project database (the Docker Compose file uses MongoDB 6.0.9), OpenID Connect with KeyCloak provides SSO, and the web UIs and device agent are built from separate reversenseorg repositories.
  • Analysis starts from the user's own app package and, for dynamic work, an Android device or emulator reachable over ADB with Frida. The third-party setup script downloads Android platform-tools, apktool 2.7.0, baksmali 2.5.2 and binwalk from their upstream hosts. The repository's test workspace bundles apktool.jar, OWASP's UnCrackable Level 1 training APK with its apktool-decoded files, and small ELF, Mach-O, plist and nib parser fixtures.
  • The 2.0 source is AGPL-3.0-only; the third-party notice covers EFF's apkeep (MIT). README features such as automated SAST/DAST scanning, device-farm management and the built-in MCP server are project-reported, and Reversense offers professional support and modules separately. Intended for apps the analyst is authorized to inspect; nothing was installed or run, and the reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Android tools
Relationship
Foundation tool
Targets
App

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · reversenseorg/dexcalibur · Revision 2408f79
  2. package.json GitHub · reversenseorg/dexcalibur · Revision 2408f79
  3. .nvmrc GitHub · reversenseorg/dexcalibur · Revision 2408f79
  4. TESTED.md GitHub · reversenseorg/dexcalibur · Revision 2408f79
  5. LICENSE GitHub · reversenseorg/dexcalibur · Revision 2408f79
  6. 3TH_LICENSES.md GitHub · reversenseorg/dexcalibur · Revision 2408f79
  7. scripts/prepare_thirdparty.sh GitHub · reversenseorg/dexcalibur · Revision 2408f79
  8. docker/Docker-compose.yml GitHub · reversenseorg/dexcalibur · Revision 2408f79
  9. .github/workflows/CI.yml GitHub · reversenseorg/dexcalibur · Revision 2408f79
  10. inspectors GitHub · reversenseorg/dexcalibur · Revision 2408f79
  11. test/ws GitHub · reversenseorg/dexcalibur · Revision 2408f79
  12. https://github.com/reversenseorg/dexcalibur/commit/2408f791ba869e7dba8f901332e44a5fee96a973
  13. https://github.com/reversenseorg/dexcalibur/releases/tag/v0.7.10
  14. docs/getting-started/installation.md GitHub · reversenseorg/rs-doc · Revision e33b0d1

More in Apps

All 101 entries in Apps