AwesomeREA.org

Tool

Katalina

Python emulator for Dalvik bytecode that its README likens to Unicorn: it parses a DEX file and executes methods one instruction at a time, substituting Python mocks for common Java and Android APIs such as String, StringBuilder, Base64, ArrayList, AES Cipher and part of reflection. Run over Android entry points, methods matching a name or one method with given arguments, it logs the strings that the code builds or decrypts, optionally as JSON, which helps recover obfuscated strings in apps and malware.

Targets
App
Category
Android tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • There are no releases or tags. Development ran from May to December 2023; the reviewed main commit f8e27b9 of 2026-10-01 merges a contributed fix that makes the String.valueOf mock follow the called overload's descriptor.
  • Requires Python 3.10+ with the pinned requirements.txt packages, including kaitaistruct 0.10 and pycryptodome 3.18.0. main.py takes -xe for Android entry points, -xm for methods matching a name, -x for one fully qualified method with arguments, -dl to skip methods whose names contain listed words and -j for JSON output. Entry-point and name-match runs give each method a SIGALRM time limit, so README says Windows support may be broken and recommends WSL.
  • Input is one classes.dex from an APK the analyst already has. README lists most instructions, same-class and static calls and String and Base64 APIs as working, iterator and array APIs and cross-class instance calls as partial, and MultiDex and I/O as broken. Framework behaviour without a mock is not reproduced, and the AES mock only tries ECB and then CBC with a zero IV, so recovered strings must be checked against the code. The repository has no tests or CI.
  • MIT. The first commit included DEX samples, many named after Android malware families, that were removed a month later; the reviewed tree holds only the Python sources, and no samples are linked here. No REA connection is stated, and no DEX file was run in this review.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · huuck/Katalina · Revision f8e27b9
  2. main.py GitHub · huuck/Katalina · Revision f8e27b9
  3. mocks.py GitHub · huuck/Katalina · Revision f8e27b9
  4. requirements.txt GitHub · huuck/Katalina · Revision f8e27b9
  5. LICENSE GitHub · huuck/Katalina · Revision f8e27b9
  6. https://github.com/huuck/Katalina/pull/6

More in Apps

All 136 entries in Apps