# Curated reverse engineering resources · Page 32

> Page 32 of 52, entries 3,101–3,200. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/32/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/32/index.md>

## Games (4)

- [Cheat Engine MCP Bridge](https://awesomerea.org/resources/cheatengine-mcp-bridge/index.md): Integration · Connects MCP clients to Cheat Engine through a Lua bridge script and a Python MCP server, so an agent can inspect a process the user runs under Cheat Engine: memory reads and value scans, pointer-chain resolution, structure dissection, RTTI class names, disassembly, cross-references and hardware or DBVM breakpoints. Further tool groups write memory, inject DLLs or code, automate input and use Cheat Engine's kernel-mode driver. The README limits it to educational and research use and disclaims multiplayer cheating and Terms of Service violations.
- [PSP Web Recomp](https://awesomerea.org/resources/psp-web-recomp/index.md): Project · Translate PSP MIPS executables into C++ and WebAssembly, backed by a PSP high-level emulation runtime and WebGL2 renderer. Native tracing, frame capture and audio tools support investigating missing behavior during game porting.
- [GRB Modding Knowledgebase](https://awesomerea.org/resources/grb-modding-knowledgebase/index.md): Project · GRB Modding Knowledgebase documents Ghost Recon: Breakpoint’s Anvil .forge archives, nested .data resources and asset replacement workflow. Its Python inspectors examine MotionCloth files, list resource types, compare forge indexes and diff gameplay database records to explore field layouts.
- [OpenRS2](https://awesomerea.org/resources/openrs2/index.md): Project · OpenRS2 develops a server compatible with RuneScape client build 550 and associated client-analysis tools. Its Kotlin source includes deobfuscator modules, while technical notes document client parameters and game data structures.

## Apps (96)

- [Frida](https://awesomerea.org/resources/frida/index.md): Tool · Dynamic instrumentation toolkit for observing and scripting the behavior of live native and managed processes.
- [JADX](https://awesomerea.org/resources/jadx/index.md): Tool · Dex-to-Java decompiler with CLI/GUI navigation, resource decoding and cross-reference search for Android packages.
- [Apktool](https://awesomerea.org/resources/apktool/index.md): Tool · Decodes Android resources and smali into a project-like tree and can rebuild modified packages.
- [Androguard](https://awesomerea.org/resources/androguard/index.md): Tool · Python toolkit for APK/DEX metadata, bytecode and reference analysis; the v5 source branch also documents agent skills and MCP.
- [ILSpy](https://awesomerea.org/resources/ilspy/index.md): Tool · .NET assembly browser and C# decompiler with whole-project export, metadata inspection and a scriptable command-line frontend.
- [dnSpyEx](https://awesomerea.org/resources/dnspyex/index.md): Tool · Community continuation of dnSpy for debugging and editing .NET assemblies without the original source.
- [@electron/asar](https://awesomerea.org/resources/electron-asar/index.md): Tool · Electron's archive tool lists and extracts ASAR contents so packaged JavaScript and application assets can be inspected.
- [Mobile Security Framework (MobSF)](https://awesomerea.org/resources/mobsf/index.md): Tool · Inspect mobile application packages with static analysis and supported-device dynamic testing, including runtime behavior and network traffic, through a web interface and APIs.
- [objection](https://awesomerea.org/resources/objection/index.md): Tool · Explore running Android and iOS apps with a Frida-backed command interface for inspecting app storage, memory, runtime objects, and instrumented behavior.
- [Grapefruit](https://awesomerea.org/resources/grapefruit/index.md): Tool · Inspect and hook running iOS and Android apps from a Frida-based web interface, with method and crypto-API hooks, filesystem and SQLite browsers, iOS keychain and UI-hierarchy views, and HTTP capture from common networking libraries.
- [Blutter](https://awesomerea.org/resources/blutter/index.md): Tool · Analyze Flutter Android ARM64 AOT binaries using the matching Dart runtime. Produces annotated assembly, object-pool dumps and a target-specific Frida script template for investigating compiled Dart application logic.
- [hermes-dec](https://awesomerea.org/resources/hermes-dec/index.md): Tool · Parse, disassemble and partially decompile React Native Hermes bytecode bundles. Makes HBC headers and instructions inspectable and emits pseudocode for understanding compiled application logic.
- [Recaf](https://awesomerea.org/resources/recaf/index.md): Tool · Inspect and modify compiled JVM applications with integrated decompilers, bytecode assembly, reference search, mappings and deobfuscation tools. The reviewed 4.0 preview also provides basic read-only Android bytecode inspection.
- [nibkit](https://awesomerea.org/resources/nibkit/index.md): Tool · Decode compiled iOS/macOS interface archives into object trees, Outlet/Action connections, custom classes and navigation relationships. Exports JSON or Mermaid diagrams and exposes read-only inspection commands through MCP.
- [AOTopsy](https://awesomerea.org/resources/aotopsy/index.md): Tool · Statically inspect Flutter/Dart AOT libapp.so files to recover available metadata, class structures, call edges and pseudocode without embedding a Dart VM or compiling a matching SDK. Supports ARM64 and x86_64 analysis paths.
- [hbctool](https://awesomerea.org/resources/hbctool/index.md): Tool · Disassemble and reassemble supported React Native Hermes bytecode bundles through HASM files, enabling bytecode inspection and editing for the explicitly supported legacy HBC versions.
- [Vineflower](https://awesomerea.org/resources/vineflower/index.md): Tool · Fernflower-derived decompiler for Java and other JVM languages that continues the ForgeFlower, Fabric and Quiltflower forks, focused on output quality and modern Java, including records, sealed classes, switch expressions and pattern matching through Java 21+. Its command line takes a JAR, ZIP, folder or class file and writes a folder, an archive or console output, with multithreaded decompilation and automatic formatting. It can also be embedded as a library from Maven Central or used in IntelliJ IDEA through a plugin that replaces Fernflower, and the regular release JAR bundles three plugins, including Kotlin support and variable renaming.
- [Droid ASC](https://awesomerea.org/resources/droid-asc/index.md): Tool · Python Android decompiler that answers queries directly against an APK instead of first unpacking and indexing it. It probes compressed DEX entries in place, uses the layout that the R8 compiler’s constant relocation and instruction deduplication leave behind to search string, type, method and field references across DEX files, and for a requested class rebuilds a minimal, self-consistent DEX in memory that a bundled copy of Androguard’s decompiler turns into Java. The droidasc CLI and Tk GUI list classes, decompile single classes, decode AndroidManifest.xml and find subclasses or interface implementations; the README presents it as a lightweight back end for agents analyzing many APKs.
- [APKEditor](https://awesomerea.org/resources/apkeditor/index.md): Tool · Command-line APK editor built on ARSCLib that decodes an APK's binary resources and DEX into editable JSON, XML or smali and rebuilds a package from them, independent of aapt and aapt2. It also merges split bundles such as XAPK, APKM and APKS, refactors obfuscated resource names, and prints package information.
- [jnitrace](https://awesomerea.org/resources/jnitrace/index.md): Tool · Frida-based dynamic-analysis tool that traces an Android app's use of the JNI API, similar to frida-trace or strace but for the Java Native Interface. It logs the JNI calls that native libraries make through the JNIEnv and JavaVM structures, with include and exclude filters, backtraces and optional JSON output for later post-processing. The tracing engine is also published as a separate jnitrace-engine library.
- [AsmResolver](https://awesomerea.org/resources/asmresolver/index.md): Tool · C# library for reading, modifying and rebuilding Portable Executable files, covering both native Windows images and images with .NET metadata. It offers three levels of abstraction: raw headers and sections (PEFile); interpreted data directories such as imports, exports, TLS, exceptions, debug data and Win32 resources (PEImage); and a System.Reflection-like model of .NET assemblies and modules with managed, native and dynamic method bodies. It also extracts files from AppHost/single-file bundles, supports ReadyToRun images and reads PDB and Portable PDB symbols without DIA, and upstream designs it to stay robust against malformed or obfuscated binaries.
- [CodemerxDecompile](https://awesomerea.org/resources/codemerxdecompile/index.md): Tool · Cross-platform desktop .NET decompiler maintained by the original JustDecompile creators as a continuation of their JustDecompile Engine, built with Mono.Cecil and an Avalonia UI. It loads assemblies into a tree of namespaces, types, members and resolved references, shows decompiled C#, VB.NET or IL with go-to-definition and back/forward navigation, and searches names, types, string literals and instructions. A create-project command exports an assembly as a Visual Studio 2015, 2017 or 2019 project.
- [wxapkg](https://awesomerea.org/resources/wux1an-wxapkg/index.md): Tool · Desktop GUI for Windows and macOS, built with Wails, that unpacks WeChat mini-program .wxapkg packages for study. It scans the mini-program package folders of local WeChat 3.x and 4.x installations, including per-user folders, or takes a file or folder the user selects; packages that the PC client stores encrypted are decrypted first. Each packaged file is written to its recorded path, with optional beautification of JSON, HTML and JavaScript.
- [React Native Decompiler](https://awesomerea.org/resources/react-native-decompiler/index.md): Tool · Alpha-stage Node.js CLI that splits a React Native JavaScript bundle (index.android.bundle or main.jsbundle), an unbundled js-modules folder, or Webpack entrypoint and chunk bundles into one readable file per module. Tagger, editor and decompiler plugins working on a Babel AST undo compilation artifacts such as Babel helpers, comma-operator chains and shortened booleans, turn element calls back into JSX and can rewrite modules as ES6 imports and exports, after which ESLint and Prettier tidy the output. Modules recognized as npm packages are skipped unless requested, and one module ID can limit output to that module and its dependencies.
- [hermes-decomp](https://awesomerea.org/resources/hermes-decomp/index.md): Tool · Rust decompiler and analysis toolkit for Hermes bytecode (.hbc), the compiled form React Native apps ship for the Hermes engine; the README lists HBC versions 40 to 99. Its hermes-decomp CLI shows file information, disassembles, decompiles whole bundles or single functions to JavaScript, with a slower deep mode that recovers more names, and provides a terminal UI, cross-references, call graphs, control-flow graphs, Metro module and closure views and bytecode diffing. A separate hermes-mcp server exposes the read and analysis functions as MCP tools, and the hbc-decomp crate offers them as a Rust library.
- [MEDUSA](https://awesomerea.org/resources/medusa-framework/index.md): Tool · Modular Frida-based framework for runtime analysis of Android and iOS apps the analyst is authorized to test. From a single coordinated script it loads plug-in modules to inspect network and WebView activity, trace API calls, examine memory and cryptographic operations, monitor malware behavior, and handle protections such as SSL pinning. The README reports it ships with over 90 reusable modules.
- [Android Unpinner](https://awesomerea.org/resources/android-unpinner/index.md): Tool · Tool from the mitmproxy project that removes certificate pinning from an Android APK you own or are authorized to test, without a rooted device. It marks the app debuggable, touching only AndroidManifest.xml, and injects a Frida Gadget over ADB so an interception proxy can read the app's traffic, reusing HTTP Toolkit's unpinning script. It bundles the Android SDK helpers it needs and can also handle split APKs delivered as XAPK.
- [apk-mitm](https://awesomerea.org/resources/apk-mitm/index.md): Tool · Command-line tool that prepares an Android APK you own or are authorized to test for HTTPS traffic inspection. It decodes the package with Apktool, adjusts the network security configuration to trust user-added certificates, disables certificate pinning, then re-encodes and signs the patched APK, so a proxy can read the app's traffic without a rooted device. App bundles supplied as .xapk or .apks are also supported.
- [Frida Mobile Interception Scripts](https://awesomerea.org/resources/frida-interception-and-unpinning/index.md): Tool · A set of Frida scripts from HTTP Toolkit for inspecting a mobile app's HTTPS traffic while analysing apps you own or are authorized to test. Injected into a running Android or iOS app, they redirect its connections to an interception proxy, add a user-supplied CA certificate to the trust stores, and disable certificate pinning and transparency checks so the proxy can read the traffic. Individual scripts can also be used on their own to hook specific behaviour.
- [reFlutter](https://awesomerea.org/resources/reflutter/index.md): Tool · Flutter reverse-engineering framework for apps the analyst is authorized to inspect. It repacks an app with a prebuilt patched Dart engine, or instruments the app's own engine at runtime, to emit a JSONL dump of every function's name, class, library and code offset into the Dart instructions image for Frida or IDA/Ghidra work. It can also route the app's HTTPS traffic through an inspection proxy with Flutter certificate pinning disabled.
- [ddc](https://awesomerea.org/resources/ddc/index.md): Tool · Rust decompiler that turns Android DEX bytecode, versions 035 to 041, from APKs, multi-dex apps and XAPK/APKS/APKM containers into Java, folding lambdas and string concatenation back into Java syntax and giving locals jadx-style names. By default every file also goes through a source-level cleanup pass, described as semantics-preserving, that inlines copy chains, recovers ternaries and for-each loops and drops dead stores; --fast skips it. Alongside full decompilation, 15 query subcommands return app and manifest information, resources, strings, cross-references, class hierarchies, disassembly or single classes and methods on demand, and the same queries are served over REST and MCP.
- [Simplify](https://awesomerea.org/resources/simplify-android-deobfuscator/index.md): Tool · Generic Android deobfuscator built on smalivm, a sandboxed Dalvik virtual machine that executes each method and records every possible register and class value along all execution paths, taking both branches when a value such as file or network input is unknown. Simplify then repeatedly applies constant propagation, dead-code removal, unreflection and peephole optimizations to the APK or DEX, which can decrypt strings and remove reflection while keeping behaviour the same; it does not rename classes or methods. smalivm can also be used as a library, and the last release adds sdbg, a step-through Smali debugger built on it.
- [GDA (GJoy Dex Analyzer)](https://awesomerea.org/resources/gda-android-decompiler/index.md): Tool · Windows-native Dalvik decompiler and Android analysis workbench written in C++ that opens APK, DEX, ODEX, OAT, JAR, AAR and class files without installation. Besides Java and Smali views with cross-references, renaming and comments, it identifies packers, deobfuscates and decrypts strings, tracks data flow and taint, solves paths, runs rule-based malicious-behaviour, vulnerability and privacy-leak scans, and can dump device memory or hook methods with Frida. Shell and server CLI modes, Python and Java scripting and a sample malware-triage agent skill expose the same analysis to scripts and agents.
- [APKLab](https://awesomerea.org/resources/apklab/index.md): Tool · VS Code extension that turns the editor into an Android reverse-engineering workbench around Apktool, Jadx, smali-lsp and uber-apk-signer. It decodes an APK into resources and Smali, decompiles it to Java, gives Smali go-to-definition, references and diagnostics through a language server, and rebuilds, signs and installs the modified app. It can also generate Frida hooks for Smali methods, add a Frida gadget, prepare an app for HTTPS traffic inspection with apk-mitm and produce a Quark-Engine malware-analysis report.
- [Fernflower](https://awesomerea.org/resources/fernflower/index.md): Tool · JetBrains' analytical decompiler that turns Java class files back into Java source; IntelliJ IDEA bundles it to show code when debugging or browsing class files. The standalone console decompiler takes class files, JARs, ZIPs or directories, can load library files with -e only as analysis context, and writes Java sources to an output directory. Options cover generic signatures, lambdas, inner classes, record and switch patterns, per-method time limits and renaming of ambiguous or obfuscated identifiers, optionally through a user-supplied renamer class.
- [Bytecode Viewer](https://awesomerea.org/resources/bytecode-viewer/index.md): Tool · Desktop suite for inspecting compiled Java and Android programs: drop in a class, JAR, WAR, APK, DEX, XAPK or APKM file to browse its classes and resources, with up to three decompiler or disassembler views side by side. The README lists six bundled Java decompilers (Krakatau, CFR, Procyon, FernFlower, JADX and JD-GUI), Krakatau and Smali/baksmali disassemblers and assemblers plus javap, Dex2Jar and Enjarify for APK/DEX conversion, a built-in Java compiler for editing, and static search. Java and JavaScript plugins receive every loaded class as an ASM ClassNode for jobs such as string deobfuscation or malicious-code searches.
- [Logic-Lens](https://awesomerea.org/resources/logic-lens/index.md): Tool · Experimental JavaScript source-analysis toolkit that classifies AST-token sequences into configured formula families after local training, and produces heuristic structure, call-graph and intent reports. It supports code-comprehension experiments. The predictions are heuristic classifications; arbitrary program invariants and semantic equivalence remain unverified.
- [Android Security Toolkit](https://awesomerea.org/resources/android-security-toolkit/index.md): Tool · Local Python APK triage tool that drives apktool and strings, checks manifest settings and source/native-library strings, and produces TXT/JSON findings for manual review. Its rules flag possible issues for manual review.
- [ilspy-cli: targeted .NET decompilation for agents](https://awesomerea.org/resources/akiselev-ilspy-cli/index.md): Tool · Rust CLI that hosts an ILSpy C# bridge in-process for assembly, type and named-method decompilation, source search and structured JSON output. A separate PE-header detector identifies managed assemblies without loading the .NET runtime.
- [React-Decode](https://awesomerea.org/resources/react-decode/index.md): Tool · Static-analysis CLI for compiled React JavaScript that produces readable bundle output and inferred API-request, route and application-constant reports. It can extract embedded source-map contents when available.
- [abc-decompiler](https://awesomerea.org/resources/abc-decompiler/index.md): Tool · Decompiler for HarmonyOS Ark bytecode (.abc), the format HarmonyOS app packages carry in modules.abc, built by adapting the jadx decompiler and reading files through a patched copy of the abcde library. Because much of Ark bytecode is semantically close to DEX, it reuses jadx's GUI, IR and passes: an .abc file dropped into the jadx-based window is shown as decompiled code. The README reports that all 227 usable instructions of the 282 Ark opcodes are implemented, most special instructions as pseudo-functions.
- [slicer](https://awesomerea.org/resources/slicer/index.md): Tool · Browser-based Java reverse-engineering tool that loads class files and JAR/ZIP archives and disassembles or decompiles them with Vineflower (the default), CFR, Procyon or JASM, compiled to run in the browser, next to its own bytecode disassembler. It draws inheritance and interface graphs and per-method control-flow graphs, searches constant-pool entries, instructions and member declarations or usages, applies Tiny, SRG/TSRG/CSRG or ProGuard mappings, and offers generic transformers that strip or normalize bytecode attributes so decompilers cope better with obfuscation. A JavaScript scripting API can add disassemblers and manipulate the workspace; the README itself recommends Recaf for serious reverse engineering.
- [APK Studio](https://awesomerea.org/resources/apk-studio/index.md): Tool · Qt6 desktop front end that drives Apktool, JADX, uber-apk-signer and ADB from an IDE-style workspace for Android packages. It decodes an APK into smali and resources, optionally adds JADX Java output, then rebuilds, signs (with optional keystore generation and zipalign) and installs the result on a selected device; manufacturer framework files and extra Apktool arguments can be supplied. Decoded projects open in a file tree with syntax-highlighted smali, Java, XML and YAML editing, an image viewer, a hex editor and search across files.
- [APKiD](https://awesomerea.org/resources/apkid/index.md): Tool · PEiD-style identifier for Android packages from RedNaga. It scans APK and DEX files, nested ZIP entries and the native ELF libraries, PE DLLs and resources inside them with YARA rules, using the yara-python-dex DEX module, and reports the compilers, packers, protectors, obfuscators and anti-VM or anti-disassembly tricks it recognizes, per file or as JSON. Optional tracker rules attributed to the Exodus API flag embedded tracking SDKs; APKiD only identifies, and does not unpack or deobfuscate anything.
- [dex2jar](https://awesomerea.org/resources/dex2jar/index.md): Tool · Java toolkit that converts Android DEX bytecode, including DEX inside APKs, into JVM .class files packed as a jar for Java decompilers and bytecode tools. It also reads and writes DEX through an ASM-like API, disassembles and assembles smali with its own implementation, converts jars back to DEX and ships helpers such as d2j-decrypt-string.
- [apk.sh](https://awesomerea.org/resources/apk-sh/index.md): Tool · Bash script that automates repetitive Android app analysis chores around apktool: pulling an installed package from a device or emulator, decoding resources and disassembling dex code, and rebuilding the decoded directory into an APK. Split APKs from app bundles are combined into a single APK when pulled, and the script can also prepare a copy for Frida instrumentation.
- [FIRERPA (lamda)](https://awesomerea.org/resources/firerpa-lamda/index.md): Tool · Client/server Android automation and dynamic-analysis platform for devices the analyst is authorized to test. An on-device server exposes UI automation, a browser-based remote desktop, HTTPS traffic capture (MITM), and bundled Frida instrumentation through one service, driven from a Python client library of 160+ APIs. The README reports it works on Android 6.0+ with or without root, maps Frida RPC to Python and JSON-RPC calls, and includes an MCP server and a natural-language agent command.
- [Binder Trace](https://awesomerea.org/resources/binder-trace/index.md): Tool · Frida-based terminal tool, described by its authors as "Wireshark for Binder", that intercepts the Binder IPC transactions an Android process sends and parses each message and its reply. Bundled structure files for specific Android releases map transaction codes back to AIDL interface and method names and decode parcel arguments into typed fields beside a hex dump. A frequency pane and a JSON filter file narrow the stream by interface, method or type, showing which system services an app calls and with what data.
- [Quark-Engine](https://awesomerea.org/resources/quark-engine/index.md): Tool · Rule-based engine for analysing suspicious Android apps: it loads an APK's Dalvik bytecode and checks JSON behaviour rules, each naming permissions and a pair of framework API calls, through five confidence stages, from the permission being requested and either API being called up to both calls appearing in order in one method and passing the same register. Weighted rule matches produce a threat score, with summary, detail, JSON, web, call-graph and label reports, and Quark Script exposes the analysis as a Python API that the project presents for finding vulnerabilities. The repository also ships two Claude Code skills, for running an analysis and generating a rule, and an optional LangChain agent that uses the OpenAI API.
- [Dexcalibur (Reversense)](https://awesomerea.org/resources/dexcalibur/index.md): Tool · Android reverse-engineering platform that combines static analysis with Frida-based dynamic instrumentation; the master branch is Reversense (Dexcalibur 2.0), a rewrite that runs as a Node.js web server for collaborative projects. Its README describes modeling an app's files, Smali and native code into one searchable representation with Radare2 integration, generating hooks for Java methods, Objective-C and native functions, and building dynamic cross-references from traces collected on attached devices. Inspector plugins in the repository observe areas such as permissions, cryptography, file-system, network and UI activity.
- [vdexExtractor](https://awesomerea.org/resources/vdexextractor/index.md): Tool · Command-line C tool that extracts the Dex bytecode held in the Vdex containers that ART's dex2oat compiler writes beside Oat files since Android 8.0 (API 26), and by default reverts ART's dex-to-dex quickening so the output is ordinary Dex again. It can also dump the verified-dependency records stored in a Vdex file, disassemble the bytecode in a dexdump-like format and report the Android API level of a Vdex version. Android 9 and 10 Vdex files hold CompactDex, which the bundled deodex helper converts back to standard Dex through a separately built compact_dex_converter.
- [Garlic](https://awesomerea.org/resources/garlic-decompiler/index.md): Tool · Java and Android decompiler written in C that recovers Java source from class, JAR, WAR, DEX and APK files on multiple threads; it also prints javap- or dexdump-style class listings, converts APK and DEX files to smali, searches their strings with regular expressions and generates call graphs for DEX and APK files. Running garlic -m starts a stdio MCP server whose seven tools decompile files, dump class information, build call graphs, load them into DuckDB for SQL queries and read the extracted AndroidManifest.xml. The README reports decompiling an APK of more than 200 MB with about 190,000 classes in 12 seconds.
- [Android-Disassembler](https://awesomerea.org/resources/android-disassembler/index.md): Tool · On-device disassembler and binary viewer for Android, built on Capstone, that opens ELF shared libraries and executables, object files, Windows PE files, .NET assemblies, dex files and APKs chosen from storage or from installed apps. It shows ELF details and symbol tables, PE import and export tables, disassembly with jump following and navigation by symbol or address, a hex view, ASCII string search and byte statistics such as entropy and chi-square tests to help tell whether data is encrypted. Analyses are kept as projects and can be exported as raw, text, JSON or database files.
- [XAPKDetector](https://awesomerea.org/resources/xapkdetector/index.md): Tool · APK and DEX detector from hors, the author of Detect-It-Easy, that reports the build tools, libraries and protections it identifies in Android packages, using scan engines and signature databases from the Detect-It-Easy family. The Qt GUI also shows AndroidManifest.xml, MANIFEST.MF, DEX and ELF contents, strings, hex, entropy, hashes and the APK signature, and can scan whole directories. A console build runs recursive, deep, heuristic or all-types scans and writes XML, JSON, CSV or TSV results.
- [Jsxer](https://awesomerea.org/resources/jsxer/index.md): Tool · C++ decompiler for JSXBIN, the binary format of Adobe's legacy ExtendScript, the ECMAScript 3 dialect used to script applications such as Photoshop, InDesign and After Effects. It reads a JSXBIN 1.0, 2.0 or 2.1 literal, parses it into a syntax tree and prints JavaScript source with a header naming the format version. An experimental --unblind option renames symbols obfuscated by JsxBlind, and the same decompiler is exposed as a shared library with a ctypes-based Python binding.
- [jni_helper](https://awesomerea.org/resources/jni-helper/index.md): Tool · Static helper by evilpan for reverse engineering Android JNI code. Its extract_jni.py script parses an APK's DEX files with Androguard, finds methods declared native, derives each one's mangled Java_ symbol name and C prototype, including overloaded methods, and saves them with the exported Java_ and JNI_OnLoad functions of the APK's arm64-v8a native libraries as a JSON signature file. Scripts for Ghidra, IDA Pro and Binary Ninja load that file and apply the prototypes and JNI types to the matching functions; a radare2 script is a work in progress.
- [ReArk](https://awesomerea.org/resources/reark/index.md): Tool · Desktop reverse-engineering and AI-assisted analysis workbench for HarmonyOS NEXT packages (.hap, .app and .abc), whose binary releases add Android .apk/.aab, iOS .ipa and standalone PE, ELF and Mach-O analysis. The README describes browsing package structure, resources, signatures and metadata, ABC bytecode disassembly and decompilation with strings and cross-references, Java-like Android decompilation, native header, import and mitigation views, and HDC/ADB device workflows for installing apps, reading logs and mirroring screens. Its built-in ReArk Agent answers questions about the open package with OpenAI-compatible or local Ollama models, retrieving package evidence on demand behind approval flows for host and device actions.
- [ARSCLib](https://awesomerea.org/resources/arsclib/index.md): Tool · Java library, modeled on AOSP's androidfw ResourceTypes.h and meant to replace aapt/aapt2, that reads, writes, modifies and creates Android resource tables (resources.arsc) and binary XML files such as AndroidManifest.xml. It decodes resources to readable JSON, which also handles obfuscated names, or to XML source when names are intact, and builds either form back into binary resources; APK module classes decode, merge and write whole packages. It also has an experimental DEX read/write package, and the APKEditor command-line tool is built on it.
- [Pithus (bazaar)](https://awesomerea.org/resources/pithus-bazaar/index.md): Tool · Self-hostable Django platform behind the Pithus Android analysis service, which its README describes as built for activists, journalists, NGOs and researchers. An uploaded APK is stored under its SHA-256 and queued for static analyses: Androguard attribute and class extraction, APKiD compiler and packer identification, ssdeep and Dexofuzzy similarity, Quark-Engine behavior rules, androcfg call graphs, Exodus tracker signatures, a MobSF static report, APK signing-block metadata and analyst-written YARA rules with retrohunts over stored samples. Results are indexed in Elasticsearch and shown as web reports and through a REST API, optionally enriched with MalwareBazaar, VirusTotal, MISP and Google Play lookups.
- [House](https://awesomerea.org/resources/house/index.md): Tool · NCC Group’s Python and Flask web interface for Frida-based runtime analysis of Android apps, intended to make writing Frida scripts simpler. From a local browser page the analyst can enumerate loaded classes, the classes in a DEX file, class loaders and a class’s methods, then generate and keep tracing scripts for several functions, including ones in dynamically loaded DEX or JAR files. A configurable monitor logs file, HTTP, WebView, SQL, IPC and SharedPreferences calls.
- [ABCDE](https://awesomerea.org/resources/abcde/index.md): Tool · Kotlin toolkit for OpenHarmony reverse engineering that parses Ark bytecode (.abc) files, the format HarmonyOS app packages carry in modules.abc, along with HAP packages and resource index (.index) files. Its Compose desktop viewer browses classes, methods, fields, literal arrays, imports and exports and disassembles methods, showing imported modules and resource references in readable form; an experimental mode translates some methods literally into JavaScript, and a CLI dumps class lists and resource indexes. The parsing core is also published as a JVM library, and the separate abc-decompiler builds on a patched fork of it.
- [de4js](https://awesomerea.org/resources/de4js/index.md): Tool · Browser-based JavaScript deobfuscator and unpacker, built as a Jekyll site that also works offline as a progressive web app. It detects or lets the user pick an encoding and reverses Dean Edwards' Packer, eval- and array-based obfuscators, some Obfuscator.IO output, JSFuck, JJencode, AAencode, URL encoding, My Obfuscate and WiseLoop, then beautifies and highlights the result, with options to unescape strings, merge strings, recover object paths and evaluate constant expressions. An optional userscript sends the code to the JS Nice service to rename unreadable identifiers.
- [DexKit](https://awesomerea.org/resources/dexkit/index.md): Tool · C++ DEX parsing library with Kotlin and Java APIs that loads an APK, DEX bytes or an app’s class loader and finds classes, methods and fields by their characteristics rather than their obfuscated names. Matchers combine package scope, modifiers and raw access flags, field, parameter and return types, annotations, the strings and numeric constants a method uses and the methods it calls, while batch queries locate many targets from strings at once; results expose opcodes, callers, invoked methods and fields used. Its guides centre on keeping Xposed hook points working across obfuscated app versions, and the same queries serve as a fast, scriptable search over an app’s bytecode.
- [bun-demincer](https://awesomerea.org/resources/bun-demincer/index.md): Tool · Node.js pipeline that recovers readable JavaScript from Bun-compiled standalone executables. It extracts the embedded module graph and assets, splits the bundle into one file per module, flags npm vendor code with a fingerprint database, and deobfuscates with wakaru, format-preserving renames recovered from export mappings and optional Gemini-suggested names. Dependency-graph clustering, manual or LLM-assisted cluster labels and cross-version artifact transfer then organize and update the output.
- [dex-oracle](https://awesomerea.org/resources/dex-oracle/index.md): Tool · Pattern-based Dalvik deobfuscator that takes an APK, a DEX file or a Smali directory, disassembles it with baksmali and runs plugins that look for obfuscation patterns in the Smali code. To learn what a matched call returns, such as a decrypted string, it merges a small driver into the app's DEX, pushes it to a connected Android device or emulator and invokes the static method there through reflection; the result replaces the call as a constant before the APK or DEX is reassembled. Plugins cover simple string encryption, indexed string and class lookups, certain DexGuard patterns and some reflection, and the author describes it as the inspiration for Simplify.
- [arkdecompiler](https://awesomerea.org/resources/arkdecompiler/index.md): Tool · Decompiler for HarmonyOS NEXT apps, published under the jd-opensource GitHub organization, that turns Panda binary files (.abc Ark bytecode) back into ArkTS source. Its xabc program parses the bytecode, lifts it into the Ark compiler's Panda IR for analysis, rebuilds an ArkTS syntax tree with loop, class, lexical-environment and module-variable reconstruction, and prints that tree as ArkTS code. A cross-platform GUI, built with either Electron or Tauri, adds a file explorer, function and symbol lists, cross-references, search and a hex view; the README links Black Hat Arsenal presentations from 2025 and 2026.
- [JNIAnalyzer](https://awesomerea.org/resources/jnianalyzer/index.md): Tool · A Ghidra extension by Terry Chia (Ayrx) with scripts for analyzing the native libraries of Android NDK apps. JNIAnalyzer.java uses the bundled JADX decompiler to extract the signatures of all native methods declared in an APK and applies the return types, parameter names and parameter types to the matching functions in the loaded .so. RegisterNatives.java uses Ghidra's P-Code API to find RegisterNatives calls and lay down the JNINativeMethod structures for dynamically registered methods, and TraceRegisterNatives.java applies the output of the author's trace_registernatives tool. A JNI data-type archive sets up the jni.h types.
- [Android Reverse](https://awesomerea.org/resources/ultrasina-android-reverse/index.md): Tool · Android app, published only as release APKs, that runs an APK reverse-engineering workflow entirely on the phone, from package extraction and Java decompilation to native analysis, editing and rebuilding. It extracts APK, XAPK and split APKS packages from storage or installed apps, decompiles each class with Jadx (with fallback and IR modes), CFR, Procyon, JD-Core, Krakatau or Vineflower, analyzes native libraries through an embedded radare2 with pseudo-C, assembly, hex, control-flow-graph and call-graph views, and since v20 edits resources, binary XML, the manifest and smali before rebuilding and signing the APK. A built-in MCP server lets MCP clients edit those project files while rebuilding stays a manual step; the README also lists Flutter Dart AOT analysis through Unflutter and Unity il2cpp metadata parsing.
- [jsc-decompile-mozjs-34](https://awesomerea.org/resources/jsc-decompile-mozjs-34/index.md): Tool · PHP decoder and decompiler for SpiderMonkey 34 JavaScript bytecode, which the README says may handle .jsc files compiled by cocos2d-x. It parses the XDR-serialized scripts with their atoms, constants, objects, regular expressions and try and scope notes, decodes instructions from a SpiderMonkey 34 opcode table and rebuilds approximate JavaScript for each function context, while a second script prints the decoded operations instead. The author describes it as unfinished and as an example of how a JavaScript virtual machine works.
- [Andromeda](https://awesomerea.org/resources/andromeda/index.md): Tool · Interactive command-line tool by Lasha Khasaia for first-pass reverse engineering of Android APKs, written in C/C++ for speed. It unpacks an APK, parses AndroidManifest.xml, the signing certificate and the DEX files at the archive root, then opens a shell with tab completion for listing permissions, activities, services, receivers and likely entry points, listing and searching classes, methods and strings, disassembling a method's Dalvik bytecode and listing, hashing or extracting native libraries. Further commands report whether the app is debuggable, a creation date taken from its certificate, URL and email strings, and a guess at whether it was written in Java, Kotlin or Xamarin .NET.
- [Dex-Editor-Android](https://awesomerea.org/resources/dex-editor-android/index.md): Tool · Work-in-progress Android app for editing DEX files on the device, built on a modified in-tree copy of Google's smali, baksmali and dexlib2. It loads one or more DEX files into a class tree and opens classes as smali in a Sora Editor view with method, field and string lists, label jumps, search and replace, method flow diagrams and Jadx decompilation of a class or method to Java, then deletes classes or recompiles the edited DEX files. The README credits MT Manager for the app's logic and interface ideas.
- [smali/baksmali](https://awesomerea.org/resources/smali-baksmali/index.md): Tool · Assembler and disassembler for the dex format used by Android's Dalvik VM: baksmali turns dex, APK, odex and oat files into smali text, and smali assembles that text back into a dex file. The README says the syntax, loosely based on Jasmin's and dedexer's, supports the full dex format, including annotations and debug and line information. baksmali can also deodex odex and oat files and list a dex file's classes, methods, fields, strings and references, while the dexlib2 library reads and writes dex files from Java.
- [dalvikus](https://awesomerea.org/resources/dalvikus/index.md): Tool · Desktop Android reverse-engineering and modification workbench built with Kotlin Compose Multiplatform. It opens APK and DEX files, edits the DEX classes inside an APK as smali without manual unpacking, with syntax highlighting and code completion, and shows decompiled Java from JADX, CFR or Vineflower. It also browses resources and XML through apktool, searches the class tree, string constants and method and field references, re-signs modified APKs with apksig and zipalign, and installs and starts them on a connected device over ADB.
- [paranoid-deobfuscator](https://awesomerea.org/resources/paranoid-deobfuscator/index.md): Tool · Python command-line tool that recovers the strings hidden by the Paranoid and LSParanoid Android string-obfuscation plugins, so that smali code becomes readable for static analysis. It scans a smali directory for the obfuscator's string-lookup method and encoded chunk array, decodes the chunks with Python ports of the libraries' DeobfuscatorHelper and RandomHelper classes, and rewrites each lookup call in place as a const-string instruction with a marker comment. Helper commands list the recovered strings, save the chunks to a file and decode a single string from saved chunks.
- [Katalina](https://awesomerea.org/resources/katalina/index.md): Tool · Python emulator for Dalvik bytecode that its README likens to Unicorn: it parses a DEX file and executes methods one instruction at a time, substituting Python mocks for common Java and Android APIs such as String, StringBuilder, Base64, ArrayList, AES Cipher and part of reflection. Run over Android entry points, methods matching a name or one method with given arguments, it logs the strings that the code builds or decrypts, optionally as JSON, which helps recover obfuscated strings in apps and malware.
- [Doldrums](https://awesomerea.org/resources/doldrums/index.md): Tool · Python parser for the Dart AOT snapshots inside libapp.so, the compiled Dart code of an Android Flutter app. It finds the VM and isolate snapshot symbols with pyelftools, deserializes the snapshot clusters and writes a text dump of every class in the isolate snapshot, with fields, method signatures and each method's absolute code offset in libapp.so. It recovers declarations and offsets for further disassembly, not decompiled function bodies.
- [Frida UI](https://awesomerea.org/resources/frida-ui/index.md): Tool · Local browser interface for Frida aimed at Android app testing: a FastAPI server lists USB, local and remote frida-server devices with their installed apps and running processes, and lets the analyst attach to a process, spawn an app, spawn it with a script injected at launch, detach or kill it. Scripts are written in a Monaco editor or loaded from files or Frida CodeShare, whose scripts can be queued to run at spawn, and each session's console output is kept and can be exported as text.
- [darter](https://awesomerea.org/resources/darter/index.md): Tool · Python module that parses binary Dart VM snapshots, such as the libapp.so of a release Flutter app, into a navigable graph of VM objects with back-references, including the memory structures the snapshot dumps. It reads old, AppJIT and AppAOT snapshots, usually autodetects flags and settings from the snapshot itself, extracts the snapshot blobs from app.so or .snapshot files, and its darter.asm module disassembles ARM and ARM64 code with Capstone to find references to VM objects. The README's examples include extracting an app's string table, finding where an object is used, generating call and library-dependency graphs, exporting metadata for Radare2 and deobfuscating a snapshot by matching it against a reference one.
- [Appshark](https://awesomerea.org/resources/appshark/index.md): Tool · ByteDance's static taint-analysis engine for Android APKs, designed for very large apps, that scans an app against JSON rules naming entry methods, sources, sinks and sanitizers as Jimple signatures, for vulnerability and privacy-compliance review. It works on Soot's Jimple IR and reuses FlowDroid's manifest and resource parsing, but implements its own field-sensitive pointer and taint analysis. Results go to results.json, which records app, component and permission information, deep links and JavaScript bridge interfaces alongside each source-to-sink path, with an HTML page per finding.
- [Wallbreaker](https://awesomerea.org/resources/wallbreaker/index.md): Tool · Frida-based explorer for the live Java heap of a running Android app, loaded as an objection plugin or used through its small Python package. classsearch and objectsearch find loaded classes by pattern and live instances of a class, returning object handles; classdump prints a class's declared fields, static field values and methods, and objectdump prints an instance's field values, can view it as a superclass and lists every entry of a collection or map. Analysts use it to see the runtime data and concrete implementations that static decompilation leaves open.
- [axmlprinter](https://awesomerea.org/resources/axmlprinter/index.md): Tool · Java library and command-line tool that parses Android binary XML, such as the compiled AndroidManifest.xml inside an APK, and prints it as readable XML. Red Naga's near-complete rewrite of the Android4ME AXMLPrinter tolerates manipulated files seen in the wild, including out-of-order string tables and mangled start tags, and can write the classic AXML format back out. Since v2.0.0 it also reads the protobuf XML used in Android App Bundles and detects which format it was given.
- [FlowDroid](https://awesomerea.org/resources/flowdroid/index.md): Tool · Static data-flow (taint) analysis for Android apps and Java programs, built on Soot and usable as a command-line tool or as Maven libraries. Given an APK, the Android SDK platforms directory and a definition of sources and sinks, it models component lifecycles and callbacks to build a call graph and reports flows from sensitive sources to sinks; the bundled SourcesAndSinks.txt is a starting point for privacy leaks, and StubDroid summaries model library methods. Options cover inter-component flows from a supplied ICC model file, path reconstruction, implicit flows, reflection and timeouts that trade precision and recall for speed, and the analysis is described in the PLDI 2014 paper “FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps”.
- [Enjarify](https://awesomerea.org/resources/enjarify/index.md): Tool · Pure-Python 3 translator from Dalvik bytecode to equivalent Java bytecode, so Java analysis tools and decompilers can be applied to Android apps: given an APK, with every DEX file of a multidex APK combined into one jar, or a single DEX file, it writes a jar of class files. Its README contrasts it with dex2jar and lists edge cases it handles, such as Unicode class names, constants used as several types, implicit casts, exception handlers that jump into normal control flow, very long methods and classes that reference too many constants. By default it also applies readability optimizations such as copy propagation and unused-value removal.
- [MagiskFrida](https://awesomerea.org/resources/magisk-frida/index.md): Tool · Magisk, KernelSU and APatch module that installs frida-server on a rooted Android device and starts it at boot, so Frida clients can attach for dynamic instrumentation without starting the server by hand. A daily GitHub Actions job checks for a new Frida release, downloads Frida's official frida-server builds for arm64, arm, x86 and x86_64, and publishes a matching module ZIP with an updater.json for updates from the root manager. The server listens on 127.0.0.1:27042 unless another port is written to a file in the module directory, and the module's action button starts or stops it.
- [de4dot](https://awesomerea.org/resources/de4dot/index.md): Tool · Open-source .NET deobfuscator and unpacker that tries to restore a packed and obfuscated assembly to almost its original form. Depending on the obfuscator, it decrypts strings, constants, methods, resources and embedded assemblies statically or dynamically, removes proxy methods, junk classes and tamper-detection and anti-debug code, devirtualizes virtualized code, deobfuscates control flow and renames symbols to readable names; it can also just detect which obfuscator was used. The README lists 19 supported obfuscators and packers, among them Dotfuscator, .NET Reactor, Eazfuscator.NET and SmartAssembly.
- [ClassyShark](https://awesomerea.org/resources/classyshark/index.md): Tool · Google's standalone browser for Android executables and libraries that shows class interfaces and members, dex counts and dependencies. It opens .dex, .aar and .so libraries, .apk, .jar and .class executables and Android binary XML files such as AndroidManifest, resources and layouts, and it can export what it shows as text.
- [JEB Decompiler](https://awesomerea.org/resources/jeb-decompiler/index.md): Tool · PNF Software's commercial reverse-engineering platform for Android apps and native code, combining a Dalvik decompiler and Android debuggers with disassemblers and decompilers for x86, ARM, MIPS and RISC-V machine code. For APKs it decompiles multi-dex Dalvik bytecode to Java, reconstructs resources and obfuscated XML, cleans up obfuscated code with optimizers that decrypt content and undo reflection, and debugs Dalvik and native ARM or Intel code in one session, stepping from Dalvik into JNI methods. Modules in JEB Pro also decompile WebAssembly, Ethereum EVM contracts (to Solidity-like code), Siemens S7-300/400 PLC blocks and Nvidia SASS GPU code and analyze PDF documents, and its loaders read PE, ELF, Mach-O, Intel HEX and raw (headless) firmware images. The JEB API lets Java and Python scripts, back-end plugins and custom headless clients automate analysis, and JEB also exposes an MCP server for AI agents.
- [Luyten](https://awesomerea.org/resources/luyten/index.md): Tool · Graphical Java decompiler front end for the Procyon decompiler, with its editor view powered by RSyntaxTextArea.
- [jd-cli](https://awesomerea.org/resources/jd-cli/index.md): Tool · Command-line wrapper around a jd-core fork that decompiles Java class and JAR files to the console, a directory or a ZIP file, with options for line numbers, file-matching patterns and parallel processing. It also ships as a Docker image and as a Java library.
- [Android Unpacker](https://awesomerea.org/resources/android-unpacker/index.md): Tool · Code and slides from the Defcon 22 talk "Android Hacker Protection Level 0". It holds a gdb and adb script for Bangcle and SecShell, a native unpacker for APKProtect, Bangcle, LIAPP and Qihoo Packer, tweaks that hide QEMU and debuggers from APKProtect, and a Corellium-based dynamic unpacking approach with automation.
- [ReverseAPK](https://awesomerea.org/resources/reverseapk/index.md): Tool · Command-line tool that decompiles an APK to Java and Smali, lists the extracted files, and statically checks AndroidManifest.xml and the source for common vulnerabilities and behaviours such as intents, command execution, content providers, crypto references and hardcoded secrets.
- [xHook](https://awesomerea.org/resources/xhook/index.md): Tool · PLT hook library for Android native ELF executables and shared libraries. It handles ELF HASH and GNU HASH symbols and SLEB128-encoded relocations, selects targets with regular expressions, and needs no root or system permissions.
- [Epic](https://awesomerea.org/resources/epic-android-hook/index.md): Tool · Continuation of Dexposed on ART: a runtime method-hooking framework that loads into an app and can hook both the app's own code and Android framework code running in its process. Stated uses include instrumentation and security audits.
- [apkscope](https://awesomerea.org/resources/apkscope/index.md): Tool · apkscope inspects Android application packages through a Rust viewer, CLI, and MCP server. It decompiles DEX classes into Java, searches code and references, reads manifests and resources, scans URLs and secrets including native libraries, and can export or modify packages.
- [NWBinAnalyzer](https://awesomerea.org/resources/nwbinanalyzer/index.md): Tool · NWBinAnalyzer inspects compiled NW.js .bin files by checking their header and walking constant-pool entries. Its Python code extracts UTF-8, null-terminated and length-prefixed strings, then groups findings such as API names, paths, URLs and cryptographic terms.
- [derkt](https://awesomerea.org/resources/derkt/index.md): Tool · derkt parses and disassembles Hermes Bytecode files in Racket. It decodes HBC structures and function data, detects the bytecode version and loads a matching generated instruction definition before producing disassembly. The repository includes versioned ISA definitions, parsers and a sample HBC file.