FuseFixer is an Android Xposed module that hooks into the MediaProvider's FUSE daemon to prevent package name existence leakage via Unicode Default_Ignorable_Code_Points. The module intercepts path comparison functions (strcasecmp, EqualsIgnoreCase) and access control checks (is_package_owned_path, is_app_accessible_path, is_bpf_backing_path) in the native libfuse_jni.so library, stripping out ignorable code points before evaluation. This closes a vulnerability where attackers could bypass directory access restrictions on /storage/emulated/.../Android/data by inserting invisible Unicode characters. The project includes a custom ELF parser for dynamic symbol resolution, a maps scanner, and a debug UI for testing. The native code is written in C++20 and demonstrates deep understanding of Android's FUSE implementation, kernel casefold behavior, and FUSE BPF internals.
dpt-shell is a sophisticated Android application protection framework that implements a 'hollow shell' obfuscation technique. It functions as a two-part system: a Java-based CLI processor (dpt) that analyzes and modifies target APK/AAB files, and a native Android shell (shell) that is injected into the target application. The processor extracts method bytecode (CodeItem) from the original Dex files, encrypts them, and replaces the original code with NOP instructions. At runtime, the injected shell hooks Android's class loading mechanisms (DefineClass/LoadClass) using native libraries (Dobby, bhook), decrypts the stored bytecode, and patches the memory of the loaded Dex file to restore the original code before execution. This architecture provides runtime code integrity verification and anti-tampering capabilities. The codebase demonstrates high craftsmanship in both Java and C++. The Java processor utilizes smali/dexlib2 for bytecode manipulation and implements a robust rule-based exclusion system for framework classes. The C++ shell implements low-level memory management, ELF parsing, and dynamic hooking to intercept Android Runtime (ART) operations. It includes anti-debugging, anti-Frida, and signature verification features. The project targets very recent Android SDK versions (36) and build tools (Gradle 8.14), indicating active development and forward-looking compatibility.
This repository is a comprehensive, modular Android application security auditing framework designed for AI agents and security engineers. It automates the entire assessment lifecycle, from APK ingestion and static analysis to dynamic instrumentation, RASP (Runtime Application Self-Protection) detection and bypass, and professional reporting aligned with OWASP MASTG and MASVS v2 standards. The architecture is a well-organized toolkit of Python, Bash, and JavaScript (Frida) scripts, orchestrated by shell entry points and sharing a common library (`scripts/lib/`). Key capabilities include a 37+ script Frida arsenal for runtime manipulation, a Semgrep rule set for static vulnerability detection, a DRY bypass profile system for countering RASP solutions, and a weighted scoring engine for MASVS compliance. The codebase emphasizes modularity, schema-driven findings, and CI/CD integration. While the codebase demonstrates strong engineering practices and contains several genuinely reusable components (findings pipeline, Frida script templates, compliance scoring models), its heavy reliance on the rapidly evolving Android and Frida ecosystems introduces a medium level of technical drift. The presence of speculative content on unreleased Android versions and deprecated API references are noted risks. Overall, it is a high-quality, production-grade security toolkit that effectively bridges the gap between manual pentesting and automated security pipelines.
This is not a conventional software application — it is a curated awesome-list repository (classified as 'application' only because its CI/CD pipeline and shell tooling are the sole executable content). The actual product is README.md: a comprehensive, categorized catalog of Android security resources covering online analyzers, static/dynamic analysis tools, reverse-engineering utilities, fuzzers, vulnerability scanners, intentionally vulnerable practice apps, research papers, malware datasets, exploit lists, and bug bounty programs. The repository ships no libraries, services, or user-facing code; its runtime behavior is limited to link-liveness checking (urlsup) and linting of the repository's own documentation and automation. The repository's engineering value lives in its maintenance infrastructure. GitHub Actions workflows lint Markdown (mdl), shell scripts (shellcheck), YAML (yamllint), and the workflows themselves (actionlint plus a zizmor security scan), while a scheduled job validates all README links weekly using a carefully curated urlsup configuration (.urlsup.toml) that distinguishes dead links (strikethrough-removed from the list) from flaky or bot-protected endpoints (allowed 403/429/503). Dead and archived tools are explicitly marked with strikethrough in the README, keeping the resource list honest without silently deleting historical references. All third-party actions are pinned to commit SHAs, permissions are least-privilege, and the cargo-based link checker is cached for fast CI runs. For an Android security practitioner, the repo serves as the de facto reference index for the ecosystem — many entries point to the actual tools (MobSF, Drozer, Frida, jadx, Androguard, QARK) and malware datasets (AndroZoo, Drebin, Kharon). For an engineer, the reusable assets are the link-liveness pipeline and the CI self-audit pattern, both of which can be transplanted into any link-heavy or automation-heavy repository. The repo is a hybrid: content-curation project with application-grade CI scaffolding around it, rather than either a true application or a data research project.
APKDeepLens is a Python-based CLI static analysis tool for Android APK security assessment. It decompiles APKs using bundled JADX, analyzes AndroidManifest.xml for misconfigurations, scans decompiled source code for OWASP Mobile Top 10 vulnerabilities, detects hardcoded secrets and insecure URLs, and generates reports in JSON/HTML/PDF/TXT formats. The architecture is monolithic with modular components for manifest analysis, code scanning, secret extraction, and report generation. Entry point is APKDeepLens.py with argparse CLI interface. External dependencies include JADX (bundled), xhtml2pdf for PDF generation, and python-bidi for PDF rendering.
drozer is a comprehensive Android security testing framework that operates as a Python CLI application with a Twisted-based server and an on-device agent. Its primary function is to assess the security posture of Android applications and devices by enumerating components (activities, services, content providers, broadcast receivers), scanning for vulnerabilities (SQL injection, path traversal, world-writable files), and delivering exploitation payloads (reverse shells, privilege escalation). The architecture follows a client-server model: the drozer console connects to a remote server (port 31415) that communicates with an agent running on the Android device via a custom protocol defined by Protocol Buffers. The agent exposes a remote Java reflection API (pysolar) that allows the console to invoke arbitrary methods, instantiate objects, and interact with the Android runtime.
This repository is a curated collection of publicly available Android APK files designed for detecting root access, Magisk, Zygisk, and other modifications. It aggregates dozens of detection applications (e.g., DirtySepolicy, DetectZ, MagiskDetector, Momo, Ruru, etc.) in binary form, with a README that outlines each app's capabilities. The repo does not contain original source code; instead, it serves as an archive and distribution point for these PoC tools. Security researchers and developers can use these APKs to test their own root detection implementations or to study evasion techniques, but the binary-only nature means there is no modifiable code or reusable software components within this repository itself.
This repository is a large collection of standalone Python scripts designed for the Termux environment on Android. It is marketed as an educational cybersecurity toolkit but contains functional phishing pages, credential harvesters, location trackers, camera/mic capture scripts, and a trojan for data exfiltration. The codebase also includes some legitimate utilities such as a password manager, file converter, network scanner, and backup tool. The architecture is highly fragmented: each script is self-contained with its own dependency auto-installation, Flask server, and cloudflared tunnel for public exposure. There is no shared module structure, and the code is heavily duplicated across English and Greek translations. The overall quality is low due to copy-paste patterns, hardcoded secrets, suppressed error logging, lack of testing, and reliance on external services like cloudflared. The repository poses significant legal and ethical risks due to its phishing and surveillance capabilities.
This repository is a curated 'awesome list' of Android security resources. It contains a single README.md file that organizes links to blogs, tools (static/dynamic analysis, online analyzers, decompilers, forensics), papers, books, training materials, labs, talks, bug bounty writeups, cheat sheets, and checklists. No executable code, APIs, or data pipelines are present. The repo functions solely as a reference index for Android security practitioners and researchers. It has no software architecture, no entry points, and no data flows. The only file beyond README is the MIT license.