x64dbg is an open-source binary debugger for Windows targeting malware analysis and reverse engineering. The architecture is a three-layer system: a GUI layer (Qt-based Windows application), a bridge layer (C API for communication), and a debugger core layer (TitanEngine/GleeBug/StaticEngine backends). The debugger supports x86 and x64 processes with comprehensive features including conditional breakpoints, memory analysis, symbol handling, and an extensive plugin SDK. The codebase demonstrates strong engineering in several areas. The analysis engine implements multiple analysis passes (linear, recursive, control flow, xrefs) with a clean pass-based architecture. The command system uses a flexible registration pattern with consistent error handling. The bridge layer provides a well-defined C API surface for plugins with careful attention to thread safety and marshaling between GUI and debugger threads. Recent development shows active work on Linux support (ElfBug debugger), cross-platform tools (hex viewer, minidump analyzer, remote table), and a comprehensive test framework with headless testing infrastructure. The test system uses convention-based test discovery with script-driven scenarios and plugin-based assertions. Technical debt includes some outdated documentation (docs reference Python 2.7 for CHM generation), mixed use of Qt versions (5.12+ required but some paths reference older configurations), and the inherent complexity of maintaining both Windows debugger and cross-platform analysis tools in one repository. The dependency on precompiled libraries (TitanEngine, Zydis, XEDParse) creates build complexity but is managed through CMake.
TruffleHog is a comprehensive, actively maintained secret scanning tool written in Go. It detects exposed credentials, API keys, tokens, and other sensitive information across a wide range of sources including Git repositories, cloud storage (S3, GCS), Docker images, CI/CD systems (Jenkins, Travis CI, CircleCI), and many third-party services. The architecture is modular: a core engine orchestrates scanning from various sources, a large library of over 700 detectors (each implementing a standard interface) identifies secrets using regex patterns and Aho-Corasick pre-filtering, and optional HTTP-based verification confirms whether discovered secrets are still valid. The tool also includes a terminal UI (Bubble Tea), a permissions analyzer for deeper credential assessment, and output formats like JSON, SARIF, and GitHub Actions annotations. External dependencies include cloud SDKs, database drivers, and numerous third-party API clients, but the core scanning logic is self-contained and well-structured.
This repository is a comprehensive, modular Android application security auditing framework designed for AI agents and security engineers. It automates the entire assessment lifecycle, from APK ingestion and static analysis to dynamic instrumentation, RASP (Runtime Application Self-Protection) detection and bypass, and professional reporting aligned with OWASP MASTG and MASVS v2 standards. The architecture is a well-organized toolkit of Python, Bash, and JavaScript (Frida) scripts, orchestrated by shell entry points and sharing a common library (`scripts/lib/`). Key capabilities include a 37+ script Frida arsenal for runtime manipulation, a Semgrep rule set for static vulnerability detection, a DRY bypass profile system for countering RASP solutions, and a weighted scoring engine for MASVS compliance. The codebase emphasizes modularity, schema-driven findings, and CI/CD integration. While the codebase demonstrates strong engineering practices and contains several genuinely reusable components (findings pipeline, Frida script templates, compliance scoring models), its heavy reliance on the rapidly evolving Android and Frida ecosystems introduces a medium level of technical drift. The presence of speculative content on unreleased Android versions and deprecated API references are noted risks. Overall, it is a high-quality, production-grade security toolkit that effectively bridges the gap between manual pentesting and automated security pipelines.
objection is a runtime mobile exploration toolkit powered by Frida, designed for security testing of iOS and Android applications without requiring jailbreak or root access. It provides an interactive REPL (objection explore) that lets security researchers bypass SSL pinning, dump keychain/keystore data, monitor cryptographic operations, inspect heap memory, hook methods, and bypass jailbreak/root detection — all by injecting a Frida agent into the target process. Architecture: The Python backend handles CLI commands, device state management, and patching (injecting Frida gadget into IPA/APK files). The TypeScript agent running inside the mobile app exports RPC methods for platform-specific features (Android: hooking, keystore, intents; iOS: keychain, crypto, biometrics). Communication happens over Frida's bi-directional transport. A Flask API server exposes RPC and script endpoints for remote control. The system uses a centralized state layer (connection, device, jobs) and a plugin system for extensibility. Key entry points: 'objection explore' (REPL), 'objection patchapk'/'objection patchipa' (binary patching), 'objection api' (API server), and the agent entry point in 'agent/src/index.ts'. External dependencies include frida, frida-tools, frida-fs, frida-screenshot, Flask, apktool, and GitHub API for gadget downloads. The codebase is well-structured for mobile security automation but shows some drift with deprecated CLI flags, Python 2 compatibility checks, and TODOs for advanced hooking targets.
fridaUiTools is a PyQt5 desktop application that serves as a comprehensive workbench for Android reverse engineering using Frida. It integrates dozens of Frida scripts for common tasks such as SSL unpinning, DEX dumping, JNI tracing, memory scanning, native hooking, and anti-debug bypass. The tool provides a unified GUI with attach/spawn modes, USB/WiFi connectivity, Frida server management, and AI-assisted script generation and log analysis. The architecture is a monolithic PyQt5 application with a main window (kmainForm.py) that orchestrates multiple dialog forms (e.g., SearchMemory, Wallbreaker, ZenTracer) and a background thread (TraceThread) for Frida script execution. While the codebase is functional and feature-rich, it suffers from tight coupling, duplicate scripts, hardcoded paths, and some dead code, making it more of a practical tool than a reference-quality codebase.