Open Source Python Reverse Engineering Tools for Android

Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts. Works on Windows, macOS, GNU/Linux, iOS, Android, and QNX. Install the Node.js bindings from npm, grab a Python package from PyPI, or use Frida through its Swift bindings, .NET bindings, Qt/Qml bindings, or C API. Frida is and will always be free software (free as in freedom). We want to empower the next generation of developer tools, and help other free software developers achieve interoperability through reverse engineering. We are proud that NowSecure is using Frida to do fast, deep analysis of mobile apps at scale. Frida has a comprehensive test-suite and has gone through years of rigorous testing across a broad range of use-cases.

Android reverse engineering & automation framework. The most powerful Android capture/reverse/HOOK & cloud phone/remote desktop/automation framework in history, your work has never been so easy and fast. LAMDA is an auxiliary framework for reverse engineering and automation. It is designed to reduce the time and trivial problems of security analysts and application testers. It replaces a large number of manual operations with a programmed interface. It is not a single-function framework. To give you a general idea of ​​its usefulness: Do you install various agents, plug-ins, or point-and-click settings on your phone to complete your work? Do you want to operate a mobile phone thousands of miles away in a different place? Do you have the need to programmatically control your phone? Are you still paying for expensive IP switching , remote ADB debugging , RPA automation and even logcat logs from some cloud mobile phone manufacturers? If so, then yes, just one LAMDA can solve all this.

OWASP Mobile Application Security Testing Guide (MASTG) is a free, open-source resource that provides comprehensive guidance for testing and evaluating the security of mobile applications. Developed by the Open Worldwide Application Security Project (OWASP), the guide offers practical methodologies, technical instructions, and testing procedures for identifying security vulnerabilities in Android and iOS applications. MASTG covers a wide range of mobile security topics, including data storage, cryptography, authentication, network communication, platform interactions, and reverse engineering. The guide aligns with the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Weakness Enumeration (MASWE), helping organizations evaluate applications against established security requirements. Security professionals can use its detailed testing techniques, tool recommendations, practical examples, and hands-on exercises.

apk-reverse is an Agent Skill for structured Android application reverse-engineering work in authorized research environments. It is designed for Claude Code, Codex, and other systems that support the Agent Skills format rather than as a conventional end-user application. Its scope includes APK analysis, debloating, controlled Dex modifications, repacking, runtime investigation, and client-versus-server diagnosis. A gated workflow forces agents to verify assumptions, environment state, and control builds before making changes. Detailed references catalog common failure modes involving signing, packaging, native code, protected applications, and runtime behavior. Parameterized scripts, environment checks, tests, and evidence records help agents perform repeatable analysis while the project explicitly restricts its intended use to owned, authorized, or sandboxed targets.