Analysis tools
Tools for inspecting packages, source code and binaries.
Frida: mobile runtime analysis
Frida investigates the behavior of running applications. In app protection testing, the relevant question is which trust assumption and business outcome an authorized…
Read the guideobjection: exploring mobile runtime behavior
objection simplifies mobile runtime investigation. Its observations depend on specific device and application conditions, which the report should document.
Read the guideMobSF: a mobile security analysis platform
MobSF can support a mobile analysis workflow. Follow automated findings with source or package evidence and impact assessment in an actual business flow.
Read the guideAndroguard: Android analysis with Python
Androguard helps teams incorporate Android packages into Python analysis and automation.
Read the guideInspecting Android code with JADX
JADX helps explain Android code structure. Its output is an interpretation of the compiled program, not a guaranteed reconstruction of the complete original source.
Read the guideApktool: Android resources and package inspection
Apktool can inspect package resources and related structures. Record that the examined artifact corresponds to the actual release package.
Read the guideAnalyzing mobile native code with Ghidra
Ghidra supports binary analysis of native mobile components. Interpret its static view against the actual architecture and execution context.
Read the guideradare2: command-line binary analysis
radare2 provides tools for command-line binary inspection and automation. Record analysis steps and artifact versions during application-protection assessment.
Read the guideThe Rizin binary analysis toolkit
Useful Rizin output extends beyond function names. Connect data flows, reachable code and verification boundaries to actual application behavior.
Read the guideCutter: a graphical analysis environment for Rizin
Cutter helps organize binary investigation through a graphical interface. The meaning of displayed code still depends on analyst verification and architecture context.
Read the guideMobile binary inspection with Binary Ninja
Binary Ninja supports code and data-flow analysis in native mobile libraries. Higher-level representations provide hypotheses to test, not independent execution evidence.
Read the guideIDA Pro: the disassembler and decompiler ecosystem
IDA Pro can help explain native code in mobile packages. Security conclusions require connecting decompiler output to real entry points and business impact.
Read the guideJEB Decompiler and Android analysis
JEB is an option for Android application analysis. Treat protected-code readability and the effectiveness of a critical control as separate questions.
Read the guideInspecting Mach-O with Hopper
Hopper can support analysis of native iOS code. Read results alongside production signing, architecture and paths reachable during execution.
Read the guideLIEF: executable-file analysis with Python
LIEF supports programmatic inspection of executable structures. Python automation should not silently turn unexpected formats or missing fields into successful results.
Read the guideThe Capstone disassembly engine
Capstone translates machine code into instruction representations. It is an engine for broader analysis tooling, not a complete security product.
Read the guideThe Unicorn CPU emulator
Unicorn is a CPU-emulation component. Investigating a bounded code region differs from representing an entire mobile operating system or physical-device security.
Read the guideangr: symbolic analysis with Python
angr supports symbolic analysis and investigation of program behavior. Results for mobile binaries depend on the model, inputs and environmental assumptions.
Read the guidepwntools: Python automation for security laboratories
pwntools can assist automation in authorized security laboratories. Keep scope, test data and evidence sensitivity explicit in app protection work.
Read the guideInspecting ELF and DWARF with pyelftools
pyelftools helps Python scripts inspect ELF and DWARF data. Reports must not confuse an absent field with proof of application security.
Read the guideAutomating radare2 with r2pipe
r2pipe connects radare2 output to automation. A reliable pipeline checks versions, command results and parsing failures; empty output is not successful analysis.
Read the guidedex2jar: DEX and Java class tooling
dex2jar supports transformations between DEX and the Java class ecosystem for analysis.
Read the guideWhat are smali and baksmali?
smali and baksmali support inspection at the DEX level. Focus on how a critical control is used within a workflow, beyond the readability of the representation.
Read the guideInspecting Android distribution packages with bundletool
bundletool helps evaluate Android distribution packages against device conditions. Security tests should cover actual installation structures as well as a universal APK.
Read the guideVerifying APK signatures with apksigner
apksigner is a core tool for checking a final APK's signature information.
Read the guide