Awesome Android Reverse Engineering

What it is

Awesome-Android-Reverse-Engineering is a GitHub list (MIT licence) by user1342 that marks its best and most current entries with a ☆. The list gives one-line descriptions and no usage instructions, versions or commands. The summary names the main categories. This note covers the starred picks and the entries it leaves out.

Starred entries

• Decompilers: JADX, Apktool, Ghidra, and APKLab (a VS Code extension that integrates several tools).
• Dynamic analysis: Frida, Objection, FriDump (dumps app memory through Frida), and Binder Trace (intercepts and parses Android Binder messages).
• Deobfuscation: Obfu[DE]scate, which uses fuzzy comparison logic.
• Network: Burp Suite.
• Firmware and visualisation: imjtool (firmware unpacking across vendors and formats) and APK Dependency Graph (class dependencies).
• Reading: Maddie Stone's training, Android Internals: A Confectioner's Cookbook, and the Mobile Offensive Security Pocket Guide.
• Practice: OWASP UnCrackable Mobile Apps.

Useful tools the summary does not name

• Setup and workflow: apk-mitm prepares APKs for HTTPS inspection, uber-apk-signer signs and zip-aligns repackaged APKs, and LADB gives a local ADB shell on the device.
• Analysis: Drozer for dynamic security testing, Dexcalibur for automated instrumentation, Androguard, androwarn, QARK, AndroBugs, and AutoDroid for mass APK collection and analysis.
• Hooking and syscalls: Xposed, RMS (a Frida web interface), and jtrace (strace-like, for Android system calls).
• Defensive detection: libhooker detects Frida and Xposed, Paranoid detects root and tampering, ATDF implements tamper detection, and DIS{integrity} analyses APKs for root, integrity and tamper checks. A RUNIC tamper detection demo is also linked.
• Firmware and kernel: Binwalk, AFLSmart, FirmWire (baseband firmware analysis), and an Android Kernel Exploits collection.
• Training targets: Broken Droid Factory generates pseudo-random vulnerable apps.
• Case studies: a Houseparty post-mortem, an analysis of the SharkBot banking Trojan, and an In-the-Wild Series on Android exploits.

Caveats

• The page flags apk2gold as possibly outdated.
• The "Obfuscation Tools" heading is empty in the fetched text.
• Burp Suite, IDA Pro and JEB are described as commercial, and Ghidra as free and open source.
• OverTheWire Narnia is described as not Android-specific.