A Python toolkit for reverse engineering, analyzing, and pentesting Android applications (APK, DEX, resources).
Androguard is a Python-based toolkit for reverse engineering and security analysis of Android applications. It allows users to parse APK files, disassemble DEX bytecode, decode resources, and perform both static and dynamic analysis to identify vulnerabilities and understand app behavior.
Security researchers, malware analysts, penetration testers, and developers focused on Android application security and reverse engineering.
It provides a comprehensive, scriptable, and extensible suite of tools specifically for Android, with features like Frida integration and SQLite session storage, making it a go-to solution for in-depth Android security analysis.
Reverse engineering and pentesting for Android applications
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Parses multiple Android file types including APK, DEX, ODEX, and binary XML, providing an all-in-one solution for reverse engineering, as listed in the Features section.
Integrates with Frida for runtime instrumentation, enabling dynamic analysis without switching tools, which is a specific feature mentioned in the README.
Built as a modular toolkit with SQLite session storage, allowing for persistent analysis and integration into larger security workflows, per the Philosophy.
Used by prominent projects like MobSF, Cuckoo Sandbox, and VirusTotal, indicating reliability and community trust, as shown in the Projects list.
The README explicitly states that documentation is 'InProgress' and contains outdated information, making it difficult for new users to rely on official guides.
Version 4.0.0 introduced substantial differences and removed functionalities from the previous stable version 3.3.5, which can break existing projects, as warned in the IMPORTANT note.
The decompiler (DAD) is described as 'basic' in the Features, which may not be sufficient for complex or heavily obfuscated code compared to more advanced tools.