An Xposed module for dynamic analysis of Android apps via API hooks, unexported activity launching, and runtime inspection.
Inspeckage is an Xposed module for dynamic analysis of Android applications that hooks into the Android API to monitor and manipulate app behavior at runtime. It helps security researchers understand what an app is doing by intercepting API calls, inspecting components, and enabling actions like starting unexported activities. The tool provides a comprehensive view of app internals without requiring source code modifications.
Android security researchers, penetration testers, and developers who need to analyze app behavior for vulnerabilities, reverse engineering, or security assessments. It's particularly useful for those working with the Xposed Framework.
Inspeckage offers a unified, feature-rich platform for dynamic analysis with extensive API hooks, runtime manipulation capabilities, and detailed app introspection. Unlike basic debugging tools, it provides deep access to non-exported components and real-time monitoring through a single interface.
Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Inspeckage intercepts and logs calls to Android APIs for crypto, HTTP, file system, SQLite, and more in real time, as listed in the hooks section of the README, providing deep runtime visibility.
It lists both exported and non-exported activities, services, content providers, and broadcast receivers with detailed metadata, enabling comprehensive app structure analysis without source code.
The tool allows actions like starting unexported activities, bypassing SSL pinning, and manipulating function parameters, as detailed in the Actions section, for advanced security testing.
Inspeckage supports HTTP proxy configuration and ARP table management directly from the interface, facilitating network traffic analysis alongside other hooks.
Inspeckage requires the Xposed Framework to be installed and enabled, which often involves rooting or specific device modifications, limiting its use to modified environments only.
Setup involves multiple steps through Xposed Installer, enabling modules, and rebooting the device, as outlined in the Installation section, making it cumbersome for quick analysis.
The README admits that 'an HTTP proxy tool is still the best alternative' for HTTP analysis, indicating built-in hooks may be insufficient for comprehensive traffic monitoring.