Inspeckage
An Xposed module for dynamic analysis of Android apps via API hooks, unexported activity launching, and runtime inspection.
What is Inspeckage?
Inspeckage is an Xposed module for dynamic analysis of Android applications that hooks into the Android API to monitor and manipulate app behavior at runtime. It helps security researchers understand what an app is doing by intercepting API calls, inspecting components, and enabling actions like starting unexported activities. The tool provides a comprehensive view of app internals without requiring source code modifications.
Android security researchers, penetration testers, and developers who need to analyze app behavior for vulnerabilities, reverse engineering, or security assessments. It's particularly useful for those working with the Xposed Framework.
Inspeckage offers a unified, feature-rich platform for dynamic analysis with extensive API hooks, runtime manipulation capabilities, and detailed app introspection. Unlike basic debugging tools, it provides deep access to non-exported components and real-time monitoring through a single interface.
Overview
Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
Use Cases
Best For
- Dynamic analysis of Android app security vulnerabilities
- Reverse engineering Android applications to understand runtime behavior
- Testing app resilience against SSL pinning bypass and certificate validation
- Inspecting non-exported activities and internal components
- Monitoring cryptographic operations, file system access, and SQLite usage in apps
- Analyzing HTTP traffic and proxy configurations within Android applications
Not Ideal For
- Projects requiring only static analysis without runtime hooks or device modification
- Users operating on non-rooted or stock Android devices without Xposed Framework
- Developers needing a simple, GUI-based app analyzer with zero setup or technical overhead
- Teams prioritizing real-time monitoring on production devices without system-level changes
Pros & Cons
Pros
Inspeckage intercepts and logs calls to Android APIs for crypto, HTTP, file system, SQLite, and more in real time, as listed in the hooks section of the README, providing deep runtime visibility.
It lists both exported and non-exported activities, services, content providers, and broadcast receivers with detailed metadata, enabling comprehensive app structure analysis without source code.
The tool allows actions like starting unexported activities, bypassing SSL pinning, and manipulating function parameters, as detailed in the Actions section, for advanced security testing.
Inspeckage supports HTTP proxy configuration and ARP table management directly from the interface, facilitating network traffic analysis alongside other hooks.
Cons
Inspeckage requires the Xposed Framework to be installed and enabled, which often involves rooting or specific device modifications, limiting its use to modified environments only.
Setup involves multiple steps through Xposed Installer, enabling modules, and rebooting the device, as outlined in the Installation section, making it cumbersome for quick analysis.
The README admits that 'an HTTP proxy tool is still the best alternative' for HTTP analysis, indicating built-in hooks may be insufficient for comprehensive traffic monitoring.
Frequently Asked Questions
Related Projects
Mobile-Security-Framework MobSFMobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
DrozerThe Leading Security Assessment Framework for Android.
Runtime Mobile Security (RMS)Runtime Mobile Security (RMS) 📱🔥 - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime
BridaThe new bridge between Burp Suite and Frida!
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.