A binary instrumentation framework for analyzing and modifying Android app Dalvik bytecode.
Redexer is a binary instrumentation framework for Dalvik bytecode that enables static analysis and modification of Android app binaries. It parses DEX files, performs various analyses like control-flow and intent resolution, and can rewrite apps to inject logging or security checks. The tool is designed for deep inspection and manipulation of Android applications without requiring source code.
Security researchers, reverse engineers, and Android developers who need to analyze, instrument, or audit compiled Android apps for vulnerabilities, behavior analysis, or research purposes.
Redexer provides a comprehensive, programmatic interface for low-level Dalvik bytecode manipulation and static analysis, which is rare in open-source tools. Its ability to infer permission usage, instrument apps for logging, and perform detailed data-flow analyses makes it a powerful framework for security research and app understanding.
The Redexer binary instrumentation framework for Dalvik bytecode
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Includes control-flow graphs, call graphs, and data-flow analyses like liveness and constant propagation, enabling thorough code inspection without source code, as shown in the usage commands for cfg, cg, and live analysis.
Can rewrite Dalvik bytecode to inject logging code for method calls or user interactions, useful for behavior analysis and testing, demonstrated by the logging and logging_ui features with pre-built DEX files.
RefineDroid feature infers parameters with which apps use permissions, aiding in security vulnerability detection by analyzing permission patterns statically.
Extracts and analyzes manifest data, components, permissions, SDK versions, and layout elements, as detailed in commands like permissions, sdk, and custom_views for full app understanding.
Requires installation of OCaml, Ruby, Android SDK, and multiple packages like ocamlfind, sha, and Nokogiri, with specific environment variable configurations, making initial deployment time-consuming and error-prone.
Tested with OCaml 4.09.0 and Ruby 1.8.6, which are older versions and may lead to compatibility issues on modern systems, as admitted in the Requirements section.
Operates entirely via command-line scripts, requiring familiarity with terminal tools and Dalvik bytecode, which limits accessibility for users preferring visual interfaces.
Focuses on DEX files and may not support analysis of apps using newer Android features like ART runtime or advanced obfuscation techniques, restricting its applicability to legacy or specific cases.