Tools

The Android counterpart to iLEAPP — parses an Android filesystem or physical extraction into categorised, human-readable reports covering messaging, browser, app and system artifacts.

python3 aleapp.py -t fs -i extraction/ -o report/

Python library and CLI for reverse-engineering Android apps programmatically — parses DEX/APK structure, builds call graphs and diffs for scripted analysis rather than manual GUI review.

androguard analyze app.apk

Fingerprints an APK's toolchain, compiler and packer/obfuscator (PEiD for Android) — quickly flags whether a sample was built with a known obfuscation or packing tool.

apkid app.apk

Decodes Android APK resources back to a near-original form and rebuilds them after edits — the standard first step in Android reverse engineering and repackaging.

apktool d app.apk

All-in-one Java/Android reverse engineering GUI bundling several decompilers (Procyon, CFR, FernFlower) side by side plus a bytecode editor and debugger.

Commercial mobile device forensics platform (UFED and related products) — the industry-standard hardware/software for extracting and decoding data from seized mobile devices.

Generates Objective-C header files from a compiled Mach-O binary, exposing an iOS app or framework's class/method structure without source — the starting point for most iOS reversing.

class-dump -H MyApp.app/MyApp -o headers/

Cloud-hosted virtual iOS and Android devices with full root/jailbreak-equivalent access, used for mobile security research at scale where physical jailbroken hardware does not.

Converts Android's Dalvik .dex bytecode into a standard .jar so ordinary Java decompilers (JD-GUI, Bytecode Viewer) can read it.

d2j-dex2jar.sh app.apk

Android security assessment framework built around an in-app agent — enumerate and interact with exported activities, content providers, services and broadcast receivers from a console.

drozer console connect

Commercial mobile forensics tool for acquiring iOS/iCloud and some Android/BlackBerry backups and keychains — widely used in lawful mobile device examinations.

Dynamic instrumentation toolkit for injecting JavaScript into a running process to hook functions, dump traffic or bypass checks — as at home reversing a mobile app as a native binary.

frida -U -f com.target.app -l hook.js --no-pause

Fast, configurable Android emulator built on VirtualBox/QEMU, popular for mobile app testing because it is quicker to snapshot/reset and easier to root than the stock AVD emulator.

Parses a full-filesystem iOS extraction into readable, categorised forensic reports (messages, location, app usage, health data) — the standard open-source companion to a Cellebrite/GrayKey iOS acquisition.

python3 ileapp.py -t fs -i extraction/ -o report/

Decompiles Android DEX bytecode back into readable Java source, with a GUI for browsing the result — usually paired with Apktool for a full APK reversing workflow.

jadx app.apk

Official Kali Linux mobile penetration testing platform — runs a Kali chroot/rootfs alongside Android, with wireless injection support and NetHunter-specific apps on compatible devices.

macOS persistence almost always lives in a LaunchAgent or LaunchDaemon plist — this lists every one across the user and system locations in one pass.

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

Commercial DFIR platform from Magnet Forensics — unifies computer, mobile and cloud artifact recovery with a single timeline/case view, common in corporate and LE forensics labs.

Preconfigured Windows VM for mobile app pentesting — bundles Genymotion, Burp, Frida, MobSF and the rest of the usual Android/iOS testing stack so it does not need assembling by hand.

An automated, all-in-one mobile application (Android/iOS/Windows) pentesting framework — static and dynamic analysis with a web dashboard, built to run as a self-hosted service.

Modular iOS security testing framework (the closest thing iOS has to Drozer) — storage, binary analysis, network and runtime manipulation modules for a jailbroken test device.

python3 needle.py

Nordic Semiconductor's free Android/iOS app for scanning BLE advertisements and browsing/writing GATT services and characteristics by hand — the everyday tool for poking at a smart-device's Bluetooth surface.

Runtime mobile exploration toolkit built on Frida that works without a jailbreak/root — bypass SSL pinning, dump the keychain/keystore, patch an app, all interactively.

objection -g com.target.app explore

osascript is the built-in bridge from a shell into AppleScript — the fastest way to script a GUI interaction (or a user-facing prompt) without writing a .scpt file.

osascript -e 'display dialog "test"'

Frida-based web UI for poking at an iOS app's file system, keychain, class list and network traffic on a jailbroken device — a lighter, browser-based alternative to Needle for quick looks.

Android malware-scoring engine that matches API call sequences against a rule set to produce a "how malicious does this behave" score, rather than just a static signature match.

quark -a app.apk -s

Bridges radare2's static analysis and Frida's dynamic instrumentation into one session, so a mobile (or desktop) binary can be disassembled and hooked from the same prompt.

r2 frida://usb//com.example.app

Unofficial iOS backup extractor — pulls an unencrypted or password-known iTunes-style backup off a device and organises it for handoff to iLEAPP or manual review.