0xbinder

libpatchfinder. A arm offsetfinder. It finds offsets, patches, parses Mach-O and even supports IMG4/IMG3

fdroidclient. Android client application.

usbliter8-fun. Python

ghidra_kernelcache. a Ghidra framework for iOS kernelcache reverse engineering

kill_flutter. Flutter SSL Pinning Bypass Tool for Android & iOS — works on any Flutter version without pattern databases

hyperion-disassembler. Native multi-arch disassembler & decompiler - PE/ELF/Mach-O, x86/x64/ARM64, Lua scripting, RTTI recovery

bindiff. Quickly find differences and similarities in disassembled code

Samsung_Vulnerabilities. 176 vulnerabilities in Samsung preinstalled Android apps

payload-dumper-go. an android OTA payload dumper written in Go

Ghidra-SandBlaster-Plugin. The SandBlaster Plugin is a sophisticated extension for Ghidra that seamlessly integrates the functionalities of the SandBlaster tool into the Ghidra environment.

CyberMeowfia. PoCs and exploits for CVEs discovered by VEGA.

Simple-Dialer. A handy phone call manager with phonebook, number blocking and multi-SIM support that uses truecaller to display the name of the caller.

Android-Exploitation-Lab. Learn Android offensive security through practical labs covering JNI, native exploitation, IPC attacks, Binder internals, memory corruption, and real-world vulnerabilities.

Choicy. Advanced tweak configurator for iOS 10 and up

ghidra-mcp. Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.

radare2. UNIX-like reverse engineering framework and command-line toolset

unflutter. Static analyzer for Flutter/Dart AOT snapshots

ideogram4. Ideogram 4: Open image model at the forefront of design

deeplink-impersonation-poc. PoC of Android deep link abuse for app impersonation

CVE-2026-0073. An automated exploit for CVE-2026-0073 (Android ADB TLS Auth Bypass). Features a built-in mDNS/Zeroconf scanner to instantly discover randomized Wireless Debugging ports on Android 13+ and establishes a fully interactive raw PTY shell.

kfund. kfund, short for my fun with kfd exploit.

ldid. Link Identity Editor. Put real or fake signatures in a Mach-O.

QueueCore. Professional QueueCore queuecore-engine with QueueCore-optimized scalable-architecture and enterprise intelligent-automation capabilities

HashSync. Future-proof data synchronization at scale through next-generation hashsync-optimization and intelligent-automation via the hashsync-engine.

undetected-frida. Making frida less detectable by applying some patches. This follows the official Frida releases and publishes releases the same day. Do not fork this!

noxen. Android interception tool for component communication and attack-surface mapping

ZygiskFrida. Injects frida gadget using zygisk to bypass anti-tamper checks.

LSPosed. LSPosed Framework

LSPosed.github.io. HTML

FreeDroidWarn. Java

sandblaster. Reversing the Apple sandbox

apk-info. APK full-featured parser

copy-fail-CVE-2026-31431. Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code

Android-CTF-challenges.

Magisk. The Magic Mask for Android

KRA_App_Backend. A Spring Boot backend service that integrates with the KRA API to automate NIL return filing for individual taxpayers. It handles secure authentication, access token management, and API communication using RESTful principles.

skills. Python

ios-deploy. Install and debug iPhone apps from the command line, without using Xcode

frida-flutterproxy. Burp proxy flutter apps

pentestagent. PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.

plist_recon. This tool parses the binary or XML `Info.plist` file found in Apple applications (IPA/APP) to extract critical security configurations, identify potential vulnerabilities, and generate instant hooking snippets for Frida and Objection.

linuxpdf. Linux running inside a PDF file via a RISC-V emulator

JwtAuditor. JWT Auditor – Analyze, break, and understand your tokens like a pro.

sqlite3. SQLite 3 Magisk Module for Android arm64-v8a, armeabi-v7a, x86 and x86_64. The releases can be found at the following link:

frida-android-helper2. Frida Android utilities 2

areclaw. Android Reverse Engineering Command-Line Automation Workspace. AI-driven security analysis with Claude Code.

BugBazaar. Android BugBazaar: Your mobile appsec playground to Explore, Exploit, Excel

Brida. The new bridge between Burp Suite and Frida!

YouTube-X. A lightweight YouTube improvement tweak.

uYouPlus. uYou+ is a modified version of uYou (made by @MiRO92) with additional features and mainly made for non jailbroken users!

exploit_me. Very vulnerable ARM/AARCH64 application (CTF style exploitation tutorial with 29 vulnerability techniques)

Exploit-Challenges. A collection of vulnerable ARM binaries for practicing exploit development

dsdump. An improved nm + Objective-C & Swift class-dump

frida-ios-dump. pull decrypted ipa from jailbreak device

theos. A cross-platform suite of tools for building and deploying software for iOS and other platforms.

libimobiledevice. A cross-platform protocol library to communicate with iOS devices

deep-C. Android deeplink misconfiguration detector and exploitation tool

penumbra. 🌘 MTK flash tool written in rust

frida-android-hook. A tool that helps you work with frida easily for Android platform

NewPipe. A libre lightweight streaming front-end for Android.

android-poc-app. Empty project to quick start Proof of Concept app development

grapefruit. Open-source mobile security testing suite for iOS and Android. Previously Passionfruit

symbolicator. `ipsw` symbolication signatures

frida-interception-and-unpinning. Frida scripts to rewrite mobile applications at runtime to directly MitM all HTTPS traffic

proxypin. Open source free capture HTTP(S) traffic software ProxyPin, supporting full platform systems

proxydroid. Global Proxy for Android

disable-flutter-tls-verification. A Frida script that disables Flutter's TLS verification

reFlutter. Flutter Reverse Engineering Framework

gxpc. Sniff XPC communication using Frida and Go

Presentations.

XPF. XNU Patch Finder (based on ChOma)

iOS-System-Symbols. Share iOS system framework's symbol files. Useful for symbolicating iOS crash report.

TrollStore. Jailed iOS app that can install IPAs permanently with arbitary entitlements and root helpers because it trolls Apple

Dopamine. Dopamine is a semi-untethered jailbreak for iOS 15 and 16

sandblaster. Reversing the Apple sandbox

kfd. kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices.

jtool2. jtool2 support Mac arm64 and x86_64

WhatsApp-Chat-Exporter. A customizable, cross-platform tool for parsing WhatsApp chat databases from Android and iOS/iPadOS backups. Supports Android .crypt12, .crypt14, .crypt15, and the latest database formats. Outputs chat history in readable HTML or structured JSON.

OSX-KVM. Run macOS on QEMU/KVM. With OpenCore + Monterey + Ventura + Sonoma support now! Only commercial (paid) support is available now to avoid spammy issues. No Mac system is required.

img4lib. image4 vfs

Inferno. Apple Silicon device emulator.

qemu-ios. A QEMU emulator for legacy Apple devices

quickemu. Quickly create and run optimised Windows, macOS and Linux virtual machines

ios-resources. Useful resources for iOS hacking

security-research. This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

AERoot. AERoot is a command line tool that allows you to give root privileges on-the-fly to any process running on the Android emulator with Google Play flavors AVDs.

android-fuzzing. C

chronomaly. Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable x86_64 Linux kernels v5.10.x.

imgtool. Utilitiy for working with Android firmware .img files

oppo_decrypt. Oppo .ofp Firmware decrypter and oneplus .ops de-/encrypter

extract_android_ota_payload. Extract firmware images from an Android OTA payload.bin file

jnitrace. A Frida based tool that traces usage of the JNI API in Android apps.

llef. LLEF is a plugin for LLDB to make it more useful for RE and VR

simplify. Android virtual machine and deobfuscator

FridaLoader. A quick and dirty app to download and launch Frida on Genymotion and rooted Physical Android Devices

android-ota-payload-extractor. A fast & natively cross-platform Android OTA payload extractor written in Go

Apk-Editor.

uber-apk-signer. A cli tool that helps signing and zip aligning single or multiple Android application packages (APKs) with either debug or provided release certificates. It supports v1, v2 and v3 Android signing scheme has an embedded debug keystore and auto verifies after signing.

whatsmap. Maps WhatsApp via API

ipsw. iOS/macOS Research Swiss Army Knife

ghidra. Ghidra is a software reverse engineering (SRE) framework

qiling. A True Instrumentable Binary Emulation Framework

vmlinux-to-elf. A tool to recover a fully analyzable .ELF from a raw kernel, through extracting the kernel symbol table (kallsyms)

sysreptor. A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.

flowsint. A modern platform for visual, flexible, and extensible graph-based investigations. For cybersecurity analysts and investigators.

ROPgadget. This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.

linux-kernel-exploitation. A collection of links related to Linux kernel security and exploitation

kernelpwn. kernel-pwn and writeup collection

gef. GEF - GDB Enhanced Features - bata24's fork

beerus-android. BEERUS Framework for Android

dots-hyprland. Usability-first dotfiles

Bottles. Run Windows software and games on Linux

wine-ge-custom. My custom build of wine, made to use with lutris. Built with lutris's buildbot.

proton-ge-custom. Compatibility tool for Steam Play based on Wine and additional components

MangoHud. A Vulkan and OpenGL overlay for monitoring FPS, temperatures, CPU/GPU load and more.

etchdroid. An application to write OS images to USB drives, on Android, no root required.

shell. A fluid, morphing shell for your Linux desktop

bindump4j. A portable utility to locate android binder service

badspin. Bad Spin: Android Binder Privilege Escalation Exploit (CVE-2022-20421)

Blunder-Kernel-Driver. An exploit for a Linux Kernel IPC Driver whose VM_MAYWRITE flag is not checked during its mmap implementation triggering an AAW and a Heap Overflow for LPE - https://mutur4.github.io/2024/02/21/linux-kernel-heap-overflow.html

Unisoc-Exploitation. This repo contains all Unisoc BootROM exploitation details.

baremetal_kasan. C

art-kernel-toolkit. C

droidground-samples. Sample applications to showcase DroidGround

droidground. A flexible playground for Android CTF challenges.

BrutDroid. BrutDroid - Android Studio Pentest Automator: Streamline mobile pentesting with automated emulator rooting, Frida, and Burp Suite integration.

CVE-2023-2008. Proof of concept code for CVE-2023-2008

CVE-2020-0041. Exploits for Android Binder bug CVE-2020-0041

setools-android. Unofficial port of setools to Android with additional sepolicy-inject utility included

KnoxPatch. LSPosed module to get Samsung apps/features working again in your rooted Galaxy device.

hashpumpy_changed. C++

HacknDroid. Automation of some MAPT activities and interaction with the mobile Android device.

PAPIMonitor. Python API Monitor for Android apps

apktool-mcp-server. A MCP Server for APK Tool (Part of Android Reverse Engineering MCP Suites)

bundletool. Bundletool is a command-line tool to manipulate Android App Bundles

onnxruntime_flutter. A flutter plugin for OnnxRuntime provides an easy, flexible, and fast Dart API to integrate Onnx models in flutter apps across mobile and desktop platforms.

medusa. Mobile Edge-Dynamic Unified Security Analysis

BinderFuzzy. An app intended for fuzzing the Android Binder interface and System Services

FuzzyAI. A powerful tool for automated LLM fuzzing. It is designed to help developers and security researchers identify and mitigate potential jailbreaks in their LLM APIs.

GhidraMCP. MCP Server for Ghidra

android-kernel-exploitation-lab. This lab guides you through setting up an environment to explore CVE-2019-2215, a critical Android kernel vulnerability in the binder subsystem.

FirmWire. FirmWire is a full-system baseband firmware emulation platform for fuzzing, debugging, and root-cause analysis of smartphone baseband firmwares

ShannonFirmware. Samples of Shannon baseband firmware for research purposes.

AFLplusplus. The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!

AFL. american fuzzy lop - a security-oriented fuzzer

syzkaller. syzkaller is an unsupervised coverage-guided kernel fuzzer

miasm. Reverse engineering framework in Python

android-kernel-exploitation. Android Kernel Exploitation

SSL-bypass. SSL bypass check

HyDE. HyDE, your Development Environment 🖥️💻

una. Una (Una's Not APT) - A complete MPR helper

bad_io_uring. Android kernel exploitation for CVE-2022-20409

CVE-2022-20474. PoC of CVE-2022-20474

Malimite. iOS and macOS Decompiler

github-trends. 🚀 Level up your GitHub profile readme with customizable cards including LOC statistics!

Docker-OSX. Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers.

github-activity-generator. A script that helps generate a rich GitHub Contribution Graph for your account 🤖

android_prebuilts_gcc_linux-x86_arm_sabermod-arm-linux-androideabi-4.9. SaberMod GCC 4.9 toolchain

gdbserver. Extracted from Android NDK

Genymotion_A11_libhoudini. Genymotion ARM, ARMv7, ARMv8/ARM64 Translation for Android 11

PentestGPT. Automated Penetration Testing Agentic Framework Powered by Large Language Models

Genymotion_ARM_Translation. 👾👾 Genymotion_ARM_Translation Please enjoy！

AhMyth-Android-RAT. Android Remote Administration Tool

dnSpy. .NET debugger and assembly editor

Il2CppDumper. Unity il2cpp reverse engineer

from-an-Android-Hook-to-RCE-5000-bounty. Java

angr_lab. This repo will contain the challenges and solutions for angr framework

ios_in_app_protections. Repository containing sample apps and Frida scripts for bypassing in-app-protections in iOS

flutter_reversing. This repo will contain the material for reversing flutter applications.

android_in_app_protections. Contains all the scripts and sample apps related to android in app protections.

GOAD. game of active directory

pywerview. A (partial) Python rewriting of PowerSploit's PowerView

MobSecco. Cloning apk for bypassing code tampering detection, Google Safety Net and scanning vulnerable plugins

libdevbinder. C

binder-trace. Binder Trace is a tool for intercepting and parsing Android Binder messages. Think of it as "Wireshark for Binder".

slime_tree. Worst Android kernel fuzzer

shannonRE. Helpful scripts for various tasks performed during reverse engineering the Shannon Baseband with the goal to exploit the Samsung Galaxy S6

rawdrawandroid. Build android apps without any java, entirely in C and Make

AutoDrozer. Auto Drozer a tool designed to automate the usage of Drozer with a custom commands.yml file

drozer-agent. The Android Agent for the Drozer Security Assessment Framework.

Damn-Vulnerable-Bank. Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. This provides an interface to assess your android application security hacking skills.

Frida-script-bypass-Framgia-Emulator. Frida script bypass detect emulator using framgia library on Android application

objection. 📱 objection - runtime mobile exploration

RMS-Runtime-Mobile-Security. Runtime Mobile Security (RMS) 📱🔥 - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime

Frida-Script-Runner. Web-based Frida framework and toolkit for Android & iOS penetration testing, mobile security, and dynamic analysis, featuring AI-assisted Frida script generation.

cyber-apocalypse-2024. Official writeups for Cyber Apocalypse CTF 2024: Hacker Royale

Name-That-Hash. 🔗 Don't know what type of hash it is? Name That Hash will name that hash type! 🤖 Identify MD5, SHA256 and 300+ other hashes ☄ Comes with a neat web app 🔥

Search-That-Hash. 🔎Searches Hash APIs to crack your hash quickly🔎 If hash is not found, automatically pipes into HashCat⚡

redroid-doc. redroid (Remote-Android) is a multi-arch, GPU enabled, Android in Cloud solution. Track issues / docs here

Azure_ARM64_Android_Emulator_Notes. Notes for my video on running an ARM64 Android emulator in Azure

ovaa. Oversecured Vulnerable Android App

pyxamstore. Python utility for parsing Xamarin AssemblyStore blob files

gmapsapiscanner. Python

docker-android. Android in docker solution with noVNC supported and video recording

cve-2024-20017. exploits for CVE-2024-20017

mkchromecast. Cast macOS and Linux Audio/Video to your Google Cast and Sonos Devices

linux-wifi-hotspot. Feature-rich wifi hotspot creator for Linux which provides both GUI and command-line interface. It is also able to create a hotspot using the same wifi card which is connected to an AP already ( Similar to Windows 10).

scudo-exploitation. Python

CrackMapExec. A swiss army knife for pentesting networks

gobuster. Directory/File, DNS and VHost busting tool written in Go