androguard - Android应用程序的逆向工程和渗透测试

项目说明

<p align="center"><img width="200" src="./.github/logo.png" alt="Androguard"></p>
<h2 align="center">Androguard</h2>

Androguard: Reverse engineering and pentesting for Android applications

<di="center">

!Powered By: Androguard

</div>

![PyPI Upload]()
!PyPI -
!Static Badge

Androguard 5 is a Python toolkit for Android reverse engineering: open an APK, inspect the manifest and DEX, disassemble or decompile 代码, hunt references and , and optionally patch or analyze native ARM — from the CLI, a high-level Application API, Claude 代码 skills, or an MCP 服务端 for LLM hosts.

Main features

Do you think your phone has been pwned? Please check IsMyPhonePwned.

Installation

Androguard 5 is this repository. It is not the package currently published on PyPI (androguard 4.1.4). From a checkout, install the local tree. A bare pip install androguard or pip install 'androguard[full]' downloads 4.1.4 and uninstalls 5.0.0.

After 5.0.0 is published, the same extras install from PyPI:

> [!IMPORTANT]
> >= 4.0.0 are new releases after a long time, where the project has substantial differences from the previous stable 3.3.5 from 2019. This means that certain functionalities have been removed. If you notice an issue with your project using the latest , please open up an issue.

Ecosystem

Androguard v5 is built on dedicated libraries:

| Layer | Library | Role |
|-------|---------|------|
| APK archive | apk-parser (apkparser-ag) | ZIP structure, signatures, manifest hooks |
| DEX structure | dex-parser (dexparser-ag) | Rust core + Python bindings: classes, methods, fields, bytecode |
| Binary XML / ARSC | axml / axml-parser (Rust) | AndroidManifest.xml, resources.arsc |
| Bytecode (optional) | dex-bytecode | Dal / CFG / patch via androguard[disasm] |
| Decompiler (optional) | dex-decompiler | DEX → Java, ASC getclass/findrefs, vulns via androguard[decompile] |
| ARM64 (optional) | arm_disassembler / arm_decompiler | Native code via androguard[arm] |
| APK patch (optional) | apk-patch | In-memory decode/build via androguard[patch] |

Examples

Runnable demos live in examples/ and are also executed by the
test suite (tests/test_examples.py):

See examples/README.md.

Claude Code

This repo ships Claude 代码 project support (similar in spirit to areclaw, but driven by Androguard itself):

| Path | Role |
|------|------|
| CLAUDE.md | Project instructions for the agent |
| .claude/agents/androguard-analyst.md | Analyst agent |
| .claude/skills/ | /analyze-apk, /decompile-apk, /find-refs, /scan-vulns |
| workspace/ | Samples, decompiled output, reports |

MCP server

Androguard can run as an MCP 服务端 so LLM hosts (Claude 代码, Cursor, …) call typed analysis tools instead of shelling out to the CLI.

Example client config:

Typical flow: open_apk → session_id → list_classes / find_refs / decompile_method / scan_vulns.

On launch the ser a stderr banner (, tools, path roots, extras). Use --log-tools to log each tool call, and --log-le for more detail.

Full 工具 list, env vars, and security notes: docs/mcp-server.md. Design background: docs/mcp-ser.md.

Quick start

Command line

CLI smoke test (bundled sample)

After pip install -e '.[full]', exercise the main CLI features against the repo
sample APK (tests/data/APK/TestActivity.apk):

Or run the Python demos (same co, including optional ARM):

MASTG demo co

Androguard’s scanner is against all OWASP MASTG Android demos.
The checked-in results live in:

docs/mastg-co.md

It lists every MASTG-DEMO-* with status (pass / gap / skip), Frida static assessment when relevant, and the scan_vulns categories found.

High-level API (Application)

APK layer (apkparser-ag)

Or through Androguard re-exports:

DEX layer (dex-parser)

From an APK’s DEX blobs:

Iterate structure:

Header as a dict:

Androguard shortcuts:

Dal (dex-bytecode, optional)

Through Application:

Ja (dex-decompiler, optional)

Through Application:

ARM64 (arm_disassembler / arm_decompiler, optional)

APK patch (apk-patch, optional)

Legacy entry point

Scripts that used AnalyzeAPK in older Androguard can keep the same call pattern; the third return value is now a full Application instead of a cross-reference Analysis object (not yet restored in v5):

Documentation

Documentation contains outdated information — in progress of updating

The Github Pages Documentation is the most up to date 源码.

Additional documentation that contains outdated information is a at ReadTheDocs.

Authors: Androguard Team

Androguard + tools: Anthony Desnos (anthony at 42.bzh).

Projects using Androguard

In alphabetical order:

* AndroPyTool
* AppKnox
* Cuckoo Sandbox
* Deckard
* Droidbot
* Droidstatx
* εxodus
* F-Droid Server
* gplaycli
* Koodous
* MobSF
* qiew
* Quark-Engine
*
* Viper Framework
* ... and many more!

You are using Androguard and are not listed here? Just create a ticket or send us a pull request with your project!

Licenses

Androguard

Copyright (C) 2012 - 2026, Anthony Desnos (anthony at 42.bzh)
All rights reserved.

Licensed under the Apache License, 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS-IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language go permissions and
limitations under the License.

项目信息

开发语言：Python

Star 数：6320

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Reverse engineering and pentesting for Android applications 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。