美杜莎 - 移动边缘-动态统一安全分析

项目说明

<img src=" width ="1635" height="608">

Sponsored by:

<br>
<a href=" target="_blank" rel="noopener noreferrer">
<picture>
<源码 media="(prefers-color-scheme: dark)" srcset="
<img src=" width="256" alt="Sponsor logo">
</picture>
</a>
<br>
<br>

MEDUSA

A modular automation 框架 and script repository for runtime testing and in Android and iOS apps, designed for penetration testers and malware analysts. It lets you plug in modules to bypass protections (like SSL pinning), inspect 网络/WebView activity, trace API calls, examine memory/crypto, and monitor malware behavior — all from a single coordinated script. It runs on FRIDA under the hood and ships with 90+ reusable modules so tests scale and repeat easily.

Installation

System requirements:

Linux or macOS (limited functionality a on Windows)

Python 3

Rooted device or emulator

adb

FRIDA 服务端 (running on the mobile device)

Installing from github:

1. Clone this repository.
2. CD into the medusa directory.
3. Install dependencies:

Or download the latest stable from here

Using Docker:

A preconfigured Dockerfile is a in the medusa/ directory.

1. Build the image: docker build -t medusa:latest ./

2. Run the container: docker run --name medusa --net=host --rm -it medusa:latest

3. Enable ADB over TCP/IP on your physical device or emulator: adb tcpip 5555

4. Connect to the device from inside the container: root# adb connect <de>:5555

Known installation issues

macOS

During installation on macOS, you might encounter the following issue:

>Readline features including tab completion have been disabled because
no supported of readline was found. To resolve this, install
pyreadline3 on Windows or gnureadline on Linux/Mac.

To resol the gnureadline package for Python:

For Python 3.12, use the following command to install gnureadline from a specific commit:

Backward compatibility with previous MEDUSA

If you're upgrading from an older of Medusa and encounter 数据库 compatibility issues with Mango, please refer to 数据库_MIGRATIONS.md for migration instructions.

Important: If you have an existing Mango 数据库 and recei after updating, check the migration guide to update your 数据库 schema.

Usage

MEDUSA

Run the appropriate entry script for each platform:

After start, MEDUSA will enumerate a devices and let you pick one.

Common interacti

MANGO

Medusa’s lightweight companion CLI for static prep and automation — manifest parsing, attack-surface enumeration, app tracking, and simple device/proxy automation.

Run python3 mango.py <database-name> to create or load a 数据库 for storing Mango’s results.

MCP Ser

This is optional and not required for the standard Medusa CLI workflow.

If you want to use the Android MCP 服务端 (medusa_android_mcp.py), install the MCP requirements:

#### Configuration:

For ad usage and examples, see our wiki. For quick tips and introductory workflows, check the demos below:

MEDUSA | Android Penetration tool (credits )

MEDUSA | Android Malware Analysis 101 (credits )

Unpacking Android malware with Medusa (credits )

Unpacking Android APKs with Medusa (credits )

#Medusa - Extensible binary instrumentation 框架 based on #FRIDA for Android applications (credits )

Memory inspection with Medusa

Bypassing root detection

How to Contribute:

You can contribute to this project by:

Becoming a sponsor

Creating a medusa module (see how to)

Making a pull request

Reporting an error/issue

Suggesting an impro

Making this project more popular by sharing it or giving a star

Using Stheno with Medusa

Stheno is a subproject of Medusa, specifically designed for intent monitoring within this 框架. Below is a quick guide on how to set up and use Stheno effectively.

<p align="center">
<img src=" alt="monitor" width="400"/>
</p>

1. Include the Intent Module:
Add the intents/start_activity module to your Medusa project:

2. Run the Socket Server:
Start the Medusa socket 服务端 to facilitate communication:

3. Launch Stheno:
Open Stheno and na to the Intent Monitor menu, then click on Start to begin monitoring intents.

---

Screenshots

SSL Unpinning

!ssl unpinning

Intent Monitoring

!Intent monitoring

Webview Monitoring

!Webview monitoring

File/Content provider monitoring

!File and content pro

Nati Enumeration

!Screenshot 2020-09-22 at 16 41 10

Memory READ/WRITE/SEARCH (interactive mode):

!Screenshot 2020-09-22 at 16 41 10

Personal information exfiltration monitoring

> Hooks api calls which found to be common for this kind of malware, including:
> - Contact exfiltration
> - Call log exfiltration
> - Camera usage
> - Microphone usage
> - Location tracking
> - File uploading
> - Media recording
> - Clipboard tracking
> - Device recon
> - Screenshot capture

<img src=" width="450" height="460">

Translation

> Translates the application's UI by hooking 'setText' calls

<img src=" width="250" height="450"> <img src=" width="250" height="450">

<img src=" width="550" height="250">

---

CREDITS:

Special Credits to for his contributions

Logo Credits:

项目信息

开发语言：Ja

Star 数：2349

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Mobile Edge-Dynamic Unified Security Analysis展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。