{ "added_at": "2026-11-02", "additional_evidence_urls": [ "https://github.com/reversenseorg/dexcalibur/blob/2408f791ba869e7dba8f901332e44a5fee96a973/package.json", "https://github.com/reversenseorg/dexcalibur/blob/2408f791ba869e7dba8f901332e44a5fee96a973/.nvmrc", "https://github.com/reversenseorg/dexcalibur/blob/2408f791ba869e7dba8f901332e44a5fee96a973/TESTED.md", "https://github.com/reversenseorg/dexcalibur/blob/2408f791ba869e7dba8f901332e44a5fee96a973/LICENSE", "https://github.com/reversenseorg/dexcalibur/blob/2408f791ba869e7dba8f901332e44a5fee96a973/3TH_LICENSES.md", "https://github.com/reversenseorg/dexcalibur/blob/2408f791ba869e7dba8f901332e44a5fee96a973/scripts/prepare_thirdparty.sh", "https://github.com/reversenseorg/dexcalibur/blob/2408f791ba869e7dba8f901332e44a5fee96a973/docker/Docker-compose.yml", "https://github.com/reversenseorg/dexcalibur/blob/2408f791ba869e7dba8f901332e44a5fee96a973/.github/workflows/CI.yml", "https://github.com/reversenseorg/dexcalibur/tree/2408f791ba869e7dba8f901332e44a5fee96a973/inspectors", "https://github.com/reversenseorg/dexcalibur/tree/2408f791ba869e7dba8f901332e44a5fee96a973/test/ws", "https://github.com/reversenseorg/dexcalibur/commit/2408f791ba869e7dba8f901332e44a5fee96a973", "https://github.com/reversenseorg/dexcalibur/releases/tag/v0.7.10", "https://github.com/reversenseorg/rs-doc/blob/e33b0d15e84ed49aa43d9733b94a9df1b884e42e/docs/getting-started/installation.md" ], "category": "android", "description_en": "Android reverse-engineering platform that combines static analysis with Frida-based dynamic instrumentation; the master branch is Reversense (Dexcalibur 2.0), a rewrite that runs as a Node.js web server for collaborative projects. Its README describes modeling an app's files, Smali and native code into one searchable representation with Radare2 integration, generating hooks for Java methods, Objective-C and native functions, and building dynamic cross-references from traces collected on attached devices. Inspector plugins in the repository observe areas such as permissions, cryptography, file-system, network and UI activity.", "description_zh": "结合静态分析与基于 Frida 的动态插桩的 Android 逆向分析平台；master 分支是重写后的 Reversense（Dexcalibur 2.0），以 Node.js Web 服务形式运行，支持多人协作项目。README 介绍了如何把应用的文件、Smali 和原生代码建模为统一的可搜索表示（集成 Radare2），为 Java 方法、Objective-C 和原生函数生成钩子，并依据在已连接设备上采集的跟踪构建动态交叉引用。仓库中的 Inspector 插件分别观察权限、加密、文件系统、网络和界面等方面的活动。", "entry_url": "https://awesomerea.org/resources/dexcalibur/", "entry_url_zh": "https://awesomerea.org/zh/resources/dexcalibur/", "evidence_url": "https://github.com/reversenseorg/dexcalibur/blob/2408f791ba869e7dba8f901332e44a5fee96a973/README.md", "group": "tools", "id": "dexcalibur", "json_url": "https://awesomerea.org/resources/dexcalibur/record.json", "kind": "tool", "markdown_url": "https://awesomerea.org/resources/dexcalibur/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/dexcalibur/index.md", "name": "Dexcalibur (Reversense)", "name_zh": "Dexcalibur（Reversense）Android 逆向分析平台", "record_type": "resource", "relationship": "foundation", "requirements": [ "The latest GitHub release and npm package are still the original Dexcalibur v0.7.10 (2021-09-27, Apache-2.0 in its package metadata); the reviewed master commit (2026-10-02) declares the unreleased 2.0.0 rewrite. Its README getting-started, prerequisite and installation sections, and the installation page of the linked documentation site, are unfinished placeholders, and TESTED.md lists only a short set of basic engine, web-server, platform, device, project and ADB-bridge checks.", "package.json targets Node.js on macOS, Linux and Windows (.nvmrc pins 22.14.0), and the reviewed commit adds Deno as a second runner; the documentation site says Windows is not officially supported. The README asks for a .dexcalibur settings folder in the user's home directory and names Frida 16.1.4, while package.json depends on frida ^17.6.2. MongoDB backs the project database (the Docker Compose file uses MongoDB 6.0.9), OpenID Connect with KeyCloak provides SSO, and the web UIs and device agent are built from separate reversenseorg repositories.", "Analysis starts from the user's own app package and, for dynamic work, an Android device or emulator reachable over ADB with Frida. The third-party setup script downloads Android platform-tools, apktool 2.7.0, baksmali 2.5.2 and binwalk from their upstream hosts. The repository's test workspace bundles apktool.jar, OWASP's UnCrackable Level 1 training APK with its apktool-decoded files, and small ELF, Mach-O, plist and nib parser fixtures.", "The 2.0 source is AGPL-3.0-only; the third-party notice covers EFF's apkeep (MIT). README features such as automated SAST/DAST scanning, device-farm management and the built-in MCP server are project-reported, and Reversense offers professional support and modules separately. Intended for apps the analyst is authorized to inspect." ], "requirements_zh": [ "GitHub 最新发布版和 npm 包仍是初代 Dexcalibur v0.7.10（2021-09-27，其包元数据标注 Apache-2.0）；所审阅的 master 提交（2026-10-02）声明为尚未发布的 2.0.0 重写版。README 中的入门、前置条件和安装章节，以及所链接文档站的安装页面，都还是未完成的占位内容；TESTED.md 只列出少量引擎、Web 服务、平台、设备、项目和 ADB 桥接方面的基本检查项。", "package.json 面向 macOS、Linux 和 Windows 上的 Node.js（.nvmrc 固定为 22.14.0），所审阅的提交还把 Deno 加为第二种运行时；文档站称 Windows 不受官方支持。README 要求先在用户主目录下创建 .dexcalibur 设置目录，并写明 Frida 16.1.4，而 package.json 依赖 frida ^17.6.2。项目数据库使用 MongoDB（Docker Compose 文件采用 MongoDB 6.0.9），SSO 通过 OpenID Connect 与 KeyCloak 实现，Web 界面和设备端代理则由 reversenseorg 下的其他仓库构建。", "分析从使用者自备的应用包开始；动态分析还需要一台可通过 ADB 连接并运行 Frida 的 Android 设备或模拟器。第三方组件准备脚本会从各自的上游地址下载 Android platform-tools、apktool 2.7.0、baksmali 2.5.2 和 binwalk。仓库的测试工作区附带 apktool.jar、OWASP 的 UnCrackable Level 1 训练 APK 及其经 apktool 解码的文件，以及用于解析器测试的小型 ELF、Mach-O、plist 和 nib 样本。", "2.0 源码采用 AGPL-3.0-only 许可；第三方声明涉及 EFF 的 apkeep（MIT）。自动化 SAST/DAST 扫描、设备农场管理和内置 MCP 服务器等 README 功能均为项目自述，Reversense 另行提供专业支持和付费模块。仅用于分析者有权检查的应用。" ], "targets": [ "app" ], "url": "https://github.com/reversenseorg/dexcalibur", "verification": "source-reviewed", "verified_at": "2026-10-20" }