Tool
Katalina
Python emulator for Dalvik bytecode that its README likens to Unicorn: it parses a DEX file and executes methods one instruction at a time, substituting Python mocks for common Java and Android APIs such as String, StringBuilder, Base64, ArrayList, AES Cipher and part of reflection. Run over Android entry points, methods matching a name or one method with given arguments, it logs the strings that the code builds or decrypts, optionally as JSON, which helps recover obfuscated strings in apps and malware.
- Targets
- App
- Category
- Android tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- There are no releases or tags. Development ran from May to December 2023; the reviewed main commit f8e27b9 of 2026-10-01 merges a contributed fix that makes the String.valueOf mock follow the called overload's descriptor.
- Requires Python 3.10+ with the pinned requirements.txt packages, including kaitaistruct 0.10 and pycryptodome 3.18.0. main.py takes -xe for Android entry points, -xm for methods matching a name, -x for one fully qualified method with arguments, -dl to skip methods whose names contain listed words and -j for JSON output. Entry-point and name-match runs give each method a SIGALRM time limit, so README says Windows support may be broken and recommends WSL.
- Input is one classes.dex from an APK the analyst already has. README lists most instructions, same-class and static calls and String and Base64 APIs as working, iterator and array APIs and cross-class instance calls as partial, and MultiDex and I/O as broken. Framework behaviour without a mock is not reproduced, and the AES mock only tries ECB and then CBC with a zero IV, so recovered strings must be checked against the code. The repository has no tests or CI.
- MIT. The first commit included DEX samples, many named after Android malware families, that were removed a month later; the reviewed tree holds only the Python sources.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · huuck/Katalina · Revision f8e27b9
- main.py GitHub · huuck/Katalina · Revision f8e27b9
- mocks.py GitHub · huuck/Katalina · Revision f8e27b9
- requirements.txt GitHub · huuck/Katalina · Revision f8e27b9
- LICENSE GitHub · huuck/Katalina · Revision f8e27b9
- https://github.com/huuck/Katalina/pull/6
More in Apps
- Doldrums · Tool
- Frida UI · Tool
- darter · Tool
- Appshark · Tool
- Wallbreaker · Tool
- axmlprinter · Tool