# Katalina > Python emulator for Dalvik bytecode that its README likens to Unicorn: it parses a DEX file and executes methods one instruction at a time, substituting Python mocks for common Java and Android APIs such as String, StringBuilder, Base64, ArrayList, AES Cipher and part of reflection. Run over Android entry points, methods matching a name or one method with given arguments, it logs the strings that the code builds or decrypts, optionally as JSON, which helps recover obfuscated strings in apps and malware. - Type: Tool - Targets: App - Category: Android tools - Relationship: Foundation tool - Sources reviewed: 2026-10-27 - Added to the catalog: 2026-11-03 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/katalina/index.md) ## Requirements & limits - There are no releases or tags. Development ran from May to December 2023; the reviewed main commit f8e27b9 of 2026-10-01 merges a contributed fix that makes the String.valueOf mock follow the called overload's descriptor. - Requires Python 3.10+ with the pinned requirements.txt packages, including kaitaistruct 0.10 and pycryptodome 3.18.0. main.py takes -xe for Android entry points, -xm for methods matching a name, -x for one fully qualified method with arguments, -dl to skip methods whose names contain listed words and -j for JSON output. Entry-point and name-match runs give each method a SIGALRM time limit, so README says Windows support may be broken and recommends WSL. - Input is one classes.dex from an APK the analyst already has. README lists most instructions, same-class and static calls and String and Base64 APIs as working, iterator and array APIs and cross-class instance calls as partial, and MultiDex and I/O as broken. Framework behaviour without a mock is not reproduced, and the AES mock only tries ECB and then CBC with a zero IV, so recovered strings must be checked against the code. The repository has no tests or CI. - MIT. The first commit included DEX samples, many named after Android malware families, that were removed a month later; the reviewed tree holds only the Python sources. ## Primary sources 1. 2. 3. 4. 5. 6. ## More in Apps - [Doldrums](https://awesomerea.org/resources/doldrums/index.md) · Tool - [Frida UI](https://awesomerea.org/resources/frida-ui/index.md) · Tool - [darter](https://awesomerea.org/resources/darter/index.md) · Tool - [Appshark](https://awesomerea.org/resources/appshark/index.md) · Tool - [Wallbreaker](https://awesomerea.org/resources/wallbreaker/index.md) · Tool - [axmlprinter](https://awesomerea.org/resources/axmlprinter/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.