{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/huuck/Katalina/blob/f8e27b9f9d2316579a22fd1e330c7b385e6de995/main.py",
    "https://github.com/huuck/Katalina/blob/f8e27b9f9d2316579a22fd1e330c7b385e6de995/mocks.py",
    "https://github.com/huuck/Katalina/blob/f8e27b9f9d2316579a22fd1e330c7b385e6de995/requirements.txt",
    "https://github.com/huuck/Katalina/blob/f8e27b9f9d2316579a22fd1e330c7b385e6de995/LICENSE",
    "https://github.com/huuck/Katalina/pull/6"
  ],
  "category": "android",
  "description_en": "Python emulator for Dalvik bytecode that its README likens to Unicorn: it parses a DEX file and executes methods one instruction at a time, substituting Python mocks for common Java and Android APIs such as String, StringBuilder, Base64, ArrayList, AES Cipher and part of reflection. Run over Android entry points, methods matching a name or one method with given arguments, it logs the strings that the code builds or decrypts, optionally as JSON, which helps recover obfuscated strings in apps and malware.",
  "description_zh": "用 Python 编写的 Dalvik 字节码模拟器，README 将其比作面向 Dalvik 的 Unicorn：它解析 DEX 文件并逐条指令执行方法，用 Python 模拟实现替代 String、StringBuilder、Base64、ArrayList、AES Cipher 及部分反射等常见 Java 与 Android API。它可针对 Android 入口点、名称匹配的方法或带指定参数的单个方法运行，记录代码构造或解密出的字符串，并可输出为 JSON，有助于还原应用和恶意软件中被混淆的字符串。",
  "entry_url": "https://awesomerea.org/resources/katalina/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/katalina/",
  "evidence_url": "https://github.com/huuck/Katalina/blob/f8e27b9f9d2316579a22fd1e330c7b385e6de995/README.md",
  "group": "tools",
  "id": "katalina",
  "json_url": "https://awesomerea.org/resources/katalina/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/katalina/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/katalina/index.md",
  "name": "Katalina",
  "name_zh": "Katalina Dalvik 字节码模拟器",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "There are no releases or tags. Development ran from May to December 2023; the reviewed main commit f8e27b9 of 2026-10-01 merges a contributed fix that makes the String.valueOf mock follow the called overload's descriptor.",
    "Requires Python 3.10+ with the pinned requirements.txt packages, including kaitaistruct 0.10 and pycryptodome 3.18.0. main.py takes -xe for Android entry points, -xm for methods matching a name, -x for one fully qualified method with arguments, -dl to skip methods whose names contain listed words and -j for JSON output. Entry-point and name-match runs give each method a SIGALRM time limit, so README says Windows support may be broken and recommends WSL.",
    "Input is one classes.dex from an APK the analyst already has. README lists most instructions, same-class and static calls and String and Base64 APIs as working, iterator and array APIs and cross-class instance calls as partial, and MultiDex and I/O as broken. Framework behaviour without a mock is not reproduced, and the AES mock only tries ECB and then CBC with a zero IV, so recovered strings must be checked against the code. The repository has no tests or CI.",
    "MIT. The first commit included DEX samples, many named after Android malware families, that were removed a month later; the reviewed tree holds only the Python sources."
  ],
  "requirements_zh": [
    "没有发布版本或标签。开发集中在 2023 年 5 月至 12 月；所审阅的 main 分支提交 f8e27b9（2026-10-01）合并了一个外部贡献的修复，使 String.valueOf 的模拟实现按被调用重载的描述符分派。",
    "需要 Python 3.10+ 以及 requirements.txt 中固定版本的依赖，包括 kaitaistruct 0.10 和 pycryptodome 3.18.0。main.py 的 -xe 执行 Android 入口点，-xm 执行名称匹配的方法，-x 以参数执行一个完整限定名的方法，-dl 跳过名称含指定词的方法，-j 输出 JSON。执行入口点和名称匹配时，每个方法都受 SIGALRM 时间限制，因此 README 称 Windows 支持可能有问题，建议使用 WSL。",
    "输入是取自分析者已有 APK 的单个 classes.dex。README 称大多数指令、同类与静态方法调用以及 String 和 Base64 API 可用，迭代器、数组 API 和跨类实例调用部分可用，MultiDex 和 I/O 不可用。没有模拟实现的框架行为不会被复现，AES 模拟也只先后尝试 ECB 和零 IV 的 CBC 模式，因此还原出的字符串需要对照代码核实。仓库没有测试或持续集成。",
    "采用 MIT 许可。首次提交曾包含一批 DEX 样本，其中许多以 Android 恶意软件家族命名，一个月后被删除；所审阅的代码树只有 Python 源码。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://github.com/huuck/Katalina",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}