예술 pmjv prahou . 열린의 마지막 순간에 선물.

droidsaw는 DEX 파일이나 헤르메스 번들가를 가지고 있으며, F-Droid의 byte-for-byte - 5,767 DEX 파일이 보존 모드에서 약간 전적으로 회복되고, 헤르메스 바이트 코드 라운드 스트립은 v84, v96, v98 및 v99에 확인되었습니다. 즉, 형식 모델이 구멍이있을 때 테스트가 크게 실패합니다. 문자열 테이블 상쇄는 하나에 의해 잘못, 정렬 요구, 패딩 바이트 잊어 버린 - 재 방출 바이트 곱셈과 테스트는 어디에 말한다. 대부분의 Android RE 툴링은 레이어당 작동; droidsaw는 React Native Bridge를 통해 JS 값을 단일 taint 경로로 추적합니다. 핸즈 APK 및 그것은 컨테이너를 포장, 데코마일 모든 층, 그리고 같은 패스에 Semgrep 및 TruffleHog를 통해 출력을 파이프 할 수 (audit --mode=full). CLI 및 MCP 서버는 하나의 명령 표면을 공유합니다. 순수한 녹, BSD-3-Clause.

설치

cargo droidsaw-*] 라이브러리는 crates.io에서 crates.io로 컴파일하고 모든 로컬로 컴파일합니다. 더 보기 단지 필수품은 Rust 툴체인(rustup)과 C 컴파일러(cc]/clang)입니다. semgrep 및 trufflehog]는 선택 사항입니다 ([T7]], --mode=semgrep], 또는 --mode=trufflehog); YARA는 내장. 없음

droidsaw

Art by pmjv_prahou. A gift to the last mage of the Open clan.

droidsaw takes a DEX file or Hermes bundle apart and puts it back together byte-for-byte — 5,767 DEX files from F-Droid recovered bit-identically under preservation mode, Hermes bytecode round-trip verified on v84, v96, v98, and v99. That test fails loudly when the format model has a hole: a string-table offset wrong by one, an alignment requirement missed, a padding byte forgotten — the re-emitted bytes diverge and the test says where. Most Android RE tooling works per-layer; droidsaw traces a JS value through the React Native bridge into Java as a single taint path. Hand it an APK and it unpacks the container, decompiles every layer, and can pipe the output through Semgrep and TruffleHog in the same pass (audit --mode=full). CLI and MCP server share one command surface. Pure Rust, BSD-3-Clause.

Install

cargo install droidsaw                 # the CLI
cargo install droidsaw --features mcp  # also installs the droidsaw-mcp server

cargo fetches the droidsaw-* library crates from crates.io and compiles everything locally. The only prerequisites are a Rust toolchain (rustup) and a C compiler (cc/clang). semgrep and trufflehog are optional (for audit --mode=full, --mode=semgrep, or --mode=trufflehog); YARA is built in. No Java/Android SDK is needed.

Installing from automation or CI? Use cargo install --locked droidsaw — it builds against the dependency versions pinned in the publish-time lockfile, so the same release installs reproducibly.

For fleet or CI installs, prefer the cargo auditable variant — it embeds the full crate dependency list inside the binary itself (a compressed JSON record in a dedicated linker section), so the artifact stays auditable long after the build environment is gone:

cargo install cargo-auditable cargo-audit   # one-time tooling
cargo auditable install --locked droidsaw   # binary carries its own dependency inventory
cargo audit bin $(which droidsaw)           # audit the installed artifact, no manifest needed

cargo audit bin reads the embedded inventory and checks it against the RustSec advisory database — the binary answers “what exactly is in you?” years later, with nothing but the file.

Working on droidsaw itself? Check out the droidsaw repo and the five droidsaw-* library repos as siblings, then build droidsaw/ — its dev-loop [patch.crates-io] wires in the local ../droidsaw-* crates instead of crates.io.

Quickstart

droidsaw info app.apk                                 # layer summary: bytecode + manifest + signing