艺术由pmjv_prahou创作。献给开放氏族最后一位法师的礼物。

droidsaw 会将 DEX 文件或 Hermes 捆绑包拆开，逐字节地拼接——从 F-Droid 中恢复了 5,767 个 DEX 文件，在保存模式下位元完全相同，Hermes 字节码在 v84、v96、v98 和 v99 上进行了往返验证。当格式模型出现漏洞时，测试会大声失败：字符串表偏移偏差 1，缺少对齐要求，遗漏填充字节——重新发出的字节会分歧，测试会告诉出位置。大多数 Android RE 工具是逐层工作;droidsaw 通过 React Native 桥接将 JS 值追踪到 Java，作为单一污点路径。给它一个 APK 后，它会解压容器，反编译每一层，并能在同一遍通过 Semgrep 和 TruffleHog 传输输出（audit --mode=full）。CLI 和 MCP 服务器共用一个命令表面。纯 Rust，BSD-3-Clause。

安装

cargo 从 crates.io 获取 droidsaw-* 库箱，并本地编译所有内容。该 唯一的前提条件是 Rust 工具链（rustup）和 C 编译器（[cc/clang）。 semgrep 和 trufflehog 是可选的（适用于 audit --mode=full、--mode=semgrep 或 [--mode=trufflehog）;YARA 是内置的。不

droidsaw

Art by pmjv_prahou. A gift to the last mage of the Open clan.

droidsaw takes a DEX file or Hermes bundle apart and puts it back together byte-for-byte — 5,767 DEX files from F-Droid recovered bit-identically under preservation mode, Hermes bytecode round-trip verified on v84, v96, v98, and v99. That test fails loudly when the format model has a hole: a string-table offset wrong by one, an alignment requirement missed, a padding byte forgotten — the re-emitted bytes diverge and the test says where. Most Android RE tooling works per-layer; droidsaw traces a JS value through the React Native bridge into Java as a single taint path. Hand it an APK and it unpacks the container, decompiles every layer, and can pipe the output through Semgrep and TruffleHog in the same pass (audit --mode=full). CLI and MCP server share one command surface. Pure Rust, BSD-3-Clause.

Install

cargo install droidsaw                 # the CLI
cargo install droidsaw --features mcp  # also installs the droidsaw-mcp server

cargo fetches the droidsaw-* library crates from crates.io and compiles everything locally. The only prerequisites are a Rust toolchain (rustup) and a C compiler (cc/clang). semgrep and trufflehog are optional (for audit --mode=full, --mode=semgrep, or --mode=trufflehog); YARA is built in. No Java/Android SDK is needed.

Installing from automation or CI? Use cargo install --locked droidsaw — it builds against the dependency versions pinned in the publish-time lockfile, so the same release installs reproducibly.

For fleet or CI installs, prefer the cargo auditable variant — it embeds the full crate dependency list inside the binary itself (a compressed JSON record in a dedicated linker section), so the artifact stays auditable long after the build environment is gone:

cargo install cargo-auditable cargo-audit   # one-time tooling
cargo auditable install --locked droidsaw   # binary carries its own dependency inventory
cargo audit bin $(which droidsaw)           # audit the installed artifact, no manifest needed

cargo audit bin reads the embedded inventory and checks it against the RustSec advisory database — the binary answers “what exactly is in you?” years later, with nothing but the file.

Working on droidsaw itself? Check out the droidsaw repo and the five droidsaw-* library repos as siblings, then build droidsaw/ — its dev-loop [patch.crates-io] wires in the local ../droidsaw-* crates instead of crates.io.

Quickstart

droidsaw info app.apk                                 # layer summary: bytecode + manifest + signing