{"repo":"reversenseorg/dexcalibur","free":true,"listed":false,"github":"https://github.com/reversenseorg/dexcalibur","clone":"git clone https://github.com/reversenseorg/dexcalibur.git","description":"Reversense (Dexcalibur2) is a fully rewriting and rethinking of Dexcalibur. Reversense is a binary intelligence platform that automates the reverse engineering of mobile and embedded applications. ","language":"TypeScript","stars":1167,"topics":["analysis","android","android-security","apk","binary-analysis","dex","frida","frida-gadget","frida-node","fuzzing","hook","hooking","instrumentation-automation","ios","mobile-security","reverse","reverse-engineering","security-tools","smali"],"license":"AGPL-3.0","category":"security_platform","readme_excerpt":"![\"logo\"](\"doc/rs.webp\")
\n\n# Reversense (also known as Dexcalibur 2)\n\n--------\n\n\n\n\n[](https://discord.gg/Pfw7Kc3dS)\n\n\nCurrent git `master` branch is `2.0.0`\n\n\n## Description\n\n\nReversense (Dexcalibur2) is a fully rewriting and rethinking of Dexcalibur.\nIt is a new project which aims to provide a better user experience, and a better coverage, suitable for intelligence and offensive security.\n\nReversense is a binary intelligence platform that automates the reverse\nengineering of mobile and embedded applications. It analyzes applications in\ntheir real execution context and supports a wide range of target\nlanguages, architectures, and operating systems.\n\nInstead of scattering work across disconnected tools, Reversense aggregates\nstatic analysis, dynamic instrumentation, emulation, and scanning into a\nsingle universal representation of the target — and lets teams explore it\ntogether.\n\n\n![\"screenshot\"](\"doc/screenshots/graphmeth.webp\")
\n\n\n\nDo you want share something or do you need some help ? Join our official chats :\n\n\n[](https://discord.gg/Pfw7Kc3dS) : the prefered way to give a response\n\n[Telegram](https://t.me/dexcalibur) - Alternative for whose are not familiar with Discord\n\n\n\nFor Professional use, support & modules : [www.reversense.com](https://www.reversense.com)\n\n\n\n## Table of contents\n\n- [Why Reversense](#why-reversense)\n- [Highlights](#highlights)\n- [How it works](#how-it-works)\n- [Features](#features)\n- [Interoperability](#interoperability)\n- [Use cases](#use-cases)\n- [Getting started](#getting-started)\n- [Documentation](#documentation)\n- [Contributing](#contributing)\n- [Services](#services)\n- [About](#about)\n- [License](#license)\n## Why Reversense\n\nMobile and embedded applications are everywhere, yet their internal behavior\nstays opaque: what data they process, whether they are vulnerable or\nmalicious, and how they defend themselves. Traditional approaches run into\nrecurring walls:\n\n- Obfuscated binaries that resist static reading.\n- Behavior that depends on a specific device model or execution context.\n- Secure channels, white-box crypto, and proprietary protocols that defeat\n ordinary network interception.\n- Vulnerable third-party dependencies that stay invisible without an SBOM.\n- A manual reverse-engineering process that is slow, costly, and hard to staff.\n Reversense addresses these by modeling the **whole** application and its\n environment, then automatically instrumenting and executing it to observe what\n really happens.\n\n## Highlights\n\n- **Collaborative by design** — several analysts work on the same project and\n binary codebase at once, each running the target on their own terminal,\n without conflicts.\n- **Automated scanning** — one-click SAST / DAST / IAST batteries driven by a\n customizable assurance model, producing shareable reports.\n- **LLM-ready** — every feature is invokable by an AI through a built-in MCP\n server, with the same access control as the standard API.\n- **Device-farm compatible** — allocate and drive physical or virtual\n terminals, locally or in a farm.\n## How it works\n\nReversense operates in four phases:\n\n1. **Discovery** — discovers the execution environment (permissions, hardware\n capabilities, CPU, TEE, …), retrieves the target application or firmware,\n and provisions a virtual test bench.\n2. **Modeling** — models the entire application and environment into the\n Reversense *universal representation*, which is updated automatically as\n tools and bots discover new data.\n3. **Instrumentation** — identifies points of interest (POIs), automatically\n generates probes to trace flows and mechanisms, then refines and tags the\n collected traces back into the model.\n4. **Execution, exploration & test** — runs the application to generate traces,\n then enriches the model and deductions. Stateful instrumentation lets the\n platform adapt to protections observed in previous runs.\n\n\n\n## Features\n\n### Discovery & test bench\nManual or batch target selection (or directly from a device), authenticated\ndownload from a store/server/terminal, allocation of one or more devices, and\nautomatic or manual configuration of the target OS to match fine hardware\ncontexts (TV, watches, IoT). Project access control by user, team, or\norganization.\n\n### Universal modeling\nExhaustive data extraction from all files and archives; a universal\nabstraction that brings machine code, binaries, graphical components, scripts,\ndumps, network traces, and system calls into one place. Combined static\nanalysis, partial emulation, and symbolic execution. Native **Radare2**\nintegration and a **Merlin** search engine to explore the representation and\nfind code by its execution behavior.\n\n### Instrumentation & dynamic analysis\nAutomatic generation of hooks (Java methods, Objective-C, native functions,\ninstructions, interrupts, instances) in a few clicks. A **KeyPoints**\nscheduler marks moments in the app lifecycle to load/unload hooks and trigger\nactions (memory dumps, screen recording, custom scenarios). Multi-thread and\ninter-process observation, multi-terminal scenarios for protocol analysis,\ndevice-fingerprint control, and a fuzzing engine. Dynamic cross-references are\nbuilt automatically during execution.\n\n### Scan & exploration\nOne-click SAST / DAST / IAST / SCA batteries, organized by theme against an\neditable **assurance model**. Scanners behave like a real user, building a test\nplan and producing explorable results plus artifacts (screenshots, input and\ntraffic recordings). Coverage includes permissions, SELinux policy, OWASP\nMASTG, SBOM, and detection of 90+ types of personal data across multiple\nstates.\n\n### Deobfuscation\nAutomatic on-the-fly decompilation with static analysis and AST update for\ndynamically loaded code. Ready-to-use bypass tactics for common RASP\n(anti-hook, anti-root, anti-emulator, …). Code synthesis via concrete and\nsymbolic execution to generate simplified representations or find bypass\noptions.\n\n### Analysis tooling\n- **Stereoscopic analysis** — a search engine over traces and ASTs spanning\n 100+ node types (UI components, file content, hooks, …) with adjacency\n search, taint analysis, and distance; plus a tag system (400+ tags by\n default) to sort, search, and trigger actions.\n- **Topological analysis** — system-API projection, application-topology\n visualization, and automatic UI-component inventory.\n- **Binary analysis** — explore all target libraries, unit-emulate with\n **Unicorn**, spoof inputs/outputs/CPU context, fuzz, explore ASTs, and\n contextually spin up an emulator from any point of execution.\n### Collaboration\nOne project, many terminals, many analysts, without conflicts. Markers, tags,\nand Merlin queries can be kept private or shared with the team. Traces and the\nhook configuration that produced them can be pooled and visualized across\nusers.\n\n### Device manager\nA single interface to allocate and manage physical or virtual terminals,\nlocally or in a farm. Virtual patching of terminal properties (Reversense\ngenerates the required low-level hooks). Access controls and quotas so\nterminals can be reserved for teams or projects.\n\n### Extensibility\n- **Inspectors** — plugins that extend analysis: define instrumentation\n strategies, chain them into analysis pipelines, and use inter-execution\n variables for stateful scenarios.\n- **Actions** — attach actions to application states (download a file, dump\n process/region memory, trigger a host action) and record screen, network, or\n Bluetooth.\n- **AssuranceModels** — scan binaries versus a set of SAST/DAST/IAST rules redacted inside an assurance model.\n## Interoperability\n\n- **Web Services API** — every feature and piece of information is reachable\n through a standardized API, documented in **OpenAPI** format.\n- **Authentication** — two modules (API key and SSO) for production use.\n- **MCP server** — exposes all features to an AI, enforcing the same access\n control as the standard API.\n- **Model-Context Protocol API** — a dedicated API to enrich your own MCP\n server with Reversense capabilities.\n## Use cases\n\nVulnerability research · threat intelligence · personal-data-flow analysis ·\ndeobfuscation and malicious-behavior detection · trojanization · security-\nfunction bypass · re-engineering and feature extraction · firmware reverse\nengineering · cryptographic-asset inventory and SBOMs · API identification ·\nintegration with an AI-driven system.\n\n## Getting started\n\nStart the server and visit the home page\n```bash\n\n```\n\n### Prerequisites\n\n- _List runtime/OS requirements (e.g. Linux, Docker, device access, …)_\n### Installation\n\n```bash\n# TODO: replace with the real installation steps\ngit clone https://github.com/YOUR_USER/reversense.git\ncd reversense\n# ...\n```\n\n### Quick start\n\n```bash\n# TODO: minimal end-to-end example (load a target, run a scan, open results)\n```\n\n## Documentation\n\nFull documentation: **[https://reversenseorg.github.io/rs-doc/](https://reversenseorg.github.io/rs-doc/)**\n\nShow Dexcalibur 0.7 (old) demo video : [Demo: Less than 1 minute to hook 61 methods ? Not a problem. \\(youtube\\)](https://www.youtube.com/watch?v=2dGoolvMEpI)\n\n## Contributing\n\nContributions are welcome. Please read [CONTRIBUTING.md](CONTRIBUTING.md)\nbefore opening an issue or a pull request.\n\n\n## Services\n\nReversense company is not a consulting firm, but professional services are available to\ntailor the platform to your needs: training on the platform and on reverse\nengineer","default_branch":"master","files":1057,"tree":[".github/FUNDING.yml",".github/workflows/CI.yml",".idea/dexcalibur-ts.iml",".idea/vcs.xml",".mocharc.json",".npmignore",".npmignore.default",".npmignore.prebuilt",".npmrc",".nvmrc",".projid","3TH_LICENSES.md","CHANGELOG.md","LICENSE","README.md","TESTED.md","assets/config/dxcengine_api.oidc.json","assets/config/emu.json","assets/config/example.oidc.json","assets/config/installer.cfg.json","assets/config/rsprivacy.oidc.json","assets/emails/activate_account.tpl.html","assets/emails/authcode.tpl.html","assets/emails/notify_findings.tpl.html","assets/emails/notify_new_sbom.tpl.html","assets/emails/passwordless_auth.tpl.html","assets/emails/reset_password.tpl.html","assets/emails/scan_completed.tpl.html","assets/login/index.html","assets/login/index_noauth.html","assets/login/index_pwdl.html","build.sh","connectors/inmemory/InMemoryDb.ts","connectors/inmemory/InMemoryDbCollection.ts","connectors/inmemory/InMemoryDbIndex.ts","connectors/inmemory/InMemoryMerlinBackend.ts","connectors/inmemory/SerializedObject.ts","connectors/inmemory/adapter.ts","connectors/inmemory/error/InMemoryException.ts","dev.env.sh","dexcalibur","dexcalibur-adm.mts","dexcalibur.ts","doc/rs.webp","doc/screenshots/graphmeth.webp","docker/Docker-compose.yml","docker/base/linux_x64/Dockerfile","docker/linux_arm64/Dockerfile.deprecated","docker/linux_x64/Dockerfile","docker/linux_x64/Dockerfile.backup","docker/linux_x64/Dockerfile.base","docker/linux_x64_base/Dockerfile","docker/mac_arm64/Dockerfile","docker/mac_arm64/Dockerfile.o","docker/mac_arm64/Dockerfile.old","docker/mac_arm64/install.sh","docker/mac_x64/Dockerfile.deprecated","docker/scripts/start.sh","docker/uis_appleSilicon/Dockerfile","docker/uis_x64/Dockerfile","info.json","inspectors/AccessibilityInteractionClient/main.ts","inspectors/AliasFromSource/main.ts","inspectors/AndroidPermissions/main.ts","inspectors/AndroidStringObserver/main.ts","inspectors/AndroidUI/main.ts","inspectors/ApplicationTopography/main.ts","inspectors/ApplicationTopography/service/main.ts","inspectors/ApplicationTopography/web/activity.html","inspectors/ApplicationTopography/web/main.html","inspectors/ApplicationTopography/web/provider.html","inspectors/ApplicationTopography/web/receiver.html","inspectors/ApplicationTopography/web/service.html","inspectors/AttackSurface/draft_main.ts","inspectors/BytecodeCleaner/main.ts","inspectors/BytecodeCleaner/service/main.ts","inspectors/BytecodeCleaner/src/Rules.ts","inspectors/BytecodeCleaner/web/main.html","inspectors/CommunicationMonitor/main.ts","inspectors/ContentProvider/main.ts","inspectors/CryptoEncryption/main.ts","inspectors/DataClassifier/main.ts","inspectors/DataClassifier/service/main.ts","inspectors/DataClassifier/web/main.html","inspectors/DynamicLoader/main.ts","inspectors/DynamicLoader/service/main.ts","inspectors/DynamicLoader/src/main.web.api.ts","inspectors/DynamicLoader/web/main.html","inspectors/FileDescriptor/main.ts","inspectors/FileDescriptor/service/main.ts","inspectors/FileDescriptor/web/main.html","inspectors/FileProvider/main.ts","inspectors/FileSystem/main.ts","inspectors/Fingerprint/main.ts","inspectors/Firebase/main.ts","inspectors/Flutter/main.ts","inspectors/Fragments/main.ts","inspectors/HashIdentifier/main.ts","inspectors/IssueObserver/main.ts","inspectors/JavaRegexMatcher/main.ts","inspectors/JavaThread/main.ts","inspectors/JavaUtilsObject/main.ts","inspectors/Keystore/main.ts","inspectors/Kotlin/main.ts","inspectors/NativeLibrary/main.ts","inspectors/NetworkHttp/main.ts","inspectors/Okhttp/main.ts","inspectors/OwaspMSTG/model.json","inspectors/OwaspMSTG/scans.json","inspectors/PermissionAnalyzer/main.ts","inspectors/ReactNative/main.ts","inspectors/RootDetection/lib.ts","inspectors/RootDetection/main.ts","inspectors/SCA/Types.ts","inspectors/SCA/main.ts","inspectors/SecurityRating/main.ts","inspectors/UI_Generic/main.ts","inspectors/ViewGroup/main.ts","inspectors/Webviews/main.ts","package-lock.json","package.json","qodana.yaml","scripts/build_doc.sh","scripts/config.jsdoc.json","scripts/files/config.json","scripts/http/mcp-resources.http","scripts/os_scripts/darwin.build.sh","scripts/os_scripts/darwin.postbuild-electron.sh","scripts/os_scripts/darwin.prebuild-electron.sh","scripts/os_scripts/darwin.prebuild-node.sh","scripts/os_scripts/darwin.prebuild.sh","scripts/os_scripts/darwin.test.js","scripts/os_scripts/linux.build.sh","scripts/os_scripts/linux.prebuild-electron.sh","scripts/os_scripts/linux.prebuild-node.sh","scripts/os_scripts/linux.prebuild.sh","scripts/patch_esm_got.js","scripts/postinstall.js","scripts/prepare_thirdparty.sh","scripts/run_os_script.mjs","src/APK.ts","src/AccessFlags.ts","src/AdbWrapper.ts","src/AdbWrapperFactory.ts","src/AnalysisHelper.ts","src/Analyzer.ts","src/AnalyzerConfiguration.ts","src/AnalyzerDatabase.ts","src/AnalyzerState.ts","src/ApkHelper.ts","src/ApkPackagePatcher.ts","src/AppIcon.ts","src/AppPackage.ts","src/Application.ts","src/Architecture.ts","src/ArgUtils.ts","src/Auditable.ts","src/BinwalkHelper.ts","src/Brand.ts","src/Bridge.ts","src/Bus.ts","src/BusEvent.ts","src/Configuration.ts","src/ConnectorFactory.ts","src/CoreConst.ts","src/CoreParser.ts","src/CryptoUtils.ts","src/DalvikInstructionFormat.ts","src/DataAnalyzer.ts","src/DataLocation.ts","src/DataScope.ts","src/DataSource.ts","src/DataSourceHelper.ts","src/Device.ts","src/DeviceFileSystem.ts","src/DeviceManager.ts","src/DeviceModel.ts","src/DexHelper.ts","src/DexcaliburEngine.ts","src/DexcaliburEngineMode.ts","src/DexcaliburProject.ts","src/DexcaliburRegistry.ts","src/DexcaliburServerChildProcess.ts","src/DexcaliburUpdater.ts","src/DexcaliburVM.ts","src/DexcaliburWorkspace.ts","src/Downloader.ts","src/Errors.ts","src/ExternalTool.ts","src/FileTypes.ts","src/FridaGenerator.ts","src/FridaHelper.ts","src/Graph.ts","src/Hook.ts","src/HookConstraint.ts","src/HookMessage.ts","src/HookPrimitive.ts","src/HookPrologue.ts","src/HookRevision.ts","src/HookSession.ts","src/HookSet.ts","src/HookStatus.ts","src/HookVariable.ts","src/IDexcaliburEngine.ts","src/INode.ts","src/Inspector.ts","src/InspectorFactory.ts","src/InspectorFrontController.ts","src/InspectorManager.ts","src/Installer.ts","src/IntentFactory.ts","src/JavaHelper.ts","src/JavaScriptHelper.ts","src/LineLocalized.ts","src/Logger.ts","src/MagicHelper.ts","src/ModelAPI.ts","src/ModelBasicBlock.ts","src/ModelBom.ts","src/ModelCall.ts","src/ModelCatchStatement.ts","src/ModelClass.ts","src/ModelConstantValue.ts","src/ModelCpuInstruction.ts","src/ModelDataBlock.ts","src/ModelExecutableSection.ts","src/ModelField.ts","src/ModelFile.ts","src/ModelFileSection.ts","src/ModelFunction.ts","src/ModelInstance.ts","src/ModelInstruction.ts","src/ModelLocation.ts","src/ModelMetadata.ts","src/ModelMethod.ts","src/ModelNativeRef.ts","src/ModelPackage.ts","src/ModelParameter.ts","src/ModelReference.ts","src/ModelResource.ts","src/ModelSavable.ts","src/ModelStringValue.ts","src/ModelSwitch.ts","src/ModelSyscall.ts","src/ModelSyscallFactory.ts","src/ModelType.ts","src/ModelVariable.ts","src/NativeAnalyzer.ts","src/NativeAnalyzerProfile.ts","src/NodeCompare.ts","src/NodeSchema.ts","src/Opcode.ts","src/OpcodeSmaliParser.ts","src/PrivilegedExecutionStrategy.ts","src/ProjectState.ts","src/ProjectWorkspace.ts","src/R2Factory.ts","src/R2Helper.ts","src/REMOVED/VM.js","src/Script.ts","src/ScriptManager.ts","src/SearchAPI.ts","src/SearchPattern.ts","src/SearchToken.ts","src/SerializeFilter.ts","src/Settings.ts","src/ShellHelper.ts","src/Simplifier.ts","src/SmaliDisassembler.ts","src/SmaliParser.ts","src/StatusMessage.ts","src/SyscallBuilder.ts","src/Syscalls.ts","src/TerminalServer.ts","src/TerminalSession.ts","src/TestHelper.ts","src/Tool.ts","src/Uploader.ts","src/User.ts","src/UserRole.ts","src/Utils.ts","src/WebServer.ts","src/WebTemplateEngine.ts","src/WebsocketClient.ts","src/WebsocketServer.ts","src/WebsocketSession.ts","src/Workflow.ts","src/actionnable/CustomCode.ts","src/actionnable/GeoIpHelper.ts","src/actionnable/MemoryScanner.ts","src/actionnable/TraceRouteHelper.ts","src/analyzer/CompositionAnalyzer.ts","src/analyzer/GenericPackageAnalyzer.ts","src/analyzer/IAnalyzerUnit.ts","src/analyzer/IAppAnalyzer.ts","src/analyzer/IDelegatedDataAnalyzer.ts","src/analyzer/IFileAnalyzer.ts","src/analyzer/IGuiAnalyzer.ts","src/analyzer/INativeHelper.ts","src/analyzer/IPackageAnalyzer.ts","src/analyzer/NativeAnalyzerCommands.ts","src/analyzer/ProjectInput.ts","src/analyzer/StringAnalyzer.ts","src/analyzer/taint/TaintAnalyzer.ts","src/analyzer/taint/TaintCase.ts","src/android/AndroidActivity.ts","src/android/AndroidAppAnalyzer.ts","src/android/AndroidApplication.ts","src/android/AndroidAttribute.ts","src/android/AndroidBinaryResourceUtils.ts","src/android/AndroidBroadcast.ts","src/android/AndroidComponent.ts","src/android/AndroidInputEvent.ts","src/android/AndroidManifest.ts","src/android/AndroidPackageManager.ts","src/android/AndroidProvider.ts","src/android/AndroidRRO.ts","src/android/AndroidReceiver.ts","src/android/AndroidResource.ts","src/android/AndroidService.ts","src/android/AndroidTypes.ts","src/android/ApkPackage.ts","src/android/ApkeepHelper.ts","src/android/AxmlDocument.ts","src/android/AxmlStructures.ts","src/android/DDVM_Allocator.ts","src/android/DDVM_ClassInstance.ts","src/android/DDVM_ClassLoader.ts","src/android/DDVM_Configuration.ts","src/android/DDVM_Exception.ts","src/android/DDVM_HeapArea.ts","src/android/DDVM_Hook.ts","src/android/DDVM_Log.ts","src/android/DDVM_MethodArea.ts","src/android/DDVM_Monitor.ts","src/android/DDVM_PseudoCodeConfiguration.ts","src/android/DDVM_PseudoCodeMaker.ts","src/android/DDVM_StackMemory.ts","src/android/DDVM_State.ts","src/android/DDVM_Symbol.ts","src/android/DDVM_SymbolTable.ts","src/android/DDVM_TypeHelper.ts","src/android/DDVM_Types.ts","src/android/DDVM_VirtualArray.ts","src/android/DalvikOpcode.ts","src/android/DeviceComponent.ts","src/android/DexStructures.ts","src/android/DexcaliburDVM.ts","src/android/Intent.ts","src/android/IntentFilter.ts","src/android/ModelPermission.ts","src/android/analyzer/AndroidCodeAnalyzer.ts","src/android/analyzer/AndroidDataAnalyzer.ts","src/android/analyzer/AndroidGuiAnalyzer.ts","src/android/analyzer/AndroidNativeAnalyzerProfile.ts","src/android/analyzer/AndroidPackageAnalyzer.ts","src/android/analyzer/AndroidPackageAnalyzerConfig.ts","src/android/bridge/AndroidInstallOptions.ts","src/android/jni/README.md","src/android/jni/common.ts","src/android/os/AndroidProcess.ts","src/android/playstore/PlaystoreScraper.ts","src/android/profiles/AndroidBuildProfile.ts","src/android/profiles/AndroidDeviceProfile.ts","src/android/profiles/AndroidInputProfile.ts","src/android/profiles/AndroidMemoryProfile.ts","src/android/profiles/AndroidMountedFsProfile.ts","src/android/profiles/AndroidNetworkProfile.ts","src/android/profiles/AndroidPermissionProfile.ts","src/android/profiles/AndroidSystemProfile.ts","src/android/profiles/AndroidTrustProfile.ts","src/android/profiles/AndroidUsbProfile.ts","src/audit/AuditEmailBuilder.ts","src/audit/AuditManager.ts","src/audit/AuditManagerMailer.ts","src/audit/DataPropertyFactory.ts","src/audit/ExplainedReport.ts","src/audit/Policy.ts","src/audit/PolicyAction.ts","src/audit/PolicyActionFactory.ts","src/audit/PolicyRule.ts","src/audit/PolicyRuleFactory.ts","src/audit/SignatureServerAPI.ts","src/audit/ThreatModelFactory.ts","src/audit/common/Asset.ts","src/audit/common/AssuranceModel.ts","src/audit/common/AssuranceReport.ts","src/audit/common/AssuranceScanner.ts","src/audit/common/CodeConstraint.ts","src/audit/common/CodeThreat.ts","src/audit/common/Constraint.ts","src/audit/common/ConstraintMatch.ts","src/audit/common/Control.ts","src/audit/common/ControlAssessment.ts","src/audit/common/DashBoard.ts","src/audit/common/DataFlowInfo.ts","src/audit/common/DataProperty.ts","src/audit/common/Finding.ts","src/audit/common/GenericReport.ts","src/audit/common/GenericScanner.ts"],"storefront":"/r/reversenseorg","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/reversenseorg/dexcalibur/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}