Modding Resources

A practical, searchable directory of tools and learning resources for Android modding, reverse engineering, native analysis, malware research, networking, and software development.

Find a tool quickly with Ctrl/Cmd + F, or start with one of the curated paths below.

Quick navigation

I want to…	Start here
Modify an Android APK	Android workflow
Inspect Java, Kotlin, or DEX code	Android reverse engineering
Analyze a native .so or executable	Native and binary analysis
Instrument a running app	Dynamic instrumentation
Learn from beginner to advanced	Learning paths
Choose tools by operating system	Platform matrix
Find a category or understand its scope	Category guide
Add a resource	Contributing guide

Contents

• Responsible use
• Android reverse engineering
• Dynamic instrumentation and hooking
• Root, patching, and system modification
• Native and binary analysis
• Networking and protocol analysis
• Malware analysis and threat research
• Cryptography and data formats
• Automation, emulation, and scripting
• Developer and workflow tools
• Game modding
• Learning resources
• Guides

Responsible use

Use these resources only on software, devices, accounts, and networks that you own or are authorized to test. Respect licenses, terms of service, privacy, and applicable laws. Do not use this list to bypass payments, steal accounts, evade security controls, or distribute malware. Prefer legal training targets, CTFs, open-source projects, and responsible disclosure.

Android reverse engineering

Resource	Best for
JADX	Reading DEX as Java-like source with GUI and CLI workflows
Apktool	Decoding resources, editing smali, and rebuilding APKs
smali/baksmali	Dalvik bytecode assembly and disassembly
Android Studio	Building, debugging, profiling, and inspecting Android projects
APKLab	VS Code-based APK reverse engineering workflow
Androguard	Python automation and static analysis of APK/DEX/AXML
MobSF	Automated mobile application security testing
uber-apk-signer	Zip alignment and APK signing
APKiD	Identifying packers, obfuscators, and compilers
ReVanced	Open-source, modular patching framework

Dynamic instrumentation and hooking

Resource	Best for
Frida	Runtime instrumentation across Java and native code
frida-tools	Frida CLI utilities and tracing
Frida documentation	Official API and usage reference
LSPosed	ART/Xposed-compatible modules on rooted devices
LSPatch	Non-root APK-integrated hooking experiments
Pine	In-process ART method hooking
Dobby	Lightweight native inline hooks
ShadowHook	Android ARM/ARM64 native inline hooks
Frida CodeShare	Community scripts; review before running
objection	Frida-powered runtime exploration

Root, patching, and system modification

Resource	Best for
Magisk	Systemless root and module development
KernelSU	Kernel-based root and per-app policies
APatch	Kernel/system patching experiments
LSPosed modules index	Discovering community modules
Android platform security	Understanding Android security architecture

Native and binary analysis

Resource	Best for
Ghidra	Free disassembly, decompilation, and scripting
IDA Free/Pro	Interactive disassembly and commercial analysis
Binary Ninja	Modern analysis and intermediate languages
Rizin	Scriptable reverse engineering framework
Cutter	GUI for Rizin
radare2	CLI disassembly, debugging, and patching
LLDB	Native debugging and Android Studio integration
GDB	Portable native debugging
pwndbg	GDB enhancements for binary analysis
Capstone	Multi-architecture disassembly library
Keystone	Multi-architecture assembler library
Unicorn	CPU emulation library
Android NDK	Official native build and inspection toolchain

Networking and protocol analysis

Resource	Best for
Wireshark	Packet capture and protocol inspection
mitmproxy	Interactive HTTP(S) testing proxy
Burp Suite	Web and mobile security testing
HTTP Toolkit	Debugging HTTP traffic with a friendly UI
curl	Reproducible HTTP and network requests
Protobuf	Working with structured binary messages
gRPC	Inspecting and building RPC services
OWASP API Security	API security risks and testing guidance

Malware analysis and threat research

Resource	Best for
REMnux	Linux toolkit and VM for malware analysis
FLARE-VM	Windows reverse engineering environment
YARA	Pattern-based file classification
CAPE Sandbox	Automated malware behavior analysis
Any.Run	Interactive sandboxing; check data-sharing terms
VirusTotal	Multi-engine file and URL intelligence
Sigma	Portable detection rule format
MITRE ATT&CK	Adversary tactics, techniques, and procedures

Run suspicious samples in an isolated lab. Never upload private or sensitive files to public services.

Cryptography and data formats

Resource	Best for
CyberChef	Safe, repeatable transformations and decoding
OpenSSL	TLS, certificates, hashes, and crypto utilities
Hashcat	Authorized password recovery and hash auditing
John the Ripper	Authorized password auditing
jq	Querying and transforming JSON
xxd	Hex dumps and binary file inspection
ExifTool	Metadata and file-format inspection
Kaitai Struct	Describing and parsing binary formats

Automation, emulation, and scripting

Resource	Best for
Qiling	Scriptable multi-platform emulation
Unidbg	Calling Android/iOS native libraries without a device
Ghidra scripts	Reusable Ghidra automation examples
Il2CppDumper	Unity IL2CPP metadata analysis
frida-il2cpp-bridge	Unity IL2CPP runtime inspection
Python	General-purpose analysis automation
Go	Fast portable utilities and tooling
PowerShell	Windows and cross-platform automation

Developer and workflow tools

Resource	Best for
Git	Version control and reproducible changes
GitHub CLI	GitHub workflows from the terminal
Docker	Isolated, repeatable environments
Podman	Daemonless containers
VS Code	Lightweight editing and extension-based workflows
Neovim	Terminal-first, extensible editing
just	Reusable project commands
Task	Cross-platform task automation
pre-commit	Automated formatting and checks
Dev Containers	Portable development environments

Game modding

Use official modding APIs and mod only games you own or are permitted to modify. Avoid cheats, DRM circumvention, multiplayer abuse, and redistribution of copyrighted assets.

Resource	Best for
BepInEx	Unity/.NET plugin framework
MelonLoader	Unity and Il2Cpp mod loader
Harmony	Runtime .NET method patching
Unity documentation	Official Unity development reference
Unreal Engine documentation	Official Unreal development reference
Godot documentation	Open-source engine and scripting reference

Learning resources

• OWASP Mobile Application Security — mobile testing guide and checklist
• OWASP Web Security Testing Guide — structured web testing methodology
• Android Developers — official Android platform documentation
• Android Internals — AOSP architecture and source documentation
• Trail of Bits Security Training — practical security exercises
• pwn.college — hands-on systems and exploitation education
• OverTheWire — beginner-friendly security wargames
• PortSwigger Web Security Academy — free web security labs
• crackmes.one — legal reverse engineering challenges
• CTFtime — capture-the-flag events and writeups
• Ghidra documentation — official training material and references

Guides

• Quick start — safe setup and first workflows
• Category guide — what belongs where
• Learning paths — beginner, intermediate, and advanced routes
• Tools by platform — Windows, Linux, macOS, and container notes
• Resources by skill level — a faster starting point for new users

Contributing

Found a broken link, better replacement, or missing category? See CONTRIBUTING.md. Keep entries neutral, useful, authorized-use focused, and easy to verify.

License

This directory is dedicated to the public domain under CC0 1.0.