Android APK security analysis · for bug bounty
Decompile, analyze and hunt, without uploading a single byte.
RevDroid runs a 12-phase static analysis locally, then an AI agent reasons over the results to build verifiable exploit chains. The heavy lifting stays on your machine, the cloud only orchestrates the AI.
- unpack
- framework
- signing
- secrets
- code
- trackers
- binariesanalyzing…
- behaviour
- strings
findings
Exploit chain proposed
Exported provider → path traversal → arbitrary file read
01 · Trust by architecture
Your APK never leaves your machine.
Decompilation and scanning happen on the local agent. Only findings and small code snippets are ever sent to the AI, the app's bytes are never uploaded anywhere.
02 · The problem
Manual decompiling is slow. Generic scanners are noise.
Hunters decompile by hand, grep thousands of smali files, eyeball the manifest, and still miss things. Then generic scanners bury the one reachable bug under a wall of low-value findings that programs auto-reject.
The old way
- Hours of manual apktool + jadx spelunking
- Walls of "allowBackup / missing pinning" noise
- No sense of what's actually reachable or pays
With RevDroid
- 12 passes run locally in minutes, streamed live
- An AI that reasons about reachable, impactful bugs
- Findings framed as verifiable exploit chains
03 · How it works
From APK to exploit chain in three steps
No cloud upload, no waiting on a queue. Pair once, then scan and hunt.
Pair the local agent
Run the lightweight agent on your machine and paste its one-time token. The browser talks to it over localhost.
Add an APK
Upload an APK directly, or pull an installed package straight off a connected Android device over ADB.
Scan & hunt with AI
Watch 12 analysis phases stream in live, then ask the AI agent to build verifiable exploit chains.
04 · What it does
A real system, not a thin wrapper
Deep static analysis, an AI that reasons in chains, live device tooling, and framework awareness, all shipped today.
12-phase static analysis, streamed live
Unpack, framework, signing, resources, code, secrets, trackers, files, binaries, packers, behaviour and strings, each phase streams to the dashboard the moment it finishes.
- Weak crypto, SSL bypass, WebView misconfig
- 40+ tracker SDKs & packer/obfuscator detection
- ELF hardening: NX, PIE, RELRO, canary
An AI agent that thinks in exploit chains
The per-project agent reads your scan data and records bug-bounty hypotheses as multi-step chains, hypothesis → verifiable steps → impact, seeded from canonical Android attack templates.
- Firebase RTDB, WebView RCE, deep-link IDOR…
- Kills dead ends explicitly, so it never loops
- Per-conversation token & cost visibility
Chain · exported provider disclosure
- 1 · content://…/files reachable, verified
- 2 · path traversal via ../, verified
- 3 · read /data/…/tokens.xml, testing
Drive real devices over ADB
Connect an Android device over USB or Wi-Fi to inspect its security posture, browse installed apps, view the live screen, and pull an installed APK straight into a project.
- Bootloader, verified boot, SELinux, debuggable
- Installed-app browser with icons
- Live screen with remote input
Framework-aware from the first pass
RevDroid detects the app's framework and adapts, so Flutter, React Native, Unity, Xamarin and native builds are all decoded correctly instead of dumped as raw smali.
- Flutter · React Native · Unity · Xamarin · native
- Detected ABIs and packaging
- Right decompiler for the right target
Flutter
libflutter.so · arm64-v8a, armeabi-v7a
05 · Capabilities
Everything a hunt needs, in one place
Local-first privacy
All decompilation and scanning run on the agent. The APK's bytes never leave your machine, only findings and small snippets reach the AI.
APK bytes never leave your machine
12 analysis passes
One click, run in parallel, streamed live.
Secret scanning
AWS, GCP, Stripe, Slack, GitHub, Twilio, private keys, OAuth tokens.
Manifest & components
Debuggable, allowBackup, cleartext, exported components, deep links.
Chains, not checklists
Reachable, impactful bugs, framed the way a program actually pays.
Cost visibility
Per-conversation token & cost totals, with cached-token-aware pricing.
06 · Why RevDroid
Built for hunters, by the workflow they use
Chains, not checklists
Most tools output a flat list. RevDroid reasons about how bugs connect into something a program will actually pay for.
Private by architecture
Cloud scanners make you upload the APK. Here, analysis runs locally, the bytes never leave your machine.
Tuned for bounty economics
It knows the difference between a payout and a won’t-fix, and prioritizes reachable, impactful issues.
Flutter · React Native · Unity · native, detected & decoded
Flutter
React Native
Unity
Kotlin
Java
Xamarin
Capacitor
Cordova07 · FAQ
Questions, answered
No. Decompilation and scanning run locally through the agent on your machine. Only findings and small code snippets are ever used by the AI layer.
The AI features use an LLM through your own OpenRouter key and incur usage costs. The full static-analysis pipeline works without any key.
No, you can upload an APK directly. A connected device unlocks pulling installed apps and the live device tooling.
It detects and adapts to Flutter, React Native, Unity, Xamarin and native Android apps.
No. RevDroid is Android-specialized by design.
RevDroid is for authorized security testing only, your own apps, bug-bounty programs you are enrolled in, or intentionally vulnerable / CTF apps. You are responsible for having permission to test any app you analyze.
Find the bugs that actually pay.
Pair the agent, scan an APK, and let the AI build your next exploit chain, locally, in minutes. Full source, self-hosted, bring your own key.
For authorized security testing only, your own apps, programs you're enrolled in, or intentionally vulnerable / CTF targets.