Android Security Workbench

العربية · English

A privacy-conscious desktop workbench for authorized Android security auditing, ADB evidence collection, APK analysis, runtime observation, and evidence-grounded Gemini review.

Android Security Workbench brings common defensive Android assessment workflows into one multilingual desktop interface. It can collect read-only ADB evidence, analyze APKs, inspect Chrome activity through CDP, correlate findings, compare saved runs, and create redacted reports. Optional integrations include JADX, Apktool, Ghidra, Frida, mitmproxy, TShark/Wireshark, MobSF, scrcpy, and Gemini.

The project is built for devices and applications you own or are explicitly authorized to test. It does not provide exploitation, credential capture, TLS-pinning bypass, or root acquisition.

Why this project

• One interface for device, application, browser, static, native, runtime, and network evidence.
• Risk, audit coverage, and evidence confidence are reported separately.
• Evidence progresses through Collected → Parsed → Correlated → Validated states.
• Reports support Markdown, HTML, JSON, and redacted or full forensic ZIP exports.
• Arabic-first UI with offline English, French, Spanish, Hindi, Simplified Chinese, Japanese, Turkish, Persian, and Russian translations for navigation, live logs, statuses, findings, and rendered reports.
• Privacy controls redact serials and sensitive network fields and avoid retaining cookies, authorization headers, request bodies, query strings, database values, or cryptographic keys.
• Gemini analysis uses local lexical RAG, explicit consent, evidence citations, and a session-only API key.

Main capabilities

Area	What it does
Device audit	Collects authorized ADB evidence and highlights device posture risks.
APK and permissions	Reviews manifests, signatures, permissions, exported components, and contextual risk.
Static and native analysis	Correlates JADX, Apktool, and call/XREF-backed Ghidra observations.
Runtime lab	Observes metadata with Frida in an authorized lab; no TLS bypass or plaintext capture.
Web and network	Observes Chrome CDP events and redacted network metadata.
Reporting	Saves, compares, exports, archives, and restores local assessment reports.
Device mirror	Launches scrcpy with safe presets, command preview, recording, and embedded-window controls.
AI analyst	Reviews selected evidence with Gemini after consent and cites local report excerpts as [R#].

Requirements

• Windows 10/11 (best-supported platform).
• Python 3.11 or newer.
• Android Platform Tools (adb) available from PATH or configured in config/tools.json.
• USB debugging enabled on an authorized Android device.

Optional tools are discovered automatically or configured in config/tools.json. Their binary distributions are intentionally excluded from Git; download them from their official projects.

Quick start

git clone <your-repository-url>
cd <repository-folder>
python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install --upgrade pip
python -m pip install -r requirements.txt
python -m android_security_audit gui

The command-line interface is also available:

python -m android_security_audit --help

Optional integrations

Install only what your authorized workflow needs:

# Gemini support
python -m pip install -r requirements-ai.txt

# Development and tests
python -m pip install -r requirements-dev.txt

The Tools tab reports portable discovery locations and health checks. Absolute paths remain internal for execution; the UI and saved health metadata show safe forms such as ./jadx-cli/bin/jadx.bat and %LOCALAPPDATA%/Android/Sdk/..., without exposing the Windows account name. You may override local paths in config/tools.json. Large third-party tool folders such as ghidra/, wireshark/, and scrcpy-win64-*/ stay local and are ignored by Git.

Gemini API key privacy

Open the AI Analyst tab and paste your Gemini API key into the masked field. The value exists only in process memory for the current session, is cleared during normal shutdown, and is never written to settings, reports, logs, or chat history.

For automation, GEMINI_API_KEY may instead be supplied through the environment:

$env:GEMINI_API_KEY = "your-key"
python -m android_security_audit gui

Never put a real key in .env.example, config/ai.json, source files, screenshots, issues, or commits. If a key has ever been published, revoke it at the provider before rewriting Git history.

Only locally selected report excerpts and user-selected attachments are sent after explicit consent. Gemini is optional; the rest of the workbench remains local.

Data and safety boundaries

• Generated runs, raw evidence, databases, APKs, PCAPs, decoded source, credentials, and third-party binaries are excluded by .gitignore.
• A finding is an assessment signal, not proof of compromise.
• Missing or failed tools lower coverage instead of silently increasing confidence.
• Shareable ZIPs exclude raw evidence; full forensic ZIPs are sensitive and should not be posted publicly.
• Network changes are temporary and the workbench attempts to restore the previous proxy state on stop or restart.

Before publishing, read SECURITY.md and run the checks below.

Development

python -m compileall -q android_security_audit scripts
python -m pytest
python -m ruff check android_security_audit scripts

Project layout:

android_security_audit/   Python package, GUI, collectors, analyzers, and tests
config/                   Safe tracked defaults for tool discovery and AI policy
scripts/                  Build and translation-maintenance scripts
.github/                  CI and contributor templates

See CONTRIBUTING.md for contribution rules and android_security_audit/ARCHITECTURE_AR.md for the Arabic architecture notes.

Contributing and community

Bug reports, reproducible false positives, translation improvements, documentation, and new evidence-backed rules are welcome. Please remove device identifiers and sensitive evidence before opening an issue. Security vulnerabilities belong in the private channel described in SECURITY.md.

Useful search topics for this repository include: Android security, ADB audit, APK analysis, mobile application security, Android forensics, JADX, Ghidra, Frida, MobSF, Chrome CDP, and Arabic cybersecurity tools.

License

Copyright © 2026 Mohamed Alromaihi. Released under the MIT License.