hexproofdev.bsky.social
@hexproofdev.bsky.social
5/ Audit an APK yourself:
droidsaw audit ./your.apk
github.com/droidsaw/dro...
Let me know what you find: droidsaw.com/hall-of-fame/
happy hunting
#android #reverseengineering
droidsaw audit ./your.apk
github.com/droidsaw/dro...
Let me know what you find: droidsaw.com/hall-of-fame/
happy hunting
#android #reverseengineering
GitHub - droidsaw/droidsaw: DROIDSAW unified Android reverse engineering CLI. Hermes, DEX, Dart AOT, APK signing. SQLite export, JSON output, MCP server. Bytecode is not a security layer.
DROIDSAW unified Android reverse engineering CLI. Hermes, DEX, Dart AOT, APK signing. SQLite export, JSON output, MCP server. Bytecode is not a security layer. - droidsaw/droidsaw
github.com
May 26, 2026 at 2:06 AM
5/ Audit an APK yourself:
droidsaw audit ./your.apk
github.com/droidsaw/dro...
Let me know what you find: droidsaw.com/hall-of-fame/
happy hunting
#android #reverseengineering
droidsaw audit ./your.apk
github.com/droidsaw/dro...
Let me know what you find: droidsaw.com/hall-of-fame/
happy hunting
#android #reverseengineering
4/ MetaMask is React Native — a Hermes bundle (HBC, JS bytecode) on one side, DEX (Java bytecode) on the other, React Native bridge between.
droidsaw audit --mode=basic io.metamask
→ 3 BRIDGE_TAINT_FLOW
Each bridge flow: one path. JS source, bridge crossing, Java sink.
droidsaw audit --mode=basic io.metamask
→ 3 BRIDGE_TAINT_FLOW
Each bridge flow: one path. JS source, bridge crossing, Java sink.
May 26, 2026 at 2:06 AM
4/ MetaMask is React Native — a Hermes bundle (HBC, JS bytecode) on one side, DEX (Java bytecode) on the other, React Native bridge between.
droidsaw audit --mode=basic io.metamask
→ 3 BRIDGE_TAINT_FLOW
Each bridge flow: one path. JS source, bridge crossing, Java sink.
droidsaw audit --mode=basic io.metamask
→ 3 BRIDGE_TAINT_FLOW
Each bridge flow: one path. JS source, bridge crossing, Java sink.
3/ AI disclosure
I have never written Lean or Rust. droidsaw was vibe-coded. I have not manually reviewed code.
Specs, kani, Lean, proptest, fuzzing, ~4k APKs, AI review, flamegraphs, and personal taste drove development in Claude Code. Mostly Opus 4.6 and 4.7.
No LLM at runtime.
I have never written Lean or Rust. droidsaw was vibe-coded. I have not manually reviewed code.
Specs, kani, Lean, proptest, fuzzing, ~4k APKs, AI review, flamegraphs, and personal taste drove development in Claude Code. Mostly Opus 4.6 and 4.7.
No LLM at runtime.
May 26, 2026 at 2:05 AM
3/ AI disclosure
I have never written Lean or Rust. droidsaw was vibe-coded. I have not manually reviewed code.
Specs, kani, Lean, proptest, fuzzing, ~4k APKs, AI review, flamegraphs, and personal taste drove development in Claude Code. Mostly Opus 4.6 and 4.7.
No LLM at runtime.
I have never written Lean or Rust. droidsaw was vibe-coded. I have not manually reviewed code.
Specs, kani, Lean, proptest, fuzzing, ~4k APKs, AI review, flamegraphs, and personal taste drove development in Claude Code. Mostly Opus 4.6 and 4.7.
No LLM at runtime.
2/ Facebook Threads v423.3.0.54.66, 54 MB APK, 11 DEX, full decompile to .java:
droidsaw 63s · 1.4 GB peak RSS · 98,656 classes
jadx 1.5 251s · 42 GB peak RSS · 92,591 classes
droidsaw.com
droidsaw 63s · 1.4 GB peak RSS · 98,656 classes
jadx 1.5 251s · 42 GB peak RSS · 92,591 classes
droidsaw.com
droidsaw
A decompiler and security-auditing suite for mobile apps. Byte-exact DEX roundtrip verified against F-Droid (5,767 files); Hermes roundtrip verified on multiple bytecode versions. Pure Rust, BSD-3-Cla...
droidsaw.com
May 26, 2026 at 2:05 AM
2/ Facebook Threads v423.3.0.54.66, 54 MB APK, 11 DEX, full decompile to .java:
droidsaw 63s · 1.4 GB peak RSS · 98,656 classes
jadx 1.5 251s · 42 GB peak RSS · 92,591 classes
droidsaw.com
droidsaw 63s · 1.4 GB peak RSS · 98,656 classes
jadx 1.5 251s · 42 GB peak RSS · 92,591 classes
droidsaw.com
2/ Demonic Mobile: seed phrase and vault password persist in the Hermes heap after autolock on Android v7.76.0. A TODO comment names the fix and links to the extension commit. Labeled "[Future improvement]." HackerOne closed Not Applicable.
May 17, 2026 at 12:25 AM
2/ Demonic Mobile: seed phrase and vault password persist in the Hermes heap after autolock on Android v7.76.0. A TODO comment names the fix and links to the extension commit. Labeled "[Future improvement]." HackerOne closed Not Applicable.