APK toolkit
for AI-assisted pentesting
TrustAPK makes an app trust your proxy - so you can read its HTTPS traffic, strip certificate pinning, surface endpoints and secrets, and decompile to Java, then hand the evidence to your AI assistant. Right on the phone, in the field.
For apps you own or are explicitly authorised to test. Requires Android 8.0+.
At a glance
Fully on-device
Patching, inspection, signing and installing run on the phone - no desktop, no Gradle, no root.
Local by default
Nothing leaves the device while you patch and inspect. Exporting evidence, sharing it with an AI app or forwarding logs is your choice.
Code preserved
In the default and most modes, the app's original classes*.dex are kept byte-for-byte - only the manifest and resources are edited and new files added.
Per-app CA trust
Trust your proxy inside one app - no system-wide CA install. Managed-device compatibility depends on your org’s install policy.
Built for the field
A pentester’s intercept-and-analyse workflow, packed into one app that runs entirely on the phone in your hand.
Intercept a target on engagement
Make a client app’s HTTPS readable in Burp / mitmproxy without touching the device’s system CA store - bundle your CA inside that one app.
Beat pinning on a bounty target
Strip network-security-config pinning, and drop a Frida gadget with an unpinning script for apps that pin in native / OkHttp code - no desktop Frida attached.
Recon endpoints, secrets & code
Extract hosts and URLs, surface API keys and tokens (values redacted), and decompile the dex to smali or Java for a static review - all on-device.
Avoid a device-wide CA
Per-app CA trust and on-device re-signing let you test without a rooted phone or a laptop, and without a system-wide CA - though installing apps may still be governed by your org’s policy.
Modern Android makes inspection hard - on purpose
The usual workarounds need a rooted phone, Frida with a desktop attached, or a full Android Studio + Gradle setup. TrustAPK does it per-app, on the device itself, with none of that.
Apps ignore user CAs
Apps targeting Android 7.0 (API 24)+ don’t trust user-added CAs by default unless configured otherwise - so pointing your phone at a proxy often shows empty or broken traffic.
Installing a system CA is intrusive
It applies device-wide, prompts a security warning, and is often restricted on managed / work devices.
Certificate pinning goes further
Even a trusted CA is rejected: the app only accepts specific certificates or public keys it was built to expect - configured per app or domain.
Three edits. One golden rule.
Everything is implemented from scratch against the raw formats - binary XML, resources.arsc chunks, the ZIP/APK container, and the v2/v3 signature schemes. No Gradle, no AndroidX at build time.
Edit only the wrapper
Rewrites the manifest (AndroidManifest.xml), the compiled resources (resources.arsc) and the network-security config - the parts that decide who the app trusts.
Add, never rewrite
Adds a network-security config, bundles your proxy certificate, and optionally adds companion dex (logs/debug) or native libs (Frida gadget) - as new files beside the originals.
Re-sign & install
Signs the whole APK with a local key using APK Signature Scheme v2/v3 and hands it to Android’s package installer. Splits and bundles are handled too.
The default rule: in the default patch and most modes, the app’s own classes*.dex are kept byte-for-byte - only the manifest and resources are edited and new files added.
Three opt-in code-level features - in-code unpinning, license bypass, and traffic capture on code-pinned apps - deliberately rewrite the affected dex, and the result screen reports how many methods changed.
Load an app - everything opens from one screen
Pick any installed app or an .apk / .apks / .xapk file and TrustAPK opens a single dashboard for the whole assessment. Every tool below is one tap away - then Patch this APK when you’re ready.
Links
Every host and URL the app talks to, pulled from the APK - filter, and flag ad/tracker hosts to block.
Secrets
API keys and tokens found bundled inside the app, with the values redacted.
Files
Browse every file in the package, search names and contents, and open any class as smali or Java.
Components
Activities, services, receivers and providers - see which are exported, unguarded or reachable.
Security scan
A MASVS-style static scan of the app, scored on the device.
App settings
Flip debuggable, cleartext, backup and WebView debugging before you patch.
App data
The app's own sandbox - shared_prefs, databases and files - watch and edit values live.
Live traffic
Read the app's decrypted HTTPS live in a built-in inspector - requests, headers and bodies.
Capture logs
Stream the app's own logcat to TrustAPK over localhost while it runs.
Review with your AI assistant
TrustAPK runs a static, MASVS-style scan and gathers evidence on-device, then lets you export a bundle you choose to the AI assistant you choose. TrustAPK has no built-in AI model - the assistant app does the analysis.
One tap gathers the evidence
Tap Full AI penetration test and TrustAPK runs its security scan and pulls everything together on the device - traffic, secrets, links, files and app data. You don’t need to run the plain scan first.
One bundle with everything it found
TrustAPK gathers what it found on the device - the security scan, the captured traffic, the decompiled code - into a single bundle for your AI. App identity is always included; everything else is a checkbox, so you pick exactly what goes in and review it before anything is shared.
Use your preferred AI assistant
TrustAPK shares the bundle into a chat app you already have installed - it opens there with a ready-made prompt, and that assistant correlates the traffic, code and secrets into findings. No TrustAPK account to create. Prefer your own instructions? Set a custom prompt that rides along with the bundle.
Shared to whichever of these you have installed. You may need an account with that provider.
Features in full
A complete toolkit for inspecting and reverse-engineering apps you own - traffic interception and analysis, plus a full on-device APK explorer and decompiler.
Live traffic inspector
Read a patched app’s own HTTPS live in a built-in inspector - requests, headers and bodies, WebSocket frames, replay and breakpoints - captured on the device.
Inspect: links, secrets & files
Extract hosts and URLs found in the APK, surface API keys and tokens (values redacted), and browse every file inside - search names and contents.
DEX decompiler - smali & Java
Read the app’s code on the device: an expandable package tree, search across names and contents, smali with highlighting or Java via jadx.
Trust your proxy CA
Writes a network-security config and can bundle your proxy certificate right inside the APK - pick it once, reused for every future patch.
Remove certificate pinning
On by default. Detects and neutralises pinning and reports which domains were unpinned. Turn it off to keep the app’s existing pinning config unchanged.
Permissions manager
Every permission with a plain-language note and a SENSITIVE flag. Untick to strip, or bulk-remove sensitive ones. See what changed after patching.
Capture logs
Adds a tiny companion so TrustAPK can read the app’s own logcat live over localhost - a new file, the app’s own dex untouched.
AI-assisted review
Ask AI about the links and secrets you surface, or export a chosen evidence bundle to your AI assistant for review - ChatGPT, Gemini, Claude, Grok, with an optional custom prompt. (It can also draft a replacement icon from a description.)
Webhook forwarding
Forward captured logs to an HTTP webhook you configure. A foreground service keeps forwarding in the background, resuming after reboot.
Diagnose
A downloadable report combining static checks, cross-references and a runtime log scan to explain why a patched app might misbehave.
Advanced & Frida
Debuggable, cleartext, extractNativeLibs, allowBackup, WebView debugging, screenshots, crash/ANR catcher, Frida gadget & runtime unpinning.
Ad & tracker blocking
Optionally block ad/tracker hosts inside the patched app, backed by an AdAway-style hosts list. Blocked hosts are listed on the result screen.
Installation, cloning & signing
On-device v2/v3 signing, split & bundle handling, and cloning that rewrites package identifiers for a separate installation so resource lookups keep working.
Works with your kit
Bring the proxy you already use and the APK in whatever shape you have it - TrustAPK handles the rest on the device.
Any intercepting proxy
Input formats
On-device signing
Decompile
Pinning bypass
A real assessment, screen by screen
Actual screens from an on-device assessment of a shipping app. Tap any screen to enlarge.
The target dashboard
Load any installed app or APK and get one control room - Inspect (Links, Secrets, Files, Components, Security scan, App settings), live App data, Live traffic and Capture logs, then Patch this APK. Here: a shipping app of 174.8 MB, base + 6 splits.
Decrypted HTTPS, live
After patching, the app’s own TLS is readable in the built-in inspector - 406 requests captured across the app’s analytics, backend APIs, Firebase and more. Tap any request to read its headers and body.
Endpoint recon
Hosts and URLs found in the APK, pulled statically: 139 hosts and 729 URLs across 124 domains. Filter instantly, flag ad/tracker hosts to block, and see which come from bundled SDKs.
Block ads & unwanted hosts
Stop ad, tracker and other unwanted requests from leaving the patched app - block a specific host you spotted in the traffic, or pull in ready-made lists (AdAway, HaGeZi, 1Hosts, Peter Lowe, StevenBlack) and choose which to apply.
Attack-surface map
Enumerate every activity, service, receiver and provider - flagged Exported / Unguarded / Reachable. 75 components, 31 exported, 27 unguarded, with the intent actions and deep-link schemes that reach them.
Read the app’s code & files
Browse the app’s entire contents on the device - every package and resource in the tree (7,212 files here), the AndroidManifest and more - search names and contents, and open any class decompiled to smali or Java.
Strip risky permissions
Every permission the app requests, each with a plain-language note and a SENSITIVE flag. Untick any to remove it from the patched app, or bulk-remove the sensitive ones - then see exactly what changed after patching.
Live logcat over localhost
A companion component streams the app’s own logs to TrustAPK without touching its code - watch the interception happen in real time (CONNECT ...:443 mitm=true, TLS client-side ok).
Data at rest
Browse the patched app’s own sandbox on-device: shared_prefs, databases and files with sizes and timestamps. Read Firebase prefs and Google measurement DBs, or export the captured flows.
Watch & edit app data live
Live-watch the app’s shared_prefs and files as you use it - see exactly which keys flip and what values are written, so session ids, feature flags and gatekeepers reveal themselves in real time. Tap any change to edit the value on the spot and feed the app whatever you want.
Per-app CA trust
Select your proxy’s CA certificate once; TrustAPK writes it inside the patched APK so that one app trusts your proxy - no system-wide CA install (managed-device compatibility depends on your org’s policy).
Fingerprint the build
Know what you’re up against: framework (React Native / Hermes), language, SDK levels, install source, split APKs and entry point - and the app’s one-tap AI review that shares the evidence to your assistant.
Built for on-device inspection
The parts that make on-device patching possible - built from the raw formats up, so editing and re-signing happen on the phone with no desktop toolchain to install.
No Gradle, framework APIs only
The app is linked by hand against the framework APIs, with no Android SDK, Android Studio or Gradle in the mix. (Building it from source needs only Docker on the host - a developer detail, not something you install to run it.)
The formats, from scratch
Binary XML (AndroidManifest), the resources.arsc chunk table, the ZIP/APK container and the v2/v3 signature schemes are all implemented in-app - that’s how it edits and re-signs on the phone.
Pure-Java, vendored
dexlib2 / baksmali and jadx (decompilation), Guava, and XZ are vendored in-repo - all pure Java, so they run on Android’s ART with nothing fetched at runtime.
The old way vs. one app
The usual mobile-intercept setup means a rooted phone with desktop Frida attached. TrustAPK folds capture, inspection and patching into one on-device app - with real trade-offs.
| Capability | TrustAPK | Root + desktop Frida |
|---|---|---|
| Runs entirely on the phone (no computer) | Yes | No |
| Works without rooting the device | Yes | No |
| Capture, inspect & decompile in one app | Yes | Depends |
| Keeps the app’s original signature | No | Yes |
| Free / open source | No | Yes |
TrustAPK trades some things for convenience: it re-signs the APK (which can break server-side integrity checks) and needs a paid license. The classic setup avoids both, but needs a computer and a rooted device.
What it can’t do
TrustAPK is deliberately transparent about its boundaries. No magic, no overclaiming.
Hardened & packed apps resist (e.g. Ijiami)
Apps reinforced by a commercial hardening SDK such as Ijiami (爱加密) ship their real code encrypted inside a native shell that only unpacks at runtime, wrapped in anti-tamper and anti-debug guards. TrustAPK can’t unpack or defeat that shell, so those apps can’t be unpinned, patched or read - this is one protection it cannot get past.
Re-signing can trip integrity checks
A re-signed build changes the app’s signature, so features gated behind Play Integrity or hardware attestation may refuse to run. Capturing the app’s traffic usually still works - a re-sign only trips those specific attestation checks; it does not break whole categories such as banking apps.
Removing a permission is not the same as revoking it
A permission removed from the manifest can make an app hit a SecurityException it never expected and crash. To just stop camera/mic/location use, revoke it in Settings instead - no reinstall, no data loss.
Manifest edits need a reinstall
You can't change an installed app's manifest in place; and because the signature differs, an in-place update over the original isn't possible (Android forces uninstall first).
Decompilation is approximate
The decompiler emits readable Java, not the original source; Kotlin can’t be reconstructed and the output may be partial or imperfect.
Native pinning may resist
Pinning done in native code may need the Frida gadget or runtime bypass to read the traffic.
Reinstalling replaces the app
Installing a patched build in place removes the original and its data (or install it as a separate copy to keep both). Back up anything you need first.
Questions, answered
The things pentesters and researchers ask before their first patch. Still stuck? Get in touch.
TrustAPK is for apps you own or are explicitly authorised to test - the same rule as any pentest tool. It makes an app you’re assessing trust your proxy so you can inspect its own traffic. Patching and inspection happen on your device; you decide whether to export or share any evidence.
Download & patch your first app
The signed APK is free to download from GitHub Releases and the in-app updater keeps it current. Using it requires a paid license - message the developer on Telegram to get a key.
All releasesQuick start
- 1Install TrustAPK and, when Android asks, allow TrustAPK to install unknown apps.
- 2On the home screen, pick an installed app (splits included) or an .apk / .apks / .xapk file.
Path A · Built-in inspector
No computer needed.
- 3.Leave "Remove certificate pinning" on and tap "Patch this APK".
- 4.Install the patched build (allow the install if Android prompts for the patched app too).
- 5.Open the app, then read its live HTTPS in TrustAPK’s built-in traffic inspector.
Path B · Desktop proxy
Burp / mitmproxy / Reqable.
- 3.In your proxy, export its CA certificate; in TrustAPK, select that certificate before patching.
- 4.Patch and install as above, then point your phone’s Wi-Fi proxy at your desktop tool.
- 5.Open the app - its traffic is now readable in your proxy.
Questions, licenses or ideas?
The fastest way to reach the developer - for a license key, a question or a bug - is Telegram.