BogusMips

BogusMips is written in Rust and allows performing analyses on how far your Android app can be disassembled. It allows you to open the *.apk or *.xapk file of your app to see how far your app can be disassembled.

Features

• VS Code style interface (Dark+ colors): a sidebar card with Explorer and Search views, an editor with tab and breadcrumbs, a file information panel and a status bar. The File and View menus are in the macOS menu bar, and in the window's menu bar on Windows.
• Open an *.apk or *.xapk with File → Open… (⌘O / Ctrl+O), by dropping it onto the window, or as a command-line argument.
• Left: package tree
  • Source code: every class from all classes*.dex files, grouped by Java package and disassembled to smali.
  • Resources: resources.arsc decoded into the res/values*/*.xml files it was compiled from (strings, colors, dimens, styles, attrs, arrays, plurals, …) plus public.xml with every resource ID.
  • Files: every entry in the archive.
  • XAPK bundles show each contained APK (base and split APKs) separately.
  • Filter box (⌘F) and keyboard navigation with the arrow keys.
  • Right-click an item (or File → Export…, ⌘E) to export it: files as stored in the package, or as shown (decoded binary XML, beautified text); classes as .smali; generated resource files as XML; APKs contained in an XAPK as .apk.
• Search (⇧⌘F): searches the contents of all classes (smali), text files, decoded XML and generated resource files, with match case / whole word / regular expression options. Clicking a result opens it in the editor at the highlighted match. The search index is built in the background on the first search.
• Center: content of the selected item
  • Classes are shown as smali (baksmali-compatible output).
  • Binary XML (AndroidManifest.xml, res/**/*.xml) is decoded. Resource references are resolved to names (@string/app_name, @android:style/Theme), and attribute values to their symbolic names (protectionLevel="signature").
  • Images are previewed, text is shown as text, and everything else as a hex dump.
  • Minified JSON, JavaScript (incl. React Native bundles), CSS, HTML and XML are beautified automatically, with syntax highlighting. Only whitespace is changed; Original shows the file as stored.
  • A hex view is available for any file.
• Right: AI Agent (⇧⌘A) and collapsible file information (⌘I):
  • AI Agent: prompt an AI agent about the disassembled smali source code, decoded resource files (AndroidManifest.xml, resources.arsc values), and captured HTTP/HTTPS network traffic. Configurable with Grok (xAI), Gemini (Google), Claude (Anthropic), OpenAI (ChatGPT), or any custom OpenAI-compatible endpoint (e.g. Ollama, OpenRouter). The agent has built-in tools (search_package, list_nodes, read_node, list_network_flows, inspect_network_flow) to autonomously search and read classes, resources, and captured network flows.
  • File / Request information: size, compression, CRC, SHA-256, DEX header details, class details, manifest summary, permissions, and any anomalies found.

Network

The Network view (⇧⌘N) is a stripped-down, Postman-like traffic sniffer. It starts an Android emulator (AVD), routes the guest's traffic through a built-in man-in-the-middle proxy, installs the open APK/XAPK, launches it, and captures its HTTP and HTTPS requests live. Captured requests appear in a list on the left; selecting one shows its full request/response (headers and body, pretty / raw / hex) in the editor, with timing and connection details in the information panel.

Full HTTPS decryption requires a rootable emulator image (google_apis / aosp_atd, not google_apis_playstore), because the proxy's CA must be installed as a system trust anchor. On start, BogusMips enables adb root and installs its generated CA (a short-lived, per-session CA, as PEM) into the system and Conscrypt (APEX) trust stores. On Android 14+ (API 34+) those stores live in per-process mount namespaces, so the CA is placed in an overlay directory — relabelled with the system_security_cacerts_file SELinux context (both the files and the directory, or apps are denied access) — and bind-mounted over the stores in every process's mount namespace via nsenter. The target app is installed and launched after this, so it forks fresh and its system-trust-store HTTPS is decrypted. Per-host leaf certificates are short-lived and sent without the CA in the chain, to satisfy clients that enforce the 398-day maximum certificate validity.

Caveats — what cannot be decrypted:

• Chrome and WebView / Chromium-based apps. Modern Chromium (the Chrome browser, Android System WebView, and the Cronet networking library) validates server certificates with the Chrome Root Store, which ignores user- or admin-installed system CAs. Such apps show ERR_CERT_AUTHORITY_INVALID; their traffic reaches the proxy but the TLS handshake is rejected. Many hybrid apps (Cordova/Capacitor/Ionic) render in a WebView and fall into this category.
• Apps with certificate pinning, which only accept a specific known certificate.
• Google's own services (Play Services / GMS traffic to *.google.com), which additionally require Certificate Transparency.

What is decrypted: apps using the Android system trust store — HttpURLConnection, OkHttp/Retrofit, Conscrypt and most native networking. (Already-running cached system processes are not re-forked, so they may keep showing trust-anchor errors until restarted; this does not affect the launched target app.)

Bypassing the Play Services & root checks. Rootable google_apis emulators ship an older Google Play Services build than many apps are compiled against (so a GoogleApiAvailability.isGooglePlayServicesAvailable() check returns SERVICE_VERSION_UPDATE_REQUIRED), and their userdebug build looks rooted (ro.debuggable=1, test-keys, RootBeer). Either makes an app abort before producing traffic. Tick Bypass Play Services & root checks before starting a capture to inject frida-gadget into the target app (via the wrap.<package> property / LD_PRELOAD) with a script that forces the Play Services checks to report success and neutralises the common root checks (RootBeer, test-keys/dangerous props, su/magisk probes). It only makes the checks pass — it does not provide the services or un-root the device — which is enough to keep these environment checks from blocking analysis. The gadget is downloaded once (needs network access) and cached; it requires a rootable emulator.

Custom Frida & CodeShare scripts. Under Frida scripts in the Network view, you can add any number of Frida scripts and individually toggle which ones to inject for a capture session:

• Frida CodeShare projects by slug (dzonerzy/aesinfo), CLI syntax (frida --codeshare dzonerzy/aesinfo), or URL (https://codeshare.frida.re/@dzonerzy/aesinfo/) — fetched from the CodeShare API and cached under ~/.cache/bogusmips/codeshare/.
• Local .js script files (typed or selected via the file picker button) and direct https:// script URLs.
• Output emitted by scripts via console.log(...) or send(...) is streamed from logcat into the collapsible Log view during capture. Your configured script list and enabled state are saved to ~/.config/bogusmips/frida.json.

Limitations: this uses frida's Java instrumentation, so it needs a frida-supported Android image — brand-new preview API levels (e.g. API 37) are not yet supported by frida and will not work; use an API 34/35 rootable image. The pinned frida version can be overridden with the BOGUSMIPS_FRIDA_VERSION environment variable. Because the gadget is injected via LD_PRELOAD and cannot suspend the app, the hooks are applied a moment after launch (frida cannot safely touch ART any earlier) — so checks that run during very early app startup can still win the race and are not reliably bypassed; beating those needs frida spawn-gating (frida-server) rather than the gadget. It also cannot defeat checks implemented in native code, apps with their own obfuscated/duplicated detectors, or server-side attestation such as the Play Integrity API.

All parsers (ZIP, DEX, smali disassembler, binary XML, resource table) are implemented in this repository. They follow Android's behaviour rather than the specs, so tricks that break other tools still open. Examples: malformed extra fields, fake encryption flags, CRC mismatches, and bogus compression methods. Such tricks are reported as warnings.

Names of Android framework resources come from media/android/framework-resources.txt, generated from the Android SDK with tools/gen_framework_resources.py (AOSP, Apache License 2.0).

The UI uses the Hack font, which is embedded in the binary (media/fonts, see its license).

Building & running

Requires Rust 1.85 or newer.

cargo run                         # debug build
cargo run --release -- app.apk    # optimized build, opening a file directly

Testing

cargo test
BOGUSMIPS_TEST_APK=path/to/app.apk cargo test --release   # also render every node of a real package

Developer tools:

# Write the smali of every class (apktool layout), e.g. to diff against `apktool d -r`
cargo run --release --example dump_smali -- app.apk out-dir
# Write the res/values*/*.xml generated from resources.arsc, e.g. to diff against `apktool d`
cargo run --release --example dump_resources -- app.apk out-dir
# Beautify a file as the content view does (format detected from the name, or given)
cargo run --release --example beautify_file -- in.min.js out.js [json|xml|html|css|js]
# Search a package's contents like the Search view, with timings
cargo run --release --example search_package -- app.apk "getString" [--regex] [--case] [--word]
# Open packages and inspect every node, reporting timings and decode errors
cargo run --release --example inspect_all -- app.apk other.xapk
# Capture an app's live HTTP/HTTPS traffic through the MITM proxy (headless)
cargo run --example net_capture -- app.xapk <AVD-name> [seconds] [--bypass] [--codeshare dzonerzy/aesinfo] [--script path/to/hook.js]

Project structure

src/
├── main.rs              # entry point, window setup
├── lib.rs
├── app.rs               # application state, menus, panels, background loading
├── inspect.rs           # turns a tree node into content + file information
├── search.rs            # content search: background index, regex search
├── agent/               # AI agent: multi-provider LLM client + package/network tools
│   ├── mod.rs           # background agent controller and chat state
│   ├── config.rs        # provider settings (Grok, Gemini, Claude, OpenAI, Custom)
│   ├── client.rs        # HTTPS client + tool-calling loops per provider API
│   ├── tools.rs         # context builder and tools over source, resources, and traffic
│   └── json.rs          # self-contained JSON parser and serializer
├── net/                 # Network view: emulator control + MITM proxy
│   ├── mod.rs
│   ├── ca.rs            # proxy CA + per-host leaf certificates (rcgen)
│   ├── bypass.rs        # optional Play Services check bypass (frida-gadget)
│   ├── http.rs          # HTTP/1.x request/response parsing (chunked, gzip)
│   ├── proxy.rs         # MITM proxy: CONNECT, TLS terminate, re-originate, capture
│   ├── capture.rs       # thread-safe captured-flow store
│   ├── emulator.rs      # adb/emulator control (root, CA install, proxy, launch)
│   └── controller.rs    # background start/stop orchestration state machine
├── beautify/            # whitespace-only pretty-printers: JSON, XML/HTML, CSS, JavaScript
├── package/
│   ├── mod.rs           # APK/XAPK loading, entry extraction, manifest summary
│   └── tree.rs          # navigation tree (source code by package, files by folder)
├── formats/
│   ├── reader.rs        # bounds-checked binary reader
│   ├── zip.rs           # lenient, Android-like ZIP reader
│   ├── axml.rs          # Android binary XML decoder
│   ├── arsc.rs          # resources.arsc parser, values XML generation
│   ├── resvalue.rs      # typed value formatting, resource name resolution
│   ├── detect.rs        # file type detection
│   └── dex/
│       ├── mod.rs       # DEX parser
│       ├── opcodes.rs   # Dalvik opcode table
│       ├── disasm.rs    # bytecode → smali instructions
│       ├── smali.rs     # class → smali file
│       ├── values.rs    # encoded values and annotations
│       ├── javafmt.rs   # Java-compatible number formatting (baksmali parity)
│       └── access.rs    # access flags
└── ui/
    ├── theme.rs         # dark theme (egui widgets + native window frame)
    ├── tree_view.rs     # left panel
    ├── content_view.rs  # center panel (text, hex, image)
    ├── info_panel.rs    # right panel (AI Agent + File/Request info tabs)
    ├── agent_panel.rs   # AI Agent prompt window and provider configuration UI
    ├── markdown.rs      # Markdown parser and renderer for agent responses
    ├── search_view.rs   # sidebar search view
    ├── network_view.rs  # sidebar network view (request list, AVD controls)
    ├── net_detail.rs    # editor view for a captured request/response
    ├── icons.rs         # vector icons (codicon style)
    ├── native_menu.rs   # native application menu (macOS menu bar, Windows menu bar)
    └── highlight.rs     # smali / XML syntax highlighting