Add Androidmeda Tool

[In3tinct]

Description

This PR adds a new tool, Androidmeda, to the MASTG tools collection.

Androidmeda is an AI tool designed to deobfuscate Android application code and also find potential vulnerabilities by leveraging the power of Large Language Models (LLMs). It analyzes decompiled Android source code to identify obfuscated patterns and suggests more readable names for variables, methods, and classes to provide a clearer understanding of an application's logic.

It supports both LLM APIs (OpenAI, Gemini, Anthropic) and local LLM inference via Ollama.

Details

• Tool ID: MASTG-TOOL-0145
• Platform: Android
• Source: https://github.com/In3tinct/Androidmeda

Checklist

• Tool added to tools/android
• File follows the MASTG-TOOL-XXXX naming convention
• Metadata (title, platform, source) is correct
• Description is accurate and follows the guidelines

---

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
  • LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
  • Prompts: [Summarize the key prompts or instructions given to the AI tools]

---

[x] I have read the contributing guidelines.

Guidelines for Pull Requests (you can delete this section after reading):

• Please ensure that your content follows the style guide.
• If you are working on Porting MASTG v1 Tests to v2, refer to this document.
• If you are working on new MASWE, tests, or demos, refer to this document.

🚫 If you do not check one of the AI Tool Disclosure or contributing guidelines boxes, your PR will not be merged. If you used AI tools to assist you in writing code or text, but fail to provide the required disclosure, your PR will not be merged.

[In3tinct]

Hi @cpholguera @sushi2k

Requesting review and merge for Androidmeda, to the MASTG tools collection as MASTG-TOOL-0145.

Thank you.

[In3tinct]

It seems another PR is introducing "MASTG-TOOL-0145", but not merged yet. #3597

Should i wait for it and then increment it?

[cpholguera]

No worries about the IDs, we fix them right before merging (if the PR can be merged). However, you should have opened an issue first so we evaluate first if the tool can be added to the MASTG. Please remember this for further contributions.

See https://mas.owasp.org/contributing/1_How_Can_You_Contribute/

[In3tinct]

Got it! Thank you.

[bernhste]

Hey, I'm running the app now on the Android UnCrackable L4.

Do you have experiences with larger apps, its performance or did you run it on these apps before? Because my M1 with llama3.2 is very slow :)

Then, do you have experiences with the issues like hallucinations during the deobfuscation and possible changes to the code?

The second prompt which looks for vulnerabilities looks a bit too generic for mobile app security and does not reflect the mentioned current OWASP Mobile Top 10. For example there is no mentioning of network related issues, local authentication or insecure cypto.

So my first impression is that we should have some more data and examples for the practical use. Unfortunately I don't find much information such as blogs etc., which are not obviously AI generated.

I will let it run over the night with my local model because I am curious how it will rate the Crackme.

[In3tinct]

Thank you for taking a look.

Regarding,

1. Latency - It depends on how powerful the machine is (i may be stating the obvious here). :) i also have that mentioned on my readme page as "Important - Don't send the entire package at once which would contain libraries etc. Otherwise It may take forever to scan." but rather app specific directories. May be i should make it a warning.

I ran it with infosecadventures "allsafe" app and other production apps too. And found it very useful in reviewing code.

2. Hallucinations - At worst it just adds back the obfuscated code, if it can't deobfuscate. but i have not seen it make things up (with my limited testing).

3. There are 2 public blogs which has gone in more details, both of them looks manual review to me. please take a look, it also helped in deobfuscating an android malware in both cases -

1. https://fuzzinglabs.com/llm-assisted-android-deobfuscation-benchmark/ (this is a great benchmarking)
2. https://www.mobile-hacker.com/2025/07/22/deobfuscating-android-apps-with-androidmeda-a-smarter-way-to-read-obfuscated-code/

I think the primary purpose of my tool is for deobfuscation/making the decompiled android code more readable, but in the future, i can make it better for vulnerabilities, right now its generic prompt.

[bernhste]

Thank you for the tips and the links. I think though the benchmarks are a bit weighted, because the source code and write-ups of the vulnerabilities may be part of the training data 😅

I will try it out in my next prod test.

[cpholguera]

Since this has bypassed out contribution flow we're going to reset and start over with a discussion:

#3652

If this gets approved and turned into and issue we can reopen the PR.

See:

https://mas.owasp.org/contributing/1_How_Can_You_Contribute/

https://mas.owasp.org/contributing/

[In3tinct]

Thank you, will keep an eye on the discussion and remember the contribtion flow for future contributions.