RevDroid

⚠ Important — external service costs are NOT included in this purchase. RevDroid is a self-hosted application. Its AI features connect to a third-party LLM provider (OpenRouter), which bills you directly based on usage, and sign-in uses your own Google OAuth credentials. The purchase price does NOT include any API credits, subscriptions, or usage costs — you (the deployer) create your own provider accounts and pay them separately. The local static-analysis engine runs entirely on your machine and requires no paid service.

AI disclosure. RevDroid uses artificial intelligence. Its hunt agent is powered by large language models accessed through OpenRouter (you choose the model, e.g. Anthropic Claude, OpenAI, DeepSeek). The AI reasons over your local scan data to generate exploit-chain hypotheses, suggested steps and written summaries. AI output is assistive and must be verified by you; it does not replace manual testing. The 12-phase static-analysis engine itself is deterministic and uses no AI.

RevDroid turns an Android APK into a credible, submittable bug-bounty finding — without the APK ever leaving your machine. A local agent decompiles and scans the app across a 12-phase pipeline; an AI agent then reasons over the results and builds multi-step exploit chains, not just a flat list of warnings. Self-host it for yourself or your team — you own the full source and bring your own OpenRouter key.

What you can do with RevDroid

• Decompile and analyze any APK locally — the app's bytes never get uploaded anywhere
• Run 12 static-analysis passes that stream to your dashboard live
• Let an AI agent read your scan data and propose verifiable exploit chains (hypothesis → steps → impact)
• Surface hardcoded secrets, insecure code patterns, risky manifest components, trackers, and weak binaries
• Detect the app framework (Flutter, React Native, Xamarin, Unity, native) and adapt
• Drive real Android devices over ADB — pull installed APKs, inspect security posture, view the live screen
• Keep per-conversation token and cost visibility on every AI run

Who this is for

• Bug bounty hunters on HackerOne / Bugcrowd / YesWeHack who need signal over noise and speed to a valid finding
• Mobile pentesters & AppSec engineers running MASVS/MASTG-style assessments or reviewing their own org's builds
• Security teams & consultancies who want to self-host a shared Android-security tool for their team under their own brand, with Google sign-in and per-conversation cost visibility
• Solo operators who want a BYOK tool — bring your own OpenRouter key and keep full control of model choice and spend

How it works: a real-world flow (step by step)

1. Pair the local agent — start the lightweight Node agent on your machine; paste its one-time token into the dashboard to link them over localhost.
2. Add an APK — upload a file directly, or pull an installed package straight off a connected Android device via ADB.
3. Run a scan — the agent unpacks the APK and runs 12 analysis phases, each streaming to the UI live over Server-Sent Events.
4. Review findings — browse by category: findings, manifest, permissions, network & deep-links, code, secrets, signing, behaviour, trackers, files, binaries, APKiD, strings.
5. Ask the AI to hunt — open the per-project chat and ask for the most promising chain; it reads your scan data through the agent and reasons over it.
6. Track exploit chains — the agent records each hypothesis as a multi-step chain with status and impact, seeded from canonical Android attack templates.
7. Report — take the verified chain and evidence into your bug-bounty submission — all while the APK stayed on your machine.

Try it live

Browse a live, seeded instance with pre-scanned sample apps (InsecureBankv2, DIVA, InjuredAndroid, and a Flutter app) across Java and Flutter:

Live demo: https://revdroid.wixzel.com/

Because analysis runs through a local agent on the user's own machine (that is the privacy guarantee), the live demo shows pre-scanned projects with their findings and AI exploit chains. Install the local agent to scan your own APKs end to end.

Feature highlights

Local-first privacy

• All decompilation and scanning run on the local agent — APK bytes never leave the machine
• Only findings and small code snippets are ever sent to the AI layer you configure
• The agent binds to 127.0.0.1, authenticates every route with a bearer token, and stores it at file mode 600

12-phase static analysis (streamed live)

• Unpack — apktool decode into smali, resources, and the manifest
• Framework detection — Flutter, React Native, Xamarin, Unity, native (+ ABIs)
• Signing — certificate chain and signature-algorithm analysis
• Secret scanning — API keys & credentials (AWS, GCP, Stripe, Slack, GitHub, Twilio), private keys, OAuth tokens
• Code analysis — weak crypto, SSL/TLS bypass, insecure RNG, WebView misconfig, unsafe reflection, SQLi patterns, debug logging
• Manifest & components — debuggable, allowBackup, cleartext, exported components, deep links, network security config
• Tracker detection — 40+ known third-party SDKs
• Binary hardening — NX, PIE, RELRO, stack canary, stripped, RPATH (ELF)
• Packer / obfuscator detection — commercial packers, ProGuard/R8/DexGuard, anti-debug (APKiD-style)
• Behaviour signals — IMEI/IMSI reads, contacts/sensors, encryption, native loads
• File inventory & string extraction — searchable, with suspicious-file flagging

AI hunt agent with exploit chains

• Per-project AI chat that reads your scan data through a multi-turn tool-calling loop
• Exploit chains — tracks bug-bounty hypotheses as multi-step, verifiable chains with impact, seeded from 10+ canonical Android templates (open Firebase RTDB, WebView JS-interface RCE, deep-link account takeover/IDOR, exported-provider disclosure, JWT weakness, SSRF via image proxy, and more)
• Swappable model layer over OpenRouter (default Claude; switch to cheaper models anytime)
• Per-conversation token & cost metering with cached-token-aware pricing

Device tooling (via the local agent)

• Connect Android devices over USB or Wi-Fi
• Device info & security posture (bootloader, verified boot, SELinux, debuggable)
• Installed-app browser, live screen view with remote input (tap / swipe / key)
• Pull an installed APK straight off a device into a project

Self-host for your team

• Multi-user — Google OAuth sign-in and per-user projects out of the box
• Bring your own key — the deployment uses a single OpenRouter key you control; per-conversation cost visibility keeps spend transparent
• Extended License — build a commercial service on top under your own brand, per Envato terms. Billing and usage limits are yours to add (see the FAQ)

Important notice (external service costs)

---

RevDroid connects to third-party services that bill you directly: OpenRouter (the LLM provider for the AI agent) and Google (OAuth sign-in). Your purchase does not include API credits or subscriptions — create your own accounts and pay the providers separately. Static analysis runs locally and needs no paid service. RevDroid is a tool for authorized security testing only — your own apps, bug-bounty programs you are enrolled in, or intentionally vulnerable / CTF apps.

---

The tech stack

• Local agent: Node.js + Express, Apktool (auto-downloaded, integrity-checked), ADB, keytool
• Backend: Node.js + Express, MongoDB (Mongoose), Passport Google OAuth, JWT, OpenRouter
• Frontend: Next.js 16 (App Router), React 19, Tailwind CSS v4, DaisyUI

What's in the box?

1. Complete local agent source code (agent/)
2. Complete backend source code (backend/)
3. Complete frontend source code (frontend/)
4. Full offline documentation (interactive index.html) and a separate Quick Start guide
5. Environment templates (.env.example) for the backend and frontend
6. Third-party notices, scanner notes, and changelog

Customization & contents: 100% source is included and fully editable — no obfuscation, no encoded files. The AI scan prompts, exploit-chain templates, detection patterns, and UI are all editable source. Not included / bring your own: a MongoDB instance, a Google OAuth client, and an OpenRouter (LLM) API key; the apktool.jar binary is downloaded automatically on npm install from its official source (not bundled). The live demo's sample data and any images shown in this listing preview are for demonstration and are not part of the download.

Ship your own AI-powered Android security platform today — full source, local-first, yours to run.

Frequently Asked Questions (FAQ)

Does the APK get uploaded anywhere?

No. Decompilation and scanning run locally through the agent on the user's machine. Only findings and small code snippets are used by the AI layer.

Do I need a paid AI key?

The AI features use an LLM via your own OpenRouter key and incur usage costs. The full static-analysis pipeline works without any key.

Can I resell this as a paid SaaS?

You can host it for multiple users today — Google sign-in and per-user projects are built in, and each user runs the lightweight local agent on their own machine (that local step is the privacy guarantee). However, billing is not included: the deployment uses one OpenRouter key you provide, so all users share it and you (the operator) carry the inference cost. To charge end users or cap their usage, you add your own payment and usage-limit layer on top. RevDroid gives you per-conversation cost visibility to build on, and an Extended License covers running a commercial service under your brand.

Does it include billing, subscriptions, or credits?

No. RevDroid is a self-hosted, bring-your-own-key tool — there is no payment gateway, subscription system, or credit metering built in. It tracks and displays per-conversation token cost for visibility only. Paid plans/billing are on the roadmap, not in this release.

Do I need a physical Android device?

No — you can upload an APK directly. A connected device unlocks pulling installed apps and the device tooling.

Which frameworks are supported?

It detects and adapts to Flutter, React Native, Xamarin, Unity, and native Android apps.

Is iOS supported?

No. RevDroid is Android-specialized by design.

Is this legal to use?

RevDroid is for authorized security testing only — your own apps, bug-bounty programs you are enrolled in, or intentionally vulnerable / CTF apps. You are responsible for having permission to test any app you analyze.