calebfenton/simplify

Simplify is a command-line tool for Android security researchers and malware analysts who need to read obfuscated Android app code. Android apps sometimes disguise their behavior using obfuscation, techniques that scramble code to hide what it actually does. Simplify works by running the app in a virtual environment it controls, tracking what happens as the code executes, and then rewriting the code to be clearer without changing how it behaves. The tool is built in three connected parts. The first is a virtual machine called smalivm that can execute the low-level code format Android apps use (called Dalvik bytecode), even when some values like network responses or file contents are unknown at analysis time. The second is the main Simplify optimizer, which takes what smalivm learned and applies transformations: replacing encrypted strings with their decrypted versions, removing dead code that never runs, and stripping out reflection (a technique often used to hide which methods are being called). The third is a demo app showing how to build your own tools on top of smalivm. To use it, you run it as a command-line Java program and point it at an Android APK or DEX file. You can limit which parts of the app it processes using include and exclude filters, set time limits for tricky methods, and adjust recursion depth. The output is a modified DEX file with the obfuscation removed. It does not rename classes or methods, so structural names stay as-is. Building it requires Java 8 and uses the Gradle build system. The repository includes submodules for Android framework files, so cloning with the recursive flag is necessary to get everything set up. The project is aimed at people doing mobile security research, malware analysis, or reverse engineering of Android applications. It is not a consumer app and not something you install on a phone. The README notes that contributions are welcome and gives clear guidance on what to include when reporting issues.