Automate Android APK decompilation and execution flow analysis using coordinated AI agents connected to IDA Pro and JADX.
Watch multiple specialized agents collaborate in real time through separate tmux windows, each handling a different analysis task.
Route reverse engineering subtasks between agents using @mention syntax so each agent calls on a peer directly without a central router.
Requires IDA Pro, JADX, a DeepSeek API key, and tmux. Prompts are in Chinese and optimized for DeepSeek behavior.
DuckAgent is a multi-agent system designed to assist with Android reverse engineering, which is the process of analyzing an Android app to understand how it works without access to its original source code. The system coordinates several AI agents that work together on this task, with the README written primarily in Chinese. The system includes three specialized AI agents. The main agent handles coordination and breaks tasks into pieces. The trace agent focuses on execution flow analysis and algorithm reconstruction. The IDA/JADX agent handles static analysis and decompilation, connecting to IDA Pro and JADX, which are professional tools used for inspecting compiled Android apps. A human participant also sits in the loop as the final decision-maker. What makes the design notable is that the agents are treated as peers rather than arranged in a hierarchy. Instead of one central router deciding who gets each message, agents direct messages to each other using @mentions, similar to tagging someone in a chat. An agent responding to a task can call on another agent directly, and that agent can in turn ping a third. The routing is automatic: the system parses @agent_id references from message content and delivers accordingly. The system can run in two modes. The default mode uses tmux, a terminal multiplexer, to run each agent in a separate process with its own visible window, which makes it easier to watch what each agent is doing in real time. A single-process debug mode is also available for development. A FastAPI server acts as the message bus, persisting messages to SQLite and distributing them to agents over WebSockets. Configuration is done through a .env file where you set your LLM API key, the model name, and paths to trace log files. The README recommends using DeepSeek as the AI model because the system was designed with Chinese-language prompts and Chinese tool-calling patterns in mind, and other models tend to behave inconsistently in that context.
← djskncxm on gitmyhub — every repo by this author, as a profile.
Verify against the repo before relying on details.