ImKKingshuk/LockKnife

LockKnife – A Unified Android Security Research Toolkit

What it is – LockKnife is an open‑source framework that lets a security analyst work on Android devices from a single terminal‑based interface. It combines a full‑screen TUI (the default) with a headless CLI, orchestrated in Python and accelerated with Rust for the heavy‑lifting (hashing, brute‑force, bulk parsing, etc.).

Why it matters – Android forensics, credential recovery, runtime instrumentation and exploitation usually require a handful of separate tools (ADB scripts, ALEAPP, MobSF, Frida, etc.). LockKnife stitches those pieces together into a case‑first workflow: you open a case, run extraction, analyse artifacts, instrument the running app, and generate a chain‑of‑custody report without leaving the terminal.

---

Core capabilities (as of v1.2.0)

Area	What you can do	Status
Device orchestration	ADB device discovery, multi‑device parallel commands, shell execution	✅
Credential recovery	Offline PIN/bruteforce, dictionary attacks, rule‑based password mutation, passkey export (Android 14+)	✅ (offline), 🔬 (device‑side)
Data extraction	SMS, contacts, call logs, browser histories, media with EXIF, location dumps, best‑effort full‑device dump	🔧 / 🔬
Forensics	SQLite bulk export, timeline building, cross‑artifact correlation, snapshotting (root needed)	✅ / 🔬
Reporting	HTML/JSON/CSV, optional PDF, chain‑of‑custody and integrity checks	🔧 / 🔑
APK analysis	Manifest parsing, permission risk scoring, DEX header extraction, lightweight de‑pack, optional YARA scanning	🔑
Runtime instrumentation	Manage Frida sessions, load scripts, memory/heap helpers (requires Frida server)	🔑 / 🔬
Network & exploitation	Wi‑Fi/WPA cracking, Bluetooth discovery, ADB‑over‑TCP, rogue AP, USB‑debug exploits, auto‑exploitation orchestration	🔑
Threat intel & AI	Optional modules for threat‑intel API enrichment and AI‑assisted analysis (extra dependencies)	🔑

How you use it

1. Install – one‑liner installer or Homebrew tap:

   curl -fsSL https://lockknife.vercel.app/install | bash   # macOS/Linux/Windows
   # or macOS only
   brew install ImKKingshuk/tap/lockknife
   

2. Start the workspace – the default launches the full‑screen TUI:

   lockknife
   

   Keybindings let you navigate panels (Tab), open actions (Enter), search (/), export results (e), etc.
3. Headless mode – for scripts or CI pipelines:

   lockknife --cli <subcommand> …
   # e.g. extract SMS from a connected device
   lockknife extract sms --output ./case1
   

4. Classic interactive mode (legacy) – lockknife interactive.

Extensibility

• Python modules under lockknife.core and lockknife.modules are importable, letting you embed the CLI logic in your own scripts.
• Rust extensions handle performance‑critical tasks; they are built automatically when you install from source.
• Optional extras are enabled via extras syntax, e.g. pip install lockknife[frida,yara,ml].

License & safety

• GPL‑3.0‑only – you can modify and redistribute under the same license.
• The README includes a standard disclaimer: the tool is for research/education and must be used with proper authorization.

---

Bottom line – If you need a single, terminal‑centric environment to acquire data from Android devices, run credential‑cracking, analyse APKs, instrument running apps, and produce forensic reports, LockKnife provides that workflow out of the box, with optional AI and threat‑intel integrations for deeper analysis.