lkimuk/ReArk

What it solves

ReArk is a desktop tool designed to simplify the reverse engineering and security analysis of HarmonyOS and Android applications. It provides a unified workspace for inspecting code, resources, and application behavior, reducing the complexity of using multiple disparate tools for static and dynamic analysis.

How it works

ReArk combines static analysis tools with real-time device interaction. It can disassemble and decompile bytecode for HarmonyOS (.hap, .app, .abc) and Android (.apk, .aab) packages, allowing users to browse package structures and source output. It also integrates with physical devices via HDC and ADB to mirror screens, capture screenshots, and read logs. To enhance analysis, the "ReArk Agent" uses AI models (via OpenAI-compatible endpoints or local Ollama models) to answer contextual questions about the package, retrieve metadata, and execute device operations.

Who it’s for

This tool is targeted at security researchers, malware analysts, and CTF (Capture The Flag) challengers who need to analyze the application logic and review security of mobile apps on these two operating systems.

Highlights

• Multi-platform Support: Supports HarmonyOS and Android application packages.
• AI-Assisted Analysis: The ReArk Agent can query package files, disassembly, and decompiled output using LLMs.
• Device Integration: Real-time screen mirroring, UI node inspection, and device control via mouse and keyboard.
• HarmonyOS Specifics: Specialized tools for ABC bytecode decompilation and application re-signing/repackaging.
• Flexible AI Backend: Compatible with both remote cloud providers and local Ollama models.